aimeat 3.1.0 → 3.3.0

package/dist/src/generated/api-types.d.ts

@@ -1360,6 +1360,141 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/chat/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Whether this node has a built-in chat agent
+         * @description Report whether an operator has configured a chat agent on this node, what the owner's chat
+         *     agent is called, how much of their AI allowance is left, and whether they have their own
+         *     OpenRouter key. A node with no agent says so plainly rather than offering a box that will
+         *     never answer. Owner sessions only.
+         */
+        get: operations["getChatStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/chat/threads": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The owner's open conversations
+         * @description List the owner's live conversations, newest first, without their turns. Older conversations
+         *     roll into one record per month once more than the node's ceiling are open, and those are not
+         *     listed here. Owner sessions only.
+         */
+        get: operations["listChatThreads"];
+        put?: never;
+        /**
+         * Start a conversation
+         * @description Start a conversation and provision the owner's chat agent if this is their first. The agent
+         *     is a real GAII principal that appears in the Agents tab beside the ones they connected
+         *     themselves, and its scopes are edited in the same place. The title is a placeholder until the
+         *     first thing the person says replaces it. Owner sessions only.
+         */
+        post: operations["createChatThread"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/chat/threads/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * One conversation, in full
+         * @description Return one conversation with every turn it holds, including the tool calls the agent made and
+         *     which model answered each turn. A conversation the caller does not own is reported as absent.
+         *     Owner sessions only.
+         */
+        get: operations["getChatThread"];
+        put?: never;
+        post?: never;
+        /**
+         * Throw a conversation away
+         * @description Delete one conversation and its turns. The conversation is looked up first, so a caller who
+         *     cannot see it is told nothing exists rather than being told a deletion happened. Owner
+         *     sessions only.
+         */
+        delete: operations["deleteChatThread"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/chat/threads/{id}/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Forget the agent session, keep the conversation
+         * @description Drop the agent session this conversation runs on. The next message opens a fresh one, which
+         *     is how a change to the chat agent's scopes takes effect: the session's credential carries the
+         *     scopes it was minted with. The conversation itself is untouched. Owner sessions only.
+         */
+        post: operations["resetChatThreadSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/chat/threads/{id}/turn": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Say something, and watch what happens
+         * @description Send one message and receive the agent's work as it happens, as `text/event-stream`. A turn
+         *     takes minutes when the agent is building something, so a single response at the end would be
+         *     indistinguishable from a hang.
+         *
+         *     Each `data:` frame is one update: `{ kind: 'text', text }` as words are written,
+         *     `{ kind: 'thought', text }`, `{ kind: 'tool_call', id, title, status }` as each tool call
+         *     starts and finishes, `{ kind: 'done', stopReason, tokens }` at the end, and
+         *     `{ kind: 'error', message }` when the turn could not run — a node with no agent configured
+         *     answers with exactly that rather than hanging. `:keepalive` comments arrive every 15 s.
+         *
+         *     The person's own words are written to the conversation before the agent is asked anything,
+         *     so a turn that fails halfway leaves a record of what was said. Owner sessions only.
+         */
+        post: operations["sendChatTurn"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/checkin": {
         parameters: {
             query?: never;
@@ -2073,7 +2208,8 @@ export interface paths {
         /**
          * Which side this person lands on (the switch)
          * @description The new home or the old profile. K2: the choice is per USER and stored on the account, so it follows them to another device; a per-tab choice would mean landing on whichever side happened to be the default every morning.
-         *     When nothing has been chosen, `defaulted` is true and the answer comes from the account's cohort (K3): an account created on the remake lands on the home, one created before it lands where it always did. Nobody's workflow changes under them.
+         *     There are three sides: the chat, the new home, and the old profile.
+         *     When nothing has been chosen, `defaulted` is true and the answer comes from the account's cohort (K3): an account created before the remake lands where it always did, so nobody's workflow changes under them. A newer account lands in the chat, which is the one place a person who has connected no AI tool of their own can do something on their first visit — but only on a node that HAS a chat agent. Where there is none, the new home is the answer, since landing somebody in a box that can only say "no agent configured" is worse.
          *     `track` and `switched` are returned read-only, for transparency — no route here changes `track`.
          */
         get: operations["getHomeUiTrack"];
@@ -2571,6 +2707,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/ai/image": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Generate an image on the owner's AI key
+         * @description Makes a picture from a description and stores it in the caller's own storage, answering with
+         *     a key and a URL rather than the image. Bytes returned inline would travel through a tool
+         *     result and an agent's context for nothing, and this node already has a place where files live
+         *     and can be pointed at.
+         *
+         *     Needs an image model: the owner's `imageModel`, or the node's default. With neither it
+         *     refuses as NO_IMAGE_MODEL rather than falling back to a chat model, which would answer an
+         *     image request with prose and leave the caller holding an opaque provider error.
+         *
+         *     Spends the owner's daily AI budget and is refused before the provider is called when that
+         *     budget is used up. Gated like the other AI routes: an owner session, or any principal holding
+         *     `ai:use`.
+         *
+         *     Pass `public: true` when a model or a web page has to fetch the image back by URL; the
+         *     default is private.
+         */
+        post: operations["generateImage"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/ai/transcribe": {
         parameters: {
             query?: never;
@@ -4284,6 +4454,231 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/datapackages": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The caller's own packages
+         * @description One entry per package, pointing at its NEWEST version, plus `lastError` when the most recent
+         *     production run failed. That pairing is the point: a package that has not changed and a
+         *     package whose producer is broken look identical without it.
+         */
+        get: operations["listDataPackages"];
+        put?: never;
+        /**
+         * Publish a data package version
+         * @description Build, check and store one immutable version. The quality gate runs FIRST: if any row fails
+         *     its resource's Table Schema the response is 422 with the row and column of every problem and
+         *     NOTHING is written, so the package stays on its previous version rather than acquiring a
+         *     half-finished one at a permanent address.
+         *
+         *     The version is the content hash of the descriptor, so re-publishing identical data answers
+         *     200 with `unchanged: true` instead of creating a second version — a deterministic producer
+         *     proving it is deterministic is not an update.
+         *
+         *     `schema` per resource is either a Table Schema (declared) or omitted/`infer` (proposed from
+         *     the rows). The descriptor records which, as `aimeat.schemaSource`, so a consumer can see
+         *     whether anybody confirmed the types.
+         */
+        post: operations["publishDataPackage"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/datapackages/validate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Run the quality gate without writing
+         * @description The same check `POST /v1/datapackages` runs, with no side effect: infer or apply each
+         *     resource's Table Schema, validate every row against it, and answer with the coordinates of
+         *     anything wrong plus the schemas that were used. This is what puts a row-and-column error in
+         *     front of a publisher in the browser, before anything is stored.
+         */
+        post: operations["validateDataPackage"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/datapackages/{owner}/{name}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * A package descriptor
+         * @description The Frictionless descriptor for one version. Without `version` the newest is resolved through
+         *     the package's mutable pointer, and the pointer travels back so a consumer can see whether the
+         *     latest production run failed. With `version` the answer is pinned and can never change.
+         *
+         *     No authentication: a published package is public, and a program reading one should not need
+         *     an AIMEAT session. For the raw bytes use the descriptor_url this returns, which is a
+         *     permanent, range-readable /v1/pub address.
+         */
+        get: operations["getDataPackage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/datapackages/{owner}/{name}/versions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Every version of one package
+         * @description Newest first, each with the explanation it was published with, its row count, its size and
+         *     its permanent address. `current: true` marks the one the pointer names, and `supersedes`
+         *     names the version each one replaced, so the history reads as a chain rather than a list of
+         *     hashes.
+         *
+         *     The versions are discovered from the stored keys rather than from an index, so nothing can
+         *     be published without appearing here. How far back it goes is the owner's retention policy.
+         *
+         *     No authentication, for the same reason as the descriptor: a history nobody can see is not a
+         *     history a consumer can rely on.
+         */
+        get: operations["listDataPackageVersions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/datapackages/{owner}/{name}/rows/{resource}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * A window of rows
+         * @description A paginated read for a UI or an agent that wants to look rather than download. For anything
+         *     larger, read the resource's CSV from its permanent address — that is what it is for, and it
+         *     answers byte ranges.
+         */
+        get: operations["readDataPackageRows"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/odata/{owner}/{name}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * OData service document
+         * @description The first thing a native connector fetches: which entity sets this feed offers. One entity
+         *     set per tabular resource in the package.
+         *
+         *     Paste this URL into Excel's "From OData Feed" or Power BI's OData connector and the rest is
+         *     automatic — and the workbook refreshes itself afterwards, which is the whole reason this
+         *     exists next to the CSV address.
+         */
+        get: operations["odataServiceDocument"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/odata/{owner}/{name}/$metadata": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * CSDL metadata (XML)
+         * @description The CSDL v4 document, projected from the package's Table Schema — which is the ONE place
+         *     columns and types are declared, so the metadata cannot drift from the data.
+         *
+         *     XML, not JSON: that is what a v4 metadata document is and what every native connector parses.
+         *     Types map Frictionless to EDM (string→Edm.String, integer→Edm.Int64, number→Edm.Double,
+         *     boolean→Edm.Boolean, date→Edm.Date, datetime→Edm.DateTimeOffset).
+         *
+         *     Every entity gets a synthetic `RowId` key, because OData requires an entity key and a CSV row
+         *     has no identity of its own. It is the row's ordinal within the version, which is stable
+         *     precisely because the version is immutable. Every other property is nullable: a Table Schema's
+         *     `primaryKey` is the only statement anybody made about required-ness.
+         */
+        get: operations["odataMetadata"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/odata/{owner}/{name}/{resource}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * An entity set — the rows
+         * @description The rows of one resource, with the readable subset of the OData query language applied.
+         *
+         *     SUPPORTED: `$select`, `$top`, `$skip`, `$filter`, `$orderby`, `$count`, `$format`.
+         *     `$filter` reads `field eq|ne|gt|ge|lt|le value` clauses joined by `and`, plus
+         *     `contains()`, `startswith()` and `endswith()`.
+         *
+         *     ANYTHING ELSE IS REFUSED, NEVER IGNORED — 501 for a construct this feed does not implement
+         *     (`$expand`, `$apply`, `$search`, `or`, `not`), 400 for a property that does not exist. That
+         *     is the design decision worth knowing: a server that ignores a query option returns MORE ROWS
+         *     THAN THE CLIENT ASKED FOR, and the client puts them in a report as the answer. There is no
+         *     symptom — the numbers are simply wrong. A visibly missing feature is cheap by comparison.
+         *
+         *     `$count=true` reports what the FILTER matched, before `$top`/`$skip`, which is what the option
+         *     means and what a paging client needs.
+         */
+        get: operations["odataEntitySet"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/storage": {
         parameters: {
             query?: never;
@@ -4345,7 +4740,12 @@ export interface paths {
         get: operations["downloadFile"];
         put?: never;
         post?: never;
-        /** Delete file */
+        /**
+         * Delete file
+         * @description Removes one file from the CALLER's own namespace. Irreversible: a stored file has no version history behind it the way a memory record does.
+         *
+         *     Scope: own namespace only. Files are keyed by (owner, key), so a file someone else owns answers 404 here even when the caller is allowed to READ it through `GET /v1/pub/{gaii}/{key}`. There is deliberately no cross-owner delete.
+         */
         delete: operations["deleteFile"];
         options?: never;
         /** File metadata */
@@ -4728,13 +5128,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /**
-         * Accept work re-delivery via OTK (Tier 0.5)
-         * @description Requester accepts re-delivery of disputed work using a one-time key supplied as the `otk`
-         *     query parameter (no bearer auth). Settles payment and resolves the dispute. The OTK owner
-         *     must be the requester on the work.
-         */
-        get: operations["getWorkAcceptRedelivery"];
+        get?: never;
         put?: never;
         /** Requester accepts re-delivery */
         post: operations["acceptRedelivery"];
@@ -4802,12 +5196,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /**
-         * Escalate a work dispute via OTK (Tier 0.5)
-         * @description Escalates a disputed work item to an operator using a one-time key supplied as the `otk`
-         *     query parameter (no bearer auth). Appends a hash-chained audit entry to the dispute.
-         */
-        get: operations["getWorkEscalate"];
+        get?: never;
         put?: never;
         /** Escalate to operator */
         post: operations["escalateDispute"];
@@ -5579,7 +5968,7 @@ export interface paths {
         };
         /**
          * Site map for agents (markdown)
-         * @description One-page map of the node in markdown: the public pages (from the shared public-page registry), the agent documentation (llms.txt, AGENTS.md, the OpenAPI contract, the app building prompt) and the machine-readable discovery endpoints, each with a one-line description. The answer to "what is here and where do I start" that neither sitemap.xml nor the 145 kB llms.txt gives. Apex only — an app origin gets its own (404 until then).
+         * @description One-page map of the node in markdown: the public pages (from the shared public-page registry), the agent documentation (llms.txt, AGENTS.md, the OpenAPI contract, the app building prompt) and the machine-readable discovery endpoints, each with a one-line description. The answer to "what is here and where do I start" that neither sitemap.xml nor the 124 kB llms-full.txt gives. Apex only — an app origin gets its own (404 until then).
          */
         get: operations["sitemapMd"];
         put?: never;
@@ -5599,7 +5988,7 @@ export interface paths {
         };
         /**
          * Orientation for a coding agent (AGENTS.md convention)
-         * @description Short markdown orientation for a coding agent that has met this node as a dependency or an integration target: what AIMEAT is, how to get an identity (RFC 8628 device flow), the identity/scope/morsel vocabulary needed before the first call, worked curl examples, the response-envelope and discovery-header conventions, and links to the full references. Deliberately short — llms.txt is the manual, this is the orientation. Also served at /agents.md. Apex only.
+         * @description Short markdown orientation for a coding agent that has met this node as a dependency or an integration target: what AIMEAT is, how to get an identity (RFC 8628 device flow), the identity/scope/morsel vocabulary needed before the first call, worked curl examples, the response-envelope and discovery-header conventions, and links to the full references. Deliberately short — llms-full.txt is the manual, this is the orientation. Also served at /agents.md. Apex only.
          */
         get: operations["agentsMd"];
         put?: never;
@@ -5618,8 +6007,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Full builder's manual for AI agents (llmstxt.org)
-         * @description The node's complete agent-facing manual: starter templates, the SDK library and library-pack tables (generated from the library-pack registry, so they cannot drift from /v1/libs), core concepts, the device-authorization and MCP connection flows, the response envelope, and the endpoint reference. Opens with a blockquote summary and link-list sections pointing at the site map, AGENTS.md, the OpenAPI contract and the discovery endpoints. On an app origin this path serves THAT app's agent face instead.
+         * Curated index of this node for AI readers (llmstxt.org)
+         * @description The node's curated map, under 8 kB: an H1, a blockquote summary whose first sentence names the full manual at /llms-full.txt, then link-list sections for the documentation, the machine-readable discovery endpoints, the human pages (generated from the shared public-page registry) and an Optional section a reader can skip for a shorter context. This is the first fetch; /llms-full.txt is the manual behind it. On an app origin this path serves THAT app's agent face instead.
          */
         get: operations["llmsTxt"];
         put?: never;
@@ -5638,8 +6027,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Full builder's manual at the conventional full-content path
-         * @description Byte-for-byte the same document as /llms.txt. The llmstxt.org convention splits a link index from the full content; this node's llms.txt has always BEEN the full content, and every published skill, the app-building prompt and robots.txt point at that exact path, so the index moved into the manual rather than the manual moving out from under its readers. Apex only.
+         * Full builder's manual for AI agents (llmstxt.org full content)
+         * @description The node's complete agent-facing manual: starter templates, the SDK library and library-pack tables (generated from the library-pack registry, so they cannot drift from /v1/libs), core concepts, the device-authorization and MCP connection flows, the response envelope, and the endpoint reference. /llms.txt is the curated index over this document, and this is what it points at. Apex only.
          */
         get: operations["llmsFullTxt"];
         put?: never;
@@ -6731,6 +7120,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/admin/roles/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Revoke operator role
+         * @description Removes the operator role from an owner. Operator only. Refuses to revoke the caller's own role and refuses to remove the last operator on the node.
+         */
+        post: operations["revokeRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/help/prompt": {
         parameters: {
             query?: never;
@@ -6908,6 +7317,43 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/admin/organisms/{id}/ownership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read an organism's ownership state (operator)
+         * @description Who holds this organism and who else is in it. Read this before writing: installing an owner
+         *     is a cross-account act, so the roster it re-points should be seen first.
+         *
+         *     Reserved to the node operator. An operator's agent also needs the exact scope
+         *     `operator:organism-repair`, which no wildcard carries.
+         */
+        get: operations["adminGetOrganismOwnership"];
+        put?: never;
+        /**
+         * Install an owner on an organism (operator break-glass)
+         * @description Makes `ghii` the organism's creator. The previous creator stays on as an admin, and a target
+         *     who is not yet a member is seated as one, because the repair case is the organism whose
+         *     reachable people are outside it. A blocked target is refused: lifting a block is its own act.
+         *
+         *     This exists because ownership had no repair path. An admin cannot remove, demote or replace a
+         *     creator, and only the creator can hand the organism on or delete it, so a handover to an
+         *     account that later became unreachable was permanent.
+         *
+         *     Reserved to the node operator. An operator's agent also needs the exact scope
+         *     `operator:organism-repair`, which no wildcard carries and nobody was grandfathered onto.
+         */
+        post: operations["adminInstallOrganismOwner"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/admin/ghii/{ghii}/cors": {
         parameters: {
             query?: never;
@@ -7471,6 +7917,15 @@ export interface paths {
          *     session, so that grant is the whole check it makes; a gated app requested there without one
          *     answers the same `404` an unmapped subdomain does. Ungated apps keep the plain `301`.
          *
+         *     Since 2026-08-15 that `404` has a door in it for people, because the app origin is the
+         *     address they hold: a **browser** (`Accept: text/html`) meeting a **code**-gated app there
+         *     with no usable grant is sent back here with `302 …?mode=inline&unlock=1`, which is the code
+         *     form below. Following it and typing the code produces the grant redirect again, this time
+         *     carrying `unlock=1` alongside `access`, and the origin refuses a second bounce, so a grant
+         *     that will not verify there stops at one round trip instead of ping-ponging. Price-gated apps
+         *     and every non-browser caller keep the uniform `404`: no form can supply the `Bearer` a paid
+         *     app needs.
+         *
          *     **Agent Face (markdown for agents):** a request that prefers `text/markdown` (`Accept`
          *     negotiation, or an explicit `?format=md`) receives the app's markdown read-surface instead
          *     of HTML: the app's **public** `apps.{filename}.agentface` memory record (a markdown string,
@@ -7683,6 +8138,149 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/apps/{owner}/{filename}/screenshot/capture": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Render the published app now and store the screenshot
+         * @description Renders `{owner}/{filename}` in a real headless browser at 1200x750, stores the JPEG, and
+         *     returns the URL of `GET .../screenshot`. The sibling `POST .../screenshot` accepts a picture
+         *     the caller already has; this one takes it.
+         *
+         *     Until this existed the node had no request path that rendered, deliberately: rendering is the
+         *     most expensive thing it does, and an open one is a denial-of-service shape. It exists because
+         *     a caller that has just published an app otherwise cannot see what it made. The publish
+         *     response says the bytes arrived, not that the page works, and a blank screen, a broken layout
+         *     or a script that never ran all answer 200.
+         *
+         *     The screenshot URL needs no authentication, which is what makes it usable as a model input:
+         *     an address a provider can fetch, rather than bytes to carry.
+         *
+         *     Owner or operator only, and throttled per owner. Only published apps can be rendered; a draft
+         *     has no public page.
+         */
+        post: operations["captureAppScreenshot"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/apps/{owner}/{filename}/draft/write": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Append to, or replace, the app's draft
+         * @description Writes a PIECE of the draft. `PUT .../draft` takes the whole app base64-encoded in one
+         *     request, which suits a client that already has the file and is impossible for a caller
+         *     composing one: no model emits 400 kB in a single response. Call this repeatedly with
+         *     `mode: append` until the file is complete, then publish the draft.
+         *
+         *     Content is plain UTF-8 text, not base64. The caller is composing HTML rather than moving a
+         *     file, and base64 would inflate the body by a third for nothing.
+         *
+         *     The size ceiling is checked before anything is written, so a chunk that would push the draft
+         *     past the node's app size limit leaves the previous content intact instead of truncating it.
+         *     Pass `expected_size_bytes` while building across many calls to be refused, rather than
+         *     silently duplicating a chunk, if the draft moved underneath you.
+         */
+        post: operations["writeAppDraft"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/apps/{owner}/{filename}/draft/replace": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Replace an exact passage inside the app's draft
+         * @description The editing counterpart to `.../draft/write`: change part of a draft without sending the
+         *     whole file. `old_string` must match exactly, including indentation and line breaks.
+         *
+         *     Without `replace_all` the match must be unique. Both refusals carry the actual number of
+         *     occurrences, because the caller's next move differs between none and several: none means the
+         *     text is not there at all, and several means the surrounding context has to be widened until
+         *     the target is unambiguous.
+         */
+        post: operations["replaceInAppDraft"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/apps/{owner}/{filename}/draft/lines": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read a line range of the app's draft
+         * @description Returns a slice of the draft as text, plus the total line count and byte size. `GET
+         *     .../draft` returns the WHOLE slot base64-encoded, which is right for a client restoring its
+         *     working copy and wrong for a caller that wants the twenty lines it is about to change.
+         *
+         *     Bounded twice: a request with no range returns the first page with `has_more` set rather than
+         *     the whole app, and a slice that would exceed the character ceiling is cut at a line boundary
+         *     with the same flag. A caller therefore never aims a replacement at text it only half received.
+         */
+        get: operations["readAppDraftLines"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/apps/{owner}/{filename}/draft/seed": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Copy a published version into the app's draft slot
+         * @description Loads a published version's source into the draft, server-side, so an app that is already
+         *     live can be continued. Without it there is nothing to edit: the app read routes serve the
+         *     bytes for download, and every draft write path has always taken its bytes from the caller.
+         *
+         *     Seeding under a different `{filename}` copies the app, manifest and all. The source manifest
+         *     is the base, so the copy keeps the original name and category rather than inheriting from
+         *     whatever happens to live at the destination name.
+         */
+        post: operations["seedAppDraft"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/apps/{owner}/{filename}/draft/preview-token": {
         parameters: {
             query?: never;
@@ -9135,6 +9733,8 @@ export interface paths {
          * @description Create a new organism (club, team, community, or project).
          *     The creator automatically becomes the admin member.
          *     A notification board is created automatically for the organism.
+         *     An owner session passes on being the account holder; every other principal (agent,
+         *     ecosystem app, published app) needs the `organism:write` scope.
          */
         post: operations["createOrganism"];
         delete?: never;
@@ -9553,9 +10153,10 @@ export interface paths {
         put?: never;
         /**
          * Create a workspace in an organism
-         * @description Provision a new workspace under an organism. Requires the `agent` role or the
-         *     `organism:write` scope, and the caller must be an active member. Optional `manifest`,
-         *     `schemas`, and `readme` shape the workspace's object types and content.
+         * @description Provision a new workspace under an organism. The caller must be an active member. An owner
+         *     session passes on being the account holder; every other principal (agent, ecosystem app,
+         *     published app) needs the `organism:write` scope. Optional `manifest`, `schemas`, and `readme`
+         *     shape the workspace's object types and content.
          */
         post: operations["createOrganismWorkspace"];
         delete?: never;
@@ -12237,6 +12838,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/organisms/{id}/owners": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add an owner
+         * @description Make an existing active member a co-owner. Additive: the caller keeps everything, which is the point — ownership used to move in one irreversible step, so an organism whose single owner became unreachable could not be recovered by anyone, and bringing in a second pair of hands cost the first pair everything. Owner only. A blocked target is refused (MEMBER_BANNED); a target who already owns it is ALREADY_OWNER.
+         */
+        post: operations["addOrganismOwner"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/organisms/{id}/owners/{ghii}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove an owner
+         * @description Take an owner off the organism; they stay on as an admin. Owner only, and any owner may remove any other. The LAST owner cannot be removed (LAST_OWNER) — an organism with no owner is the one state nobody inside it can repair. To leave entirely, remove yourself as an owner first and then use the leave route.
+         */
+        delete: operations["removeOrganismOwner"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/organisms/{id}/transfer": {
         parameters: {
             query?: never;
@@ -12248,7 +12889,7 @@ export interface paths {
         put?: never;
         /**
          * Transfer organism ownership
-         * @description The current creator hands the organism to an existing active member; the target becomes creator and the previous creator is demoted to admin. Creator only.
+         * @description Hand the organism to an existing active member in one call: the target is added as an owner and the caller stops being one, staying on as an admin. Owner only. This is POST /v1/organisms/{id}/owners followed by DELETE /v1/organisms/{id}/owners/{caller}, and doing it in those two steps is preferable — the state in between is legal, so it can be looked at before the second step. Kept because clients depend on it; the response carries `owners` alongside the older `creator`/`previousCreator` fields.
          */
         post: operations["transferOrganismOwnership"];
         delete?: never;
@@ -12589,7 +13230,8 @@ export interface paths {
          *     instance_id. Optionally anchored to part of a document (`anchor` = { section } or { quote }),
          *     general (no anchor), or a threaded reply (`parent_id`). Comments are memory-backed under the
          *     workspace meta namespace (excluded from workspace read + content search). Any active member
-         *     or organism agent may comment.
+         *     or organism agent may comment. An owner session passes on being the account holder; every
+         *     other principal (agent, ecosystem app, published app) needs the `organism:write` scope.
          */
         post: operations["addOrganismComment"];
         delete?: never;
@@ -13688,7 +14330,12 @@ export interface paths {
         };
         /** Get capability detail with schemas, examples, exports, dependencies */
         get: operations["capabilityGet"];
-        /** Update own capability */
+        /**
+         * Update own capability
+         * @description Patches the fields the owner controls. The fields the node writes about the record are dropped from the body if they are sent: trust, stats, operatorOverride, rejectionReason, schemaHash, scope, id, ownerGhii, createdAt and updatedAt. trust is the node operator's review and the vouch count, so it is never the owner's to claim; stats counts invocations that really happened. The response carries the stored record, which shows what took.
+         *
+         *     Changing the webhook asks the node's webhook policy the same question POST asks, and is refused with the same three answers: 403 WEBHOOKS_DISABLED, 403 WEBHOOK_DOMAIN_NOT_ALLOWED or 400 INVALID_WEBHOOK_URL. It is asked on a CHANGE of the address the node would call, so sending the whole record back with webhookUrl untouched is accepted whatever the policy, and clearing it is always accepted.
+         */
         put: operations["capabilityUpdate"];
         post?: never;
         /** Delete own manual capability */
@@ -14159,7 +14806,8 @@ export interface paths {
         };
         /**
          * Get task detail
-         * @description Get full task detail including all events and TODO items.
+         * @description Full task detail: TODO items, attachments as presigned handles authorized for this reader, and — once the task has finished — `outcome`: what it actually produced.
+         *     `outcome` carries the agent's own completion message and the address of the deliverable it published. It is absent while the task is still running, because an unfinished task has no outcome and an empty one would read as "finished with nothing". Before this, a completed task answered with `status: "done"` and nothing else: the completion message lived only on the terminal event and the deliverable pointer was stored but never returned, so a caller had to already know that a second, differently-shaped endpoint existed in order to find out what happened. The deliverable comes back as an ADDRESS rather than as content, because an output may be megabytes.
          */
         get: operations["getAgentTask"];
         put?: never;
@@ -14244,6 +14892,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{name}/tasks/{id}/queue": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Release a draft task to the agent
+         * @description Move a draft task to queued, which is the point at which the agent it is for can see it. Owner, or a same-owner app holding task:write. When the target agent's mode is task-runner the task goes straight to active, exactly as it would have at create time, and the response says so in auto_activated.
+         */
+        post: operations["queueAgentTask"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{name}/tasks/{id}/start": {
         parameters: {
             query?: never;
@@ -15794,6 +16462,160 @@ export interface paths {
         patch: operations["updateSharingGroupMember"];
         trace?: never;
     };
+    "/v1/usage/reports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Which usage reports this node can answer, for the calling owner
+         * @description The menu for GET /v1/usage/summary. Cheap and static, so a client (or an agent) never has to guess a report name. Behind the same wallet:read scope as the summary itself.
+         */
+        get: operations["usageReports"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/usage/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One usage report over a date window, for the calling owner only
+         * @description Reads the precomputed serving layer, never a raw table, so the cost of an answer does not grow with the node traffic. Always scoped to the owner behind the session: there is no parameter on this endpoint that can name another owner. The computed_through field in the response states how fresh the precomputed layer is. Requires the wallet:read scope for agent, ecosystem and app-grant sessions (owner sessions bypass scopes): a usage report is the owner's whole spend and activity history, which is the same sensitivity class as their balance.
+         */
+        get: operations["usageSummary"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/usage/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Cross-owner usage reports, or one named owner slice (operator only)
+         * @description The same precomputed layer as GET /v1/usage/summary, without the owner scope. Pass owner to read one person numbers; omit it for the node. Operator role required on every shape.
+         */
+        get: operations["adminUsageSummary"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/usage/reports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Which usage reports exist in each scope (operator only) */
+        get: operations["adminUsageReports"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/usage/calls": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Raw usage-call rows behind the reports (operator only, audited)
+         * @description The operator carries liability for what happens on this node, so anything that can become a legal matter has to be reachable at the call level. The counterweight is that looking is itself recorded: this endpoint writes a usage call of its own (surface operator, the inspected owner as the counterparty), which then appears in the ordinary reports. Only the hot window is served; older rows live in the archive.
+         */
+        get: operations["adminUsageCalls"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/usage/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** How fresh the precomputed usage layer is, and its retention windows (operator only) */
+        get: operations["adminUsageStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/usage/rollup/rebuild": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Clear a bucket range and recompute it from raw (operator only)
+         * @description Needed after a new report cut is declared, whose history would otherwise be empty and read on a chart as never used. Clears the range before re-folding, because the fold adds. Refuses a from older than the raw hot window rather than deleting rollups it could not refill.
+         */
+        post: operations["adminUsageRollupRebuild"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/usage/archive/prune": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Permanently delete archived usage rows before a date (operator only)
+         * @description Deliberately not a scheduled job. Archived rows are what answers a billing dispute or a legal question months later, so the date is required, is never defaulted, and confirm true is required alongside it.
+         */
+        post: operations["adminUsageArchivePrune"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/admin/storage-stats": {
         parameters: {
             query?: never;
@@ -22701,20 +23523,91 @@ export interface components {
             };
             /** @description Max minutes to wait for this step's success signal before timed-out. Default 60 (agent/ecosystem steps) / 1440 (human-input steps). */
             timeout_min?: number;
-            /** @description Absent ⇒ the default agent-dispatch. `export-out` pushes a memory key to a GEAI; `trigger-geai` invokes a GEAI capability (both complete on the tunnel reply). `human-input` parks the run (step state `waiting-human`) and asks the owner a structured question (in-app inbox + push); the run resumes when the owner answers via POST /v1/workflows/{id}/runs/{runId}/steps/{stepId}/answer, or the `on_timeout` policy fires after timeout_min (default 1440 = 24h): fail (timed-out, default) | skip | default (synthesize the answer `default_option`, by "timeout-default"). The answer JSON ({picks, pick, other, answeredAt, by}) is written to `answer_to_key` (templated, sandbox-prefix-honoring) so downstream steps branch on it with deterministic json_field gates — e.g. required_to_function {op: json_field, key: <answer_to_key>, path: pick, equals: approve}. */
+            /** @description Absent ⇒ the default agent-dispatch. `export-out` pushes a memory key to a GEAI; `trigger-geai` invokes a GEAI capability (both complete on the tunnel reply). `human-input` parks the run (step state `waiting-human`) and asks the owner a structured question (in-app inbox + push); the run resumes when the owner answers via POST /v1/workflows/{id}/runs/{runId}/steps/{stepId}/answer, or the `on_timeout` policy fires after timeout_min (default 1440 = 24h): fail (timed-out, default) | skip | default (synthesize the answer `default_option`, by "timeout-default"). The answer JSON ({picks, pick, other, answeredAt, by}) is written to `answer_to_key` (templated, sandbox-prefix-honoring) so downstream steps branch on it with deterministic json_field gates — e.g. required_to_function {op: json_field, key: <answer_to_key>, path: pick, equals: approve}. `extension` runs one of the OWNER'S OWN extension actions on this node, in the sandbox, with no agent session and no model call — the deterministic half of a pipeline (fetch, normalise, hash, write a file) next to the agent steps that interpret. It completes through the same path as an ecosystem step, so its `success_signal` decides green or red; a `success_signal` is REQUIRED on an extension step, because without one the step would go green whenever the script merely returned, whatever it produced. Naming an extension installed by anyone else is refused at save AND at run: an unattended call has no paywall, no contract and no meter, so it would be an unlimited standing call on someone else's capability, API keys and quota. */
             action?: {
                 /** @enum {string} */
-                kind: "agent" | "export-out" | "trigger-geai" | "human-input";
+                kind: "agent" | "export-out" | "trigger-geai" | "human-input" | "extension" | "datapackage";
                 /** @description export-out / trigger-geai: the target GEAI. */
                 geai?: string;
                 /** @description trigger-geai (required) / export-out (default __deposit__). */
                 capability?: string;
                 /** @description export-out: owner memory key whose value is pushed. */
                 from?: string;
-                /** @description trigger-geai: capability input. */
+                /** @description trigger-geai: capability input. extension: the action's input, with `{var}` substituted into its string leaves at dispatch (numbers and booleans pass through unchanged). */
                 input?: {
                     [key: string]: unknown;
                 };
+                /** @description extension: the extension name — must be installed by this workflow's owner. */
+                extension?: string;
+                /** @description extension: the action id on that extension. */
+                action?: string;
+                /** @description extension: run against this named instance (its config, secrets decrypted, arrives as ctx.instance). */
+                instance_id?: string;
+                /** @description extension: owner-namespace key (templated, sandbox-prefix-honoring) the action's RETURN VALUE is written to, so a signal can gate on it — the analogue of `answer_to_key`. It is needed because an extension's own memory lives in the `ext:{name}` namespace while a workflow's signals read owner scope, and those never intersect: a signal pointed at what the extension wrote for itself can only read nothing. Absent `success_signal`, the default gate is that this key is non-empty. A step must declare one or the other. */
+                result_to_key?: string;
+                /** @description datapackage: the package name. It becomes part of the permanent address, so it is a name rather than a sentence. */
+                name?: string;
+                /** @description datapackage: the owner-namespace key an earlier step wrote (its `result_to_key`), {var}-templated. This is the join a repeating package needs and the one no other component can make: an extension step lands its result in the owner's namespace as a PRIVATE record, which the sandbox cannot read back (ctx.memory.get sees `ext:{name}`, getPublic returns only public records). The engine already runs as the owner and already wrote that key. */
+                from_key?: string;
+                /** @description datapackage: dotted path to the rows INSIDE that value. A producer answers with an envelope (`{ ok, total, results }`) far more often than with a bare array, so naming the path is how a workflow says which part of the answer is the table. Omit when the value is the array itself. */
+                rows_at?: string;
+                /** @description extension: call the action repeatedly and merge the pages. Real registries page — `laake-fi` caps at 500 rows on a set of 718, so one call answers `truncated: true` and a package built from it holds five-sevenths of the data with nothing saying so. The merged value keeps the LAST page's envelope with `items_at` replaced by every row collected, plus `pagesFetched` and `complete`. `complete` is false when the loop stopped at `max_pages` rather than at the end of the data, which is what makes "did we get all of it" something a success_signal can assert. */
+                paging?: {
+                    /** @description Input field carrying the offset; set on each call. */
+                    offset_param: string;
+                    /** @description Rows per page, and the increment. */
+                    page_size: number;
+                    /** @description Dotted path to a page's rows. */
+                    items_at: string;
+                    /** @description Dotted path to the reported total. Absent = stop on a short page. */
+                    total_at?: string;
+                    /** @description Hard stop. Required: a producer that never reports completion must not loop forever. */
+                    max_pages: number;
+                };
+                /** @description extension: call the action once per value and merge the answers — the other shape a real producer has. `kumppani` answers about ONE company per call, so a package covering ten companies is ten calls. Paging varies an offset over one query; this varies a parameter over a list. Both merge `items_at` and both add `complete`. A call that fails fails the STEP: ten companies of which one could not be read is not a package about ten companies. */
+                for_each?: {
+                    /** @description The values to iterate; each is {var}-templated. */
+                    values: string[];
+                    /** @description Input field each value is set on. */
+                    param: string;
+                    /** @description Dotted path to the rows in ONE answer. */
+                    items_at: string;
+                };
+                /** @description datapackage: several lists in one answer, published as ONE table with a discriminator. `aiuutiset` answers with topics, actors and sources — the same numbers under a differently-named label each — and `rows_at` names exactly one path, so without this such a producer could only publish a third of what it knows. Each source gets its own `columns` (that is what reconciles topic/actor/source into one `name`) and its own `set` of constant columns (that is the discriminator). When `union` is present the top-level `rows_at` and `columns` are not used. */
+                union?: {
+                    rows_at: string;
+                    columns?: {
+                        [key: string]: string;
+                    };
+                    /** @description Constant columns added to every row from this source. */
+                    set?: {
+                        [key: string]: string;
+                    };
+                }[];
+                /** @description datapackage: column name to a dotted path INSIDE each row. Omit to publish the rows as they are. A Table Schema describes scalars and a real producer answers with nested objects (`buyer: { name, businessId }`) and arrays, so this is the transformation these bindings actually need — the first production run of one refused 200 row problems for exactly that reason. It is a mapping rather than a script on purpose: flattening is declarative and lands in the descriptor as a recorded transformation, where a scripting language in a workflow descriptor would be a sandbox with no boundary. A missing path yields null rather than dropping the column, so a row that lost a field is a visible gap instead of a silently different table; an array at the end of a path is joined with a semicolon. */
+                columns?: {
+                    [key: string]: string;
+                };
+                /** @description datapackage: what moved against the previous version and why, {var}-templated. Required, and required at SAVE as well as at publish — a workflow that discovers the contract at 06:00 has already lost the run it was written for. */
+                changes?: string;
+                /** @description datapackage: the Table Schema the rows must satisfy. Omitting it INFERS from the rows, and for a repeating producer that is the wrong default even though it is the convenient one: inference widens to fit whatever arrived, so a run where the upstream sent a word instead of a number publishes a version whose column is quietly a string, and every consumer's join against it stops matching with no error anywhere. Declared, the same run is refused with the row and the field named, and the package stands on its previous version. */
+                schema?: {
+                    fields?: {
+                        name: string;
+                        type: string;
+                    }[];
+                };
+                /** @description datapackage: resource name, default `rows`. */
+                resource?: string;
+                /** @description datapackage: sources, licence, legal basis and transformations, carried into the descriptor. */
+                provenance?: {
+                    [key: string]: unknown;
+                };
+                /** @description datapackage: how many old versions to keep. */
+                retention_policy?: {
+                    keep?: number;
+                    unit?: string;
+                };
                 /** @description human-input: the structured question (AskUserQuestion-shaped). */
                 question?: {
                     header?: string;
@@ -25504,6 +26397,174 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    getChatStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description `{ enabled, agent_name, allowance_remaining_usd, has_own_key, note? }`. `note` is present
+             *     only when `enabled` is false, and names what an operator has to set.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    listChatThreads: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{ threads: [{ id, title, created_at, updated_at, turns }] }` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    createChatThread: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Optional title. Otherwise taken from the first message. */
+                    title?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description `{ thread: { id, title, createdAt, updatedAt, turns: [] } }` */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    getChatThread: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{ thread: { id, title, createdAt, updatedAt, gooseSessionId?, turns: [{ role, text, at, tools?, model? }] } }` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deleteChatThread: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{ deleted: true }` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    resetChatThreadSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{ reset: true }` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    sendChatTurn: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description What to say. Must not be empty. */
+                    text: string;
+                };
+            };
+        };
+        responses: {
+            /** @description SSE stream of turn updates */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/event-stream": string;
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     agentCheckin: {
         parameters: {
             query?: never;
@@ -26858,7 +27919,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @enum {string} */
-                    ui: "home" | "profile";
+                    ui: "home" | "profile" | "chat";
                 };
             };
         };
@@ -26870,7 +27931,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description ui must be "home" or "profile" */
+            /** @description ui must be "home", "profile" or "chat" */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -27835,6 +28896,101 @@ export interface operations {
             403: components["responses"]["AimeatError"];
         };
     };
+    generateImage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description What the picture should show. */
+                    prompt: string;
+                    /** @description Provider-specific size string, e.g. "1024x1024". Passed through untouched. */
+                    size?: string;
+                    /** @description Where to store it. Defaults to ai-images/<timestamp>-<random>.<ext>. */
+                    storage_key?: string;
+                    /**
+                     * @description Store it publicly readable, so a model or page can fetch it by URL.
+                     * @default false
+                     */
+                    public?: boolean;
+                    /** @description Override the image model. */
+                    model?: string;
+                    /** @description Attribution for the per-app quota and the spend report. */
+                    app_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The image was generated and stored */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            storage_key?: string;
+                            mime_type?: string;
+                            size?: number;
+                            model?: string;
+                            /** @enum {string} */
+                            visibility?: "public" | "private";
+                            url?: string;
+                            usage?: {
+                                cost_usd?: number;
+                                /** @description false when the provider reported no cost; never estimated */
+                                cost_exact?: boolean;
+                            };
+                            budget?: {
+                                daily_budget_usd?: number;
+                                spent_today_usd?: number;
+                                remaining_usd?: number;
+                            };
+                        };
+                    };
+                };
+            };
+            /** @description INVALID_BODY, PROMPT_TOO_LONG, or NO_IMAGE_MODEL when neither the owner nor the node has named one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized, or INVALID_API_KEY when the provider rejected the key */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description QUOTA_EXHAUSTED - the daily budget is spent; nothing was generated */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description RATE_LIMITED by the provider */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description PROVIDER_ERROR - the provider failed; the message carries what it said */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     aiTranscribe: {
         parameters: {
             query?: never;
@@ -30246,6 +31402,393 @@ export interface operations {
             };
         };
     };
+    listDataPackages: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The caller's packages, newest first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    publishDataPackage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Lowercase letters, digits and dashes, 2-64 chars. It is an address segment. */
+                    name: string;
+                    /** @description REQUIRED. What moved against the previous version and why. A version nobody explained is a version a consumer cannot decide about, so this is not optional. */
+                    changes: string;
+                    title?: string;
+                    description?: string;
+                    resources: {
+                        /** @description Becomes data/{name}.csv in the package. */
+                        name: string;
+                        rows: {
+                            [key: string]: unknown;
+                        }[];
+                        /** @description A Table Schema object, or "infer" (the default) to propose one from the rows. */
+                        schema?: "infer" | {
+                            fields: {
+                                name: string;
+                                /** @enum {string} */
+                                type: "string" | "integer" | "number" | "boolean" | "date" | "datetime" | "any";
+                                description?: string;
+                            }[];
+                            /** @description Fields that must be present, non-empty and unique across rows. */
+                            primaryKey?: string[];
+                        };
+                        title?: string;
+                        description?: string;
+                    }[];
+                    /** @description What the producer was asked for — the window, the keywords. Travels in the descriptor. */
+                    parameters?: {
+                        [key: string]: unknown;
+                    };
+                    /** @description Origin, legal basis and licence. The owner is responsible for the data; this is where they say so. */
+                    provenance?: {
+                        sources?: {
+                            url?: string;
+                            title?: string;
+                            retrievedAt?: string;
+                            role?: string;
+                        }[];
+                        /** @description packageIds this was derived from. */
+                        lineage?: string[];
+                        transformations?: {
+                            by?: string;
+                            what?: string;
+                        }[];
+                        legalBasis?: string;
+                        consentStatus?: string;
+                        retention?: string;
+                        license?: string;
+                        supersedes?: string;
+                    };
+                    retentionPolicy?: {
+                        keep?: number;
+                        /** @enum {string} */
+                        unit?: "versions" | "months";
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Identical content was already published — no new version (unchanged is true) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description A new version was written */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The request is malformed (no name, no changes, no resources, a bad resource name) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing storage:write or memory:write */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The quality gate refused — issues[] carries the row and column of each problem */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    validateDataPackage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    resources: {
+                        name: string;
+                        rows: {
+                            [key: string]: unknown;
+                        }[];
+                        /** @description A Table Schema, or "infer" (default). */
+                        schema?: unknown;
+                    }[];
+                };
+            };
+        };
+        responses: {
+            /** @description ok:false with issues[] is a normal answer here — the gate ran and refused. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    getDataPackage: {
+        parameters: {
+            query?: {
+                /** @description sha256:… to pin one version. */
+                version?: string;
+            };
+            header?: never;
+            path: {
+                /** @description Owner name or GHII. */
+                owner: string;
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The descriptor, its permanent URL, and the latest pointer when unpinned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such package or version */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listDataPackageVersions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Owner name or GHII. */
+                owner: string;
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The version list, newest first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such package */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    readDataPackageRows: {
+        parameters: {
+            query?: {
+                version?: string;
+                offset?: number;
+                limit?: number;
+                /** @description Comma-separated field names. */
+                select?: string;
+            };
+            header?: never;
+            path: {
+                owner: string;
+                name: string;
+                resource: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description rows, total, and the Table Schema of what was returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such package, version or resource */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    odataServiceDocument: {
+        parameters: {
+            query?: {
+                /** @description sha256:… to pin the feed to one version, which can then never change under the consumer. */
+                version?: string;
+            };
+            header?: never;
+            path: {
+                owner: string;
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description { "@odata.context": …, "value": [ { name, kind, url } ] } */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such package (OData error shape, not the node envelope) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    odataMetadata: {
+        parameters: {
+            query?: {
+                version?: string;
+            };
+            header?: never;
+            path: {
+                owner: string;
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description CSDL v4 XML */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/xml": string;
+                };
+            };
+            /** @description No such package */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    odataEntitySet: {
+        parameters: {
+            query?: {
+                version?: string;
+                $select?: string;
+                $top?: number;
+                $skip?: number;
+                $filter?: string;
+                $orderby?: string;
+                $count?: boolean;
+            };
+            header?: never;
+            path: {
+                owner: string;
+                name: string;
+                /** @description The entity set name from the service document. */
+                resource: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description { "@odata.context": …, "@odata.count": …, "value": [ … ] } */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description A named property does not exist, or an option is malformed */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such package, version or entity set */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description A query construct this feed does not implement — refused rather than ignored */
+            501: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     listStorage: {
         parameters: {
             query?: never;
@@ -30408,6 +31951,20 @@ export interface operations {
         requestBody?: never;
         responses: {
             200: components["responses"]["AimeatSuccess"];
+            /** @description Anonymous agent outside the `anonymous/` key prefix */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such file in the caller's own namespace */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     fileMetadata: {
@@ -30891,40 +32448,6 @@ export interface operations {
             200: components["responses"]["AimeatSuccess"];
         };
     };
-    getWorkAcceptRedelivery: {
-        parameters: {
-            query: {
-                otk: string;
-            };
-            header?: never;
-            path: {
-                tc: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Re-delivery accepted, dispute resolved */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["AimeatEnvelope"] & {
-                        data?: {
-                            tracking_code?: string;
-                            dispute_resolved?: boolean;
-                            tier?: string;
-                        };
-                    };
-                };
-            };
-            400: components["responses"]["BadRequest"];
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
-        };
-    };
     acceptRedelivery: {
         parameters: {
             query?: never;
@@ -30985,39 +32508,6 @@ export interface operations {
             200: components["responses"]["AimeatSuccess"];
         };
     };
-    getWorkEscalate: {
-        parameters: {
-            query: {
-                otk: string;
-            };
-            header?: never;
-            path: {
-                tc: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Dispute escalated */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["AimeatEnvelope"] & {
-                        data?: {
-                            tracking_code?: string;
-                            dispute_status?: string;
-                            tier?: string;
-                        };
-                    };
-                };
-            };
-            400: components["responses"]["BadRequest"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
     escalateDispute: {
         parameters: {
             query?: never;
@@ -32033,7 +33523,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Builder's manual */
+            /** @description Node index */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -33745,6 +35235,26 @@ export interface operations {
             200: components["responses"]["AimeatSuccess"];
         };
     };
+    revokeRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    owner: string;
+                    /** @enum {string} */
+                    role: "operator";
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
     getHelpPrompt: {
         parameters: {
             query?: never;
@@ -33925,6 +35435,49 @@ export interface operations {
             200: components["responses"]["AimeatSuccess"];
         };
     };
+    adminGetOrganismOwnership: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    adminInstallOrganismOwner: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Bare owner name to install as the organism's creator.
+                     * @example alice
+                     */
+                    ghii: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
     adminSetGhiiCors: {
         parameters: {
             query?: never;
@@ -35170,6 +36723,8 @@ export interface operations {
                 version?: number;
                 /** @description The access code for a protected app (the `X-Access-Code` header carries it too). A browser navigation without it, or with the wrong one, gets an HTML unlock page with a code field rather than JSON; an API caller gets `403 ACCESS_DENIED`. The app's own owner and node operators never need it. With the app origin enabled, a correct code produces a 302 to the app origin carrying a grant, and the code itself is not forwarded. */
                 code?: string;
+                /** @description Set by the app origin when it sends a browser here for the code form, and stamped back onto the grant redirect so the origin can tell a first bounce from a second. A caller never needs to set it; passing it by hand only costs the retry. */
+                unlock?: "1";
                 /** @description A signed draft-preview token (from POST .../draft/preview-token). When present and valid, the app's UNPUBLISHED draft is served instead of the live version (the live app is untouched). On a node with the app origin enabled an apex request is 301-redirected to the isolated origin, preserving the token. */
                 preview?: string;
             };
@@ -35654,6 +37209,308 @@ export interface operations {
             };
         };
     };
+    captureAppScreenshot: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The app was rendered and the screenshot stored */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            filename?: string;
+                            captured?: boolean;
+                            /** @description JPEG size in bytes */
+                            size?: number;
+                            screenshot_url?: string;
+                        };
+                    };
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Not your app */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No published app by that name */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description RATE_LIMITED - the owner's hourly render allowance is used up */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description RENDER_FAILED - the page did not render; the message carries the reason */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description NO_BROWSER - this node has no usable browser to render with */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    writeAppDraft: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The text to write. Plain UTF-8, not base64. */
+                    content: string;
+                    /**
+                     * @default append
+                     * @enum {string}
+                     */
+                    mode?: "append" | "replace";
+                    /** @description Refuse unless the draft currently has exactly this many bytes. */
+                    expected_size_bytes?: number;
+                    /** @description Display name; defaults from the live app, or from the draft once set. */
+                    name?: string;
+                    description?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The piece was written */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            filename?: string;
+                            mode?: string;
+                            size?: number;
+                            /** Format: date-time */
+                            updated_at?: string;
+                            has_live_version?: boolean;
+                            live_version_number?: number;
+                        };
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description DRAFT_CHANGED - the draft is not the size the caller expected; nothing was written */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description TOO_LARGE - the write would exceed the node's app size ceiling; nothing was written */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    replaceInAppDraft: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The exact text to replace, including indentation. */
+                    old_string: string;
+                    new_string: string;
+                    /** @default false */
+                    replace_all?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The replacement was made */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            filename?: string;
+                            replacements?: number;
+                            size?: number;
+                            /** Format: date-time */
+                            updated_at?: string;
+                        };
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description NO_DRAFT, or NOT_FOUND when old_string does not appear in the draft */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description NOT_UNIQUE - old_string appears more than once and replace_all was not set */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    readAppDraftLines: {
+        parameters: {
+            query?: {
+                /** @description First line to return, 1-based. */
+                offset?: number;
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The requested range */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            filename?: string;
+                            size?: number;
+                            total_lines?: number;
+                            from_line?: number;
+                            to_line?: number;
+                            has_more?: boolean;
+                            mime_type?: string;
+                            /** Format: date-time */
+                            updated_at?: string;
+                            content?: string;
+                        };
+                    };
+                };
+            };
+            /** @description INVALID_RANGE - offset is 1-based and limit is at least 1 */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description NO_DRAFT - nothing is staged for this app */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    seedAppDraft: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                owner: string;
+                /** @description The draft slot to write into. */
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description The published app to copy from. Defaults to filename. */
+                    from_filename?: string;
+                    /** @description Which published version. Defaults to the newest. */
+                    version?: number;
+                };
+            };
+        };
+        responses: {
+            /** @description The published source is now in the draft slot */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            filename?: string;
+                            seeded_from?: string;
+                            seeded_version?: number;
+                            size?: number;
+                            /** Format: date-time */
+                            updated_at?: string;
+                        };
+                    };
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description NOT_FOUND - no published app, or no such version, to copy from */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description TOO_LARGE - the published app exceeds the node's current app size ceiling */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     mintAppDraftPreviewToken: {
         parameters: {
             query?: never;
@@ -43861,6 +45718,48 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    addOrganismOwner: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Bare owner name of the active member to make an owner */
+                    ghii: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    removeOrganismOwner: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                ghii: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     transferOrganismOwnership: {
         parameters: {
             query?: never;
@@ -47302,7 +49201,8 @@ export interface operations {
                     /** @description Primary task instructions. The agent crew reads this field as its prompt. */
                     description?: string;
                     /**
-                     * @default draft
+                     * @description queued means the agent can see it; draft holds it for your review and is released later with POST .../{id}/queue.
+                     * @default queued
                      * @enum {string}
                      */
                     status?: "draft" | "queued";
@@ -47522,6 +49422,39 @@ export interface operations {
             409: components["responses"]["Conflict"];
         };
     };
+    queueAgentTask: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                name: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Draft released */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            task?: components["schemas"]["AgentTask"];
+                            /** @description The target agent is a task-runner, so the task is already active. */
+                            auto_activated?: boolean;
+                        };
+                    };
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+        };
+    };
     startAgentTask: {
         parameters: {
             query?: never;
@@ -50821,6 +52754,222 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    usageReports: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Report names with a one-line description of each */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    usageSummary: {
+        parameters: {
+            query?: {
+                /** @description Which report to read. GET /v1/usage/reports lists them with descriptions. */
+                report?: "day" | "model" | "app" | "agent" | "tool" | "surface" | "apps-used" | "activity" | "sold";
+                /** @description Inclusive start day (UTC). Defaults to 30 days ago. */
+                from?: string;
+                /** @description Inclusive end day (UTC). Defaults to today. */
+                to?: string;
+                /** @description Falls back to the grain the report actually materialises. */
+                grain?: "day" | "hour";
+                /** @description Include the per-bucket series a chart needs. */
+                series?: "true" | "false";
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Groups, totals, an optional series, and the freshness of the layer */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    adminUsageSummary: {
+        parameters: {
+            query?: {
+                report?: "day" | "model" | "app" | "app-model" | "agent" | "user" | "tool" | "surface" | "apps-used" | "activity" | "provider";
+                /** @description Bare owner name or full GHII. Omit for a node-wide report. */
+                owner?: string;
+                from?: string;
+                to?: string;
+                grain?: "day" | "hour";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Groups, totals and freshness */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    adminUsageReports: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Node-scope and per-owner report names */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    adminUsageCalls: {
+        parameters: {
+            query?: {
+                /** @description Bare owner name or full GHII. Omit to read across owners. */
+                owner?: string;
+                actor?: string;
+                surface?: "mcp" | "apptool" | "exchange" | "capability" | "app" | "extension" | "http" | "operator";
+                app_id?: string;
+                outcome?: "ok" | "refused" | "error";
+                from?: string;
+                to?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Raw calls, newest first, flagged as audited */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    adminUsageStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Fold watermarks per stream, plus the hot-window settings */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    adminUsageRollupRebuild: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    from: string;
+                    /** @enum {string} */
+                    grain?: "day" | "hour";
+                };
+            };
+        };
+        responses: {
+            /** @description Rows cleared and what was re-folded */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    adminUsageArchivePrune: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    before: string;
+                    confirm: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description What was deleted */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     adminStorageStats: {
         parameters: {
             query?: {