aimeat 1.36.0 → 1.37.0

package/dist/src/data/aimeat-iam-package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aimeat-iam-package.d.ts","sourceRoot":"","sources":["../../../src/data/aimeat-iam-package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AA6S/D,wBAAgB,gBAAgB,IAAI,iBAAiB,CAkBpD"}
+{"version":3,"file":"aimeat-iam-package.d.ts","sourceRoot":"","sources":["../../../src/data/aimeat-iam-package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AA0U/D,wBAAgB,gBAAgB,IAAI,iBAAiB,CAkBpD"}

package/dist/src/data/aimeat-iam-package.js

@@ -1,15 +1,30 @@
 // ── Extension `iam` — server-side enforcement (V8 sandbox: export default async (ctx, input)) ──
 const SCRIPT_CHECK = `export default async function (ctx, input) {
-  const permission = input && input.permission;
-  if (!permission) return { allowed: false, error: 'permission required' };
   const config = (await ctx.memory.get('iam.config')) || {};
   const roles = (await ctx.memory.get('iam.roles')) || {};
+  const levels = (await ctx.memory.get('iam.levels')) || {};
+  const commands = (await ctx.memory.get('iam.commands')) || [];
   const assignments = (await ctx.memory.get('iam.assignments')) || {};
   const caller = ctx.caller && ctx.caller.gaii;
   const role = (caller && assignments[caller]) || config.defaultRole || null;
   const perms = (role && roles[role]) || [];
-  const allowed = perms.indexOf('*') !== -1 || perms.indexOf(permission) !== -1;
-  return { allowed: allowed, role: role, permission: permission };
+  const level = (role && Object.prototype.hasOwnProperty.call(levels, role)) ? levels[role] : null;
+  const has = function (cap) { return perms.indexOf('*') !== -1 || perms.indexOf(cap) !== -1; };
+  // Command mode: check { command } — resolve the command's required capability + mutation tier so the
+  // caller (a human GHII or an agent GAII, identically) knows whether it may run + when to confirm.
+  if (input && input.command) {
+    let cmd = null;
+    for (let i = 0; i < commands.length; i++) { if (commands[i] && commands[i].id === input.command) { cmd = commands[i]; break; } }
+    if (!cmd) return { allowed: false, error: 'unknown command', command: input.command, role: role, level: level };
+    return {
+      allowed: has(cmd.capability), role: role, level: level, command: cmd.id, capability: cmd.capability,
+      tier: cmd.tier || 'write', needsConfirmation: cmd.tier === 'irreversible',
+    };
+  }
+  // Permission mode (legacy — unchanged shape): check { permission }.
+  const permission = input && input.permission;
+  if (!permission) return { allowed: false, error: 'permission or command required' };
+  return { allowed: has(permission), role: role, permission: permission, level: level };
 }`;
 const SCRIPT_ADMIN = `export default async function (ctx, input) {
   const caller = ctx.caller && ctx.caller.gaii;
@@ -21,6 +36,12 @@ const SCRIPT_ADMIN = `export default async function (ctx, input) {
     roles = { admin: ['*'], editor: ['read', 'create', 'edit'], viewer: ['read'] };
     await ctx.memory.set('iam.roles', roles);
   }
+  let levels = await ctx.memory.get('iam.levels');
+  if (!levels) {
+    levels = { admin: 0, editor: 10, viewer: 20 };  // BBS ordinal, lower = more power
+    await ctx.memory.set('iam.levels', levels);
+  }
+  let commands = (await ctx.memory.get('iam.commands')) || [];
   if (op === 'claim') {
     if (!config.ownerGhii) {
       config.ownerGhii = caller;
@@ -31,7 +52,7 @@ const SCRIPT_ADMIN = `export default async function (ctx, input) {
   }
   const isOwner = !config.ownerGhii || config.ownerGhii === caller;
   if (op === 'getState') {
-    return { ok: true, ownerGhii: config.ownerGhii || null, isOwner: isOwner, config: config, roles: roles, assignments: assignments };
+    return { ok: true, ownerGhii: config.ownerGhii || null, isOwner: isOwner, config: config, roles: roles, levels: levels, commands: commands, assignments: assignments };
   }
   if (!isOwner) return { ok: false, error: 'forbidden: owner only' };
   if (op === 'setConfig') {
@@ -43,6 +64,14 @@ const SCRIPT_ADMIN = `export default async function (ctx, input) {
     if (input.roles && typeof input.roles === 'object') { roles = input.roles; await ctx.memory.set('iam.roles', roles); }
     return { ok: true, roles: roles };
   }
+  if (op === 'setLevels') {
+    if (input.levels && typeof input.levels === 'object') { levels = input.levels; await ctx.memory.set('iam.levels', levels); }
+    return { ok: true, levels: levels };
+  }
+  if (op === 'setCommands') {
+    if (Array.isArray(input.commands)) { commands = input.commands; await ctx.memory.set('iam.commands', commands); }
+    return { ok: true, commands: commands };
+  }
   if (op === 'assign') {
     if (input.ghii && input.role) { assignments[input.ghii] = input.role; await ctx.memory.set('iam.assignments', assignments); }
     return { ok: true, assignments: assignments };
@@ -57,8 +86,8 @@ const EXTENSION_IAM = JSON.stringify({
     manifest: [
         'metadata:',
         '  name: iam',
-        '  version: 1.0.0',
-        '  description: In-app role & permission management with server-side enforcement.',
+        '  version: 1.1.0',
+        '  description: In-app role & permission management with server-side enforcement (BBS levels + command manifest).',
         '  author: operator',
         'required_apis:',
         '  - memory',
@@ -66,9 +95,9 @@ const EXTENSION_IAM = JSON.stringify({
         '  - id: check',
         '    method: POST',
         '    path: /check',
-        '    description: Check whether the calling user has a permission. Any authenticated user.',
-        '    input_schema: { type: object, properties: { permission: { type: string } }, required: [permission] }',
-        '    output_schema: { type: object, properties: { allowed: { type: boolean }, role: { type: string } } }',
+        '    description: Check whether the caller may do something — pass { permission } for a raw capability or { command } to resolve an app command (returns its mutation tier + needsConfirmation). Any authenticated user.',
+        '    input_schema: { type: object, properties: { permission: { type: string }, command: { type: string } } }',
+        '    output_schema: { type: object, properties: { allowed: { type: boolean }, role: { type: string }, level: { type: number }, tier: { type: string }, needsConfirmation: { type: boolean } } }',
         '    script: check.js',
         '  - id: admin',
         '    method: POST',

package/dist/src/data/aimeat-iam-package.js.map

@@ -1 +1 @@
-{"version":3,"file":"aimeat-iam-package.js","sourceRoot":"","sources":["../../../src/data/aimeat-iam-package.ts"],"names":[],"mappings":"AAwBA,kGAAkG;AAElG,MAAM,YAAY,GAAG;;;;;;;;;;;EAWnB,CAAC;AAEH,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyCnB,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,QAAQ,EAAE;QACR,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,kFAAkF;QAClF,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,UAAU;QACV,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,2FAA2F;QAC3F,0GAA0G;QAC1G,yGAAyG;QACzG,sBAAsB;QACtB,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,oFAAoF;QACpF,0FAA0F;QAC1F,4EAA4E;QAC5E,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,OAAO,EAAE;QACP,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,YAAY;KACzB;CACF,CAAC,CAAC;AAEH,qGAAqG;AAErG,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4Md,CAAC;AAET,wEAAwE;AAExE,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,yUAAyU;QACtV,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,CAAC;QAC3E,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE;YACxH,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE;SACtH;QACD,eAAe,EAAE;YACf,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,8cAA8c;YAC3d,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC;SAChE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"aimeat-iam-package.js","sourceRoot":"","sources":["../../../src/data/aimeat-iam-package.ts"],"names":[],"mappings":"AAgCA,kGAAkG;AAElG,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BnB,CAAC;AAEH,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDnB,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,QAAQ,EAAE;QACR,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,kHAAkH;QAClH,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,UAAU;QACV,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,yNAAyN;QACzN,6GAA6G;QAC7G,gMAAgM;QAChM,sBAAsB;QACtB,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,oFAAoF;QACpF,0FAA0F;QAC1F,4EAA4E;QAC5E,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,OAAO,EAAE;QACP,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,YAAY;KACzB;CACF,CAAC,CAAC;AAEH,qGAAqG;AAErG,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4Md,CAAC;AAET,wEAAwE;AAExE,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,yUAAyU;QACtV,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,CAAC;QAC3E,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE;YACxH,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE;SACtH;QACD,eAAe,EAAE;YACf,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,8cAA8c;YAC3d,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC;SAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/src/generated/api-types.d.ts

@@ -1250,6 +1250,28 @@ export interface paths {
         patch: operations["updateAgentTags"];
         trace?: never;
     };
+    "/v1/agents/{name}/engagements": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an agent's contract engagements across all workspaces (same-owner)
+         * @description The agent's contract engagements (active + retired) across every organism/workspace, enriched
+         *     with organism + workspace display names — powers the agent-detail Contracts tab. Same-owner
+         *     gated: only the owner sees where their agent works.
+         */
+        get: operations["listAgentEngagements"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/checkin": {
         parameters: {
             query?: never;
@@ -5736,11 +5758,13 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Search the people directory
-         * @description Search the people directory with faceted filtering. Supports filtering
-         *     by type, city, area, country, interests, and geo-radius. Returns
-         *     paginated results with facet counts for cities and interests.
-         *     No authentication required (Tier 0).
+         * Search the people directory (the member "phone book")
+         * @description Search the people directory with faceted filtering (type, city, area, country,
+         *     interests, geo-radius) with facet counts.
+         *
+         *     Privacy (2026-07-03): **requires authentication** — you must be a signed-in user to
+         *     browse the directory (the anonymous internet is rejected). Entries are opt-in: only
+         *     profiles that chose to be listed appear.
          */
         get: operations["searchDirectory"];
         put?: never;
@@ -5924,6 +5948,10 @@ export interface paths {
          *     enumerable only by the member themself (authenticated as that owner or
          *     one of their agents) or an operator — for anyone else the member filter
          *     degrades to public organisms only (no private-membership disclosure).
+         *
+         *     Roster privacy: each returned organism's `members`/`agentGaiis` arrays are
+         *     redacted to `[]` when the caller is below that organism's `member_visibility`
+         *     tier; `member_count` (pre-redaction) and `members_hidden` are attached per item.
          */
         get: operations["listOrganisms"];
         put?: never;
@@ -5951,6 +5979,11 @@ export interface paths {
          * Get organism detail
          * @description Get detailed information about a specific organism including
          *     member count and board reference.
+         *
+         *     Roster privacy: when the caller is below the organism's `member_visibility`
+         *     tier, `organism.members`/`organism.agentGaiis` come back as `[]` and
+         *     `members_hidden: true` is set. `your_membership` ({ role, status } or null)
+         *     always answers "am I a member" for the caller; `member_count` stays.
          */
         get: operations["getOrganism"];
         /**
@@ -6022,9 +6055,12 @@ export interface paths {
         };
         /**
          * List organism members
-         * @description List all members of an organism. Public organisms show members
-         *     to anyone. Private organisms require membership to view.
-         *     Supports pagination.
+         * @description List an organism's members, gated by the organism's `member_visibility`
+         *     tier ('public' | 'authenticated' (default) | 'members' | 'admins').
+         *     Below the tier the listing shrinks to the ACCOUNTABILITY rows — the
+         *     creator/admin rows plus the caller's own row — with `members_hidden: true`
+         *     and the TRUE `total` (a count is not an identity). Creator/admins and
+         *     operators always see the full roster.
          *
          *     When the caller is an ACTIVE member of the organism (or an operator),
          *     each member row additionally carries `agents: [{gaii, name}]` — the
@@ -6064,11 +6100,13 @@ export interface paths {
          */
         get: operations["getOrganismWorkspace"];
         /**
-         * Update a workspace's name and/or readme in place
-         * @description Update a workspace's editable metadata **in place** — its `name` and/or `readme` — without
-         *     changing its id, objectTypes, schemas, sections or content (so nothing that references it gets
-         *     orphaned). The name is kept in sync across both places it lives: the manifest
-         *     (`meta.manifest.name`) and the organism's workspace registry (`meta.workspaces[].name`).
+         * Update a workspace's definition in place (name/readme/structure/schemas/apps)
+         * @description Update a workspace **in place** — its `name`, `readme`, its whole structure (a full
+         *     replacement `manifest`, or safe additive `add_spaces`), record `schemas`, and/or the `apps`
+         *     pinned to it — without changing its id (so nothing that references it gets orphaned). The
+         *     name is kept in sync across both places it lives: the manifest (`meta.manifest.name`) and
+         *     the organism's workspace registry (`meta.workspaces[].name`). App bindings live in their own
+         *     `…meta.apps` record, so a manifest replace never clobbers them.
          *     Creator-only (or an org admin). Mirrors the `aimeat_workspace_update` MCP tool.
          */
         put: operations["updateOrganismWorkspace"];
@@ -6282,6 +6320,56 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/organisms/{id}/workspace/engagements": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a workspace's contract engagements (active + retired)
+         * @description The first-class binding between an agent's contract capability and a workspace, with an
+         *     active/retired lifecycle — distinct from the derived "active here" record trace. Member-gated.
+         */
+        get: operations["listWorkspaceEngagements"];
+        put?: never;
+        /**
+         * Adopt (activate) a contract engagement for one of your agents
+         * @description Writes an ACTIVE engagement for (agent × contract × workspace) — the source of truth an agent's
+         *     processing loop obeys. The caller must own the agent and be an organism member. Typically paired
+         *     with the adopt-contract task so the agent provisions the contract's spaces itself.
+         */
+        post: operations["activateWorkspaceEngagement"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/organisms/{id}/workspace/engagements/retire": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Retire a contract engagement (real off-switch)
+         * @description Flips an engagement to `retired` (kept as history: who served here, until when). The agent's
+         *     processing loop then skips this workspace. Allowed for the agent's OWNER or the workspace
+         *     creator/admin. Creates a retired marker even with no prior active engagement, so an agent that
+         *     started working before contracts were first-class can still be retired.
+         */
+        post: operations["retireWorkspaceEngagement"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/organisms/{id}/workspace/export": {
         parameters: {
             query?: never;
@@ -6595,7 +6683,19 @@ export interface paths {
          */
         get: operations["listNotifications"];
         put?: never;
-        post?: never;
+        /**
+         * Notify the caller's own owner (bell + browser push)
+         * @description Create a notification for the CALLER's OWN owner — self-targeted only; there is no way to
+         *     notify an arbitrary owner. The notification lands in the header bell and, when the owner
+         *     has a web-push subscription, is mirrored as a browser push whose click opens `link`.
+         *
+         *     Owner sessions may always call this. Agent sessions need the `notifications:send` scope.
+         *     App-grant sessions (role `app`) need `notifications:send` in their grant; an app
+         *     notification gets the app's name prefixed to the title (provenance) and `link` defaults to
+         *     the app's own open URL (`/v1/apps/{owner}/{file}?mode=inline`) so the click reopens the app.
+         *     Delivery is best-effort (`created: true` confirms acceptance, not push delivery).
+         */
+        post: operations["createNotification"];
         delete?: never;
         options?: never;
         head?: never;
@@ -12117,10 +12217,11 @@ export interface components {
         /** @enum {string} */
         DisputeStatus: "open" | "contested" | "escalated" | "resolved";
         /**
+         * @description Access level. `members` (any logged-in user of this node) and `group` apply to memory records; storage files accept private/owner/public only.
          * @default private
          * @enum {string}
          */
-        Visibility: "private" | "owner" | "group" | "public";
+        Visibility: "private" | "owner" | "group" | "members" | "public";
         /** @enum {string} */
         DisputeEventType: "dispute_opened" | "counter_dispute" | "message" | "re_delivery" | "accept_redelivery" | "withdraw_dispute" | "accept_fault" | "partial_offer" | "partial_accepted" | "partial_rejected" | "escalated" | "operator_ruled" | "timeout_resolved";
         AimeatEnvelope: {
@@ -14980,7 +15081,7 @@ export interface operations {
                 /** @description Optional key prefix filter. */
                 prefix?: string;
                 /** @description Optional visibility filter. */
-                visibility?: "private" | "owner" | "group" | "public";
+                visibility?: "private" | "owner" | "group" | "members" | "public";
             };
             header?: never;
             path: {
@@ -16930,6 +17031,29 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    listAgentEngagements: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Agent name or URL-encoded GAII */
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description { agent, engagements: [{ organism_id, ws, agent, contract, state, adoptedAt, retiredAt, organismName, wsName }] } */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     agentCheckin: {
         parameters: {
             query?: never;
@@ -17657,7 +17781,7 @@ export interface operations {
             query?: {
                 page?: components["parameters"]["Pagination"];
                 per_page?: components["parameters"]["PerPage"];
-                visibility?: "private" | "owner" | "group" | "public";
+                visibility?: "private" | "owner" | "group" | "members" | "public";
                 /** @description Comma-separated tag filter */
                 tags?: string;
                 /** @description Filter keys by prefix (e.g. "shared:" returns all shared:* keys) */
@@ -17831,7 +17955,7 @@ export interface operations {
             query: {
                 /** @description Search query */
                 q: string;
-                visibility?: "private" | "owner" | "group" | "public";
+                visibility?: "private" | "owner" | "group" | "members" | "public";
                 /** @description Exclude entries with flagCount exceeding this value (Phase 1.5 data quality filter) */
                 max_flags?: number;
                 /** @description Scope the search to keys beginning with this prefix (e.g. a namespace/group like "organism.{id}.") */
@@ -17888,7 +18012,7 @@ export interface operations {
                         key: string;
                         value: unknown;
                         /** @enum {string} */
-                        visibility?: "private" | "owner" | "group" | "public";
+                        visibility?: "private" | "owner" | "group" | "members" | "public";
                         tags?: string[];
                         ttl_hours?: number;
                     }[];
@@ -18451,7 +18575,7 @@ export interface operations {
                      * @default private
                      * @enum {string}
                      */
-                    visibility?: "private" | "owner" | "group" | "public";
+                    visibility?: "private" | "owner" | "group" | "members" | "public";
                 };
             };
         };
@@ -24734,6 +24858,12 @@ export interface operations {
                      * @enum {string}
                      */
                     visibility?: "public" | "unlisted" | "private";
+                    /**
+                     * @description Who may see the member ROSTER (the members/agentGaiis fields and the /members listing). Unset = authenticated (any signed-in caller) — the anonymous internet never sees rosters. 'public' is a deliberate opt-in. Creator + admins stay visible at every tier (accountability); admins/operator always see the roster.
+                     * @default authenticated
+                     * @enum {string}
+                     */
+                    member_visibility?: "public" | "authenticated" | "members" | "admins";
                 };
             };
         };
@@ -24773,7 +24903,17 @@ export interface operations {
                 };
                 content: {
                     "application/json": components["schemas"]["AimeatEnvelope"] & {
-                        data?: components["schemas"]["OrganismRecord"];
+                        data?: {
+                            organism?: components["schemas"]["OrganismRecord"];
+                            member_count?: number;
+                            readme?: string | null;
+                            /** @description True when the roster was redacted for this caller */
+                            members_hidden?: boolean;
+                            your_membership?: {
+                                role?: string;
+                                status?: string;
+                            } | null;
+                        };
                     };
                 };
             };
@@ -24812,6 +24952,11 @@ export interface operations {
                     joinPolicy?: "open" | "approval" | "invite";
                     /** @enum {string} */
                     visibility?: "public" | "unlisted" | "private";
+                    /**
+                     * @description Who may see the member roster. 'public' = anyone (deliberate opt-in), 'authenticated' = signed-in callers (the default), 'members' = active members, 'admins' = creator/admins only.
+                     * @enum {string}
+                     */
+                    member_visibility?: "public" | "authenticated" | "members" | "admins";
                 };
             };
         };
@@ -25012,6 +25157,15 @@ export interface operations {
                             manifest?: Record<string, never> | null;
                             /** @description Markdown readme at organism.{id}.meta.readme */
                             readme?: unknown;
+                            /** @description Apps pinned to this workspace (the `…meta.apps` binding record; empty when none). Pinning is presentation/launch-context only — workspace data access stays gated per call. */
+                            apps?: {
+                                /** @description Publishing owner of the app */
+                                owner?: string;
+                                /** @description App filename under /v1/apps/{owner}/{filename} */
+                                filename?: string;
+                                /** @description Optional display label override */
+                                label?: string;
+                            }[];
                             /** @description Records keyed by the manifest's objectType name */
                             objects?: {
                                 [key: string]: unknown[];
@@ -25047,6 +25201,20 @@ export interface operations {
                     name?: string;
                     /** @description New markdown readme/intro (replaces the current one) */
                     readme?: string;
+                    /** @description FULL replacement manifest (objectTypes + policy/gate + settings). For genuine restructuring; to only add spaces prefer `add_spaces`. */
+                    manifest?: Record<string, never>;
+                    /** @description ADDITIVE objectTypes to UNION into the manifest (skip-if-exists, defaults filled). Alias `add_object_types` is also accepted. */
+                    add_spaces?: Record<string, never>[];
+                    /** @description Map of namespace → JSON Schema, locked (strict) for that space's records. */
+                    schemas?: {
+                        [key: string]: Record<string, never>;
+                    };
+                    /** @description FULL replacement list of apps pinned to this workspace (`[]` clears; max 50). Each entry references a published app (/v1/apps/{owner}/{filename}). Pinning is presentation/launch-context only — workspace data access stays gated per call. */
+                    apps?: {
+                        owner: string;
+                        filename: string;
+                        label?: string;
+                    }[];
                 };
             };
         };
@@ -25059,7 +25227,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["AimeatEnvelope"] & {
                         data?: {
-                            /** @description Which records changed: manifest / registry / readme */
+                            /** @description Which records changed: manifest / registry / readme / schemas / apps */
                             updated?: string[];
                             creator?: string;
                             name?: string;
@@ -25352,7 +25520,7 @@ export interface operations {
                  * @description `enrichment` folds the per-workspace getWorkspace+activity+participants fan-out into this one
                  *     response: each readable workspace gains `enrichment: { hasManifest, recs, docs,
                  *     lastEvent:{type,instance,action,at}|null, participants:[{owner,node,isLocalNode,isCreator,isSelf,agentsCount}],
-                 *     pendingReviews }`. Workspaces with `access:none` carry no enrichment.
+                 *     pendingReviews, apps:[{owner,filename,label?}] }`. Workspaces with `access:none` carry no enrichment.
                  */
                 include?: "enrichment";
             };
@@ -25475,6 +25643,103 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    listWorkspaceEngagements: {
+        parameters: {
+            query: {
+                /** @description Workspace id */
+                ws: string;
+            };
+            header?: never;
+            path: {
+                /** @description Organism ID */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description { ws, engagements: [{ organism_id, ws, agent, owner, agentName, contract, state, adoptedAt, adoptedBy, retiredAt, retiredBy }] } */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    activateWorkspaceEngagement: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organism ID */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Workspace id */
+                    ws: string;
+                    /** @description The agent (full GAII or bare name — must be owned by the caller) */
+                    agent: string;
+                    /** @description Contract id (a contract.<id> tag); omit for the bare workspace-contract marker */
+                    contract?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description { engagement } */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    retireWorkspaceEngagement: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organism ID */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Workspace id */
+                    ws: string;
+                    /** @description The agent (full GAII or bare name) */
+                    agent: string;
+                    /** @description Contract id; omit for the bare marker */
+                    contract?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description { engagement } */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     exportWorkspace: {
         parameters: {
             query: {
@@ -25975,6 +26240,46 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
+    createNotification: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Short title shown in the bell and push */
+                    title: string;
+                    /** @description Optional longer context */
+                    body?: string;
+                    /** @description Same-node path the notification deep-links to (must start with '/'), e.g. '/v1/profile?tab=messages' */
+                    link?: string;
+                    /** @description Machine type; defaults to 'app' / 'agent' / 'custom' by caller role */
+                    type?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Notification accepted ({ created: true, link }) */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description Missing notifications:send scope */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     markNotificationsRead: {
         parameters: {
             query?: never;