disk 0.8.17 → 0.8.19

package/dist/index.d.cts

@@ -1,2150 +1,219 @@
-import { Client } from 'openapi-fetch';
-
-/**
- * This file was auto-generated by openapi-typescript.
- * Do not make direct changes to the file.
- */
-
-interface paths {
-    "/api/disks": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List all disks
-         * @description Returns all disks owned by the authenticated account.
-         */
-        get: operations["listDisks"];
-        put?: never;
-        /**
-         * Create a new disk
-         * @description Creates a new disk with the specified configuration. A default token
-         *     user is automatically generated and returned in the response, so the
-         *     disk is immediately mountable. The one-time token appears in
-         *     `authorizedUsers[].token` and cannot be retrieved again.
-         *
-         *     To provide your own users instead, pass the deprecated `authMethods`
-         *     field or call AddDiskUser after creation.
-         */
-        post: operations["createDisk"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/disks/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get disk details
-         * @description Returns detailed information about a specific disk.
-         */
-        get: operations["getDisk"];
-        put?: never;
-        post?: never;
-        /**
-         * Delete a disk
-         * @description Deletes a disk and all associated resources.
-         */
-        delete: operations["deleteDisk"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/disks/{id}/users": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Add user to disk
-         * @description Adds an authorized user to a disk. Users can authenticate via:
-         *     - **token**: A shared token with a nickname and 4-character suffix
-         *     - **awssts**: AWS STS role assumption with an IAM principal ARN
-         */
-        post: operations["addDiskUser"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/disks/{id}/users/{userType}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /**
-         * Remove user from disk
-         * @description Removes an authorized user from a disk.
-         */
-        delete: operations["removeDiskUser"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/disks/{id}/allowed-ips": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get IP allowlist
-         * @description Returns the current IP allowlist for a disk.
-         */
-        get: operations["getAllowedIPs"];
-        /**
-         * Set IP allowlist
-         * @description Replaces the IP allowlist for a disk. When non-empty, only clients connecting from listed IPs or CIDR ranges can mount the disk. Pass an empty array to remove all restrictions.
-         */
-        put: operations["setAllowedIPs"];
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/disks/{id}/exec": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Execute a command on a disk
-         * @description Launches a container with the specified disk mounted, runs the given
-         *     command to completion, and shuts down the container. Returns immediately
-         *     with the container info; poll the container endpoint for completion.
-         */
-        post: operations["execDisk"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/disks/{id}/grep": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Constant-time parallel grep over a directory on a disk
-         * @description Searches files under a directory on the disk for lines matching a
-         *     regular expression. Listing and matching are fanned out across
-         *     ephemeral exec containers, so the request finishes within the user's
-         *     time budget regardless of the size of the directory.
-         *
-         *     The user controls cost and latency with three knobs:
-         *
-         *     - `maxDurationSeconds` is the wall-clock deadline.
-         *     - `concurrency` is the maximum number of parallel grep workers.
-         *       Higher concurrency finishes larger datasets within the deadline;
-         *       the controlplane clamps to the runtime fleet's current capacity.
-         *     - `maxResults` causes the search to short-circuit after the
-         *       aggregator has collected this many matches.
-         *
-         *     With `recursive: false` only files directly under `directory` are
-         *     searched. With `recursive: true` subdirectories are walked
-         *     breadth-first and grep workers are dispatched as soon as each level
-         *     finishes listing — listing and matching overlap.
-         *
-         *     The matches returned when stopping early on `maxResults` are a sample
-         *     of whichever workers reported first, not the lexicographically first
-         *     N. The response surfaces `stoppedReason` so callers can distinguish
-         *     completion from early termination.
-         */
-        post: operations["grepDisk"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/exec": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Execute a command with multiple disks mounted
-         * @description Launches a container with the supplied set of disks each mounted at its
-         *     own relative path under `/mnt/archil`, runs the command to completion,
-         *     and shuts down the container. Activation is atomic: every disk mounts
-         *     or none of them do.
-         *
-         *     Relative paths must be non-empty, non-absolute, and contain no `.` /
-         *     `..` segments. Mounting two disks at the same relative path is an
-         *     error.
-         */
-        post: operations["exec"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/tokens": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List API tokens
-         * @description Returns all API tokens for the authenticated account.
-         */
-        get: operations["listApiTokens"];
-        put?: never;
-        /**
-         * Create API token
-         * @description Creates a new API token for programmatic access. The full token value
-         *     is only returned once at creation time.
-         */
-        post: operations["createApiToken"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/tokens/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /**
-         * Delete API token
-         * @description Revokes and deletes an API token.
-         */
-        delete: operations["deleteApiToken"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-}
-interface components {
-    schemas: {
-        ErrorResponse: {
-            /** @example false */
-            success: boolean;
-            /** @example Invalid request parameters */
-            error: string;
-        };
-        ApiResponse_Empty: {
-            /** @example true */
-            success: boolean;
-        };
-        ApiResponse_Message: {
-            /** @example true */
-            success: boolean;
-            data: {
-                message?: string;
-            };
-        };
-        CreateDiskRequest: {
-            /**
-             * @description Disk name (alphanumeric, dashes, underscores)
-             * @example my-data-disk
-             */
-            name: string;
-            /** @description Storage mount to attach. Omit for archil-managed storage. */
-            mounts?: components["schemas"]["MountConfig"][];
-            /**
-             * @description IP allowlist for mount access. When non-empty, only clients connecting from these IPs or CIDR ranges can mount the disk. An empty list (default) allows all IPs.
-             * @example [
-             *       "203.0.113.0/24",
-             *       "198.51.100.42"
-             *     ]
-             */
-            allowedIps?: string[];
-            /**
-             * @deprecated
-             * @description Deprecated. Use AddDiskUser after creation instead. When provided, suppresses the default auto-generated token user.
-             */
-            authMethods?: components["schemas"]["DiskUser"][];
-        };
-        MountConfig: components["schemas"]["S3Mount"] | components["schemas"]["GCSMount"] | components["schemas"]["R2Mount"] | components["schemas"]["S3CompatibleMount"] | components["schemas"]["AzureBlobMount"];
-        /**
-         * S3
-         * @description Mount configuration for Amazon S3 buckets
-         */
-        S3Mount: {
-            /**
-             * @description Mount type identifier (enum property replaced by openapi-typescript)
-             * @enum {string}
-             */
-            type: "s3";
-            /**
-             * @description S3 bucket name
-             * @example my-bucket
-             */
-            bucketName: string;
-            /** @description AWS access key ID (optional for public buckets or IAM role auth) */
-            accessKeyId?: string;
-            /**
-             * Format: password
-             * @description AWS secret access key
-             */
-            secretAccessKey?: string;
-            /** @description Session token for temporary credentials */
-            sessionToken?: string;
-            /**
-             * @description Prefix within the bucket
-             * @example data/
-             */
-            bucketPrefix?: string;
-        };
-        /**
-         * Google Cloud Storage
-         * @description Mount configuration for Google Cloud Storage buckets
-         */
-        GCSMount: {
-            /**
-             * @description Mount type identifier (enum property replaced by openapi-typescript)
-             * @enum {string}
-             */
-            type: "gcs";
-            /**
-             * @description GCS bucket name
-             * @example my-gcs-bucket
-             */
-            bucketName: string;
-            /** @description HMAC access key ID */
-            accessKeyId: string;
-            /**
-             * Format: password
-             * @description HMAC secret access key
-             */
-            secretAccessKey: string;
-            /**
-             * @description Prefix within the bucket (optional)
-             * @example data/
-             */
-            bucketPrefix?: string;
-        };
-        /**
-         * Cloudflare R2
-         * @description Mount configuration for Cloudflare R2 buckets
-         */
-        R2Mount: {
-            /**
-             * @description Mount type identifier (enum property replaced by openapi-typescript)
-             * @enum {string}
-             */
-            type: "r2";
-            /**
-             * @description R2 bucket name
-             * @example my-r2-bucket
-             */
-            bucketName: string;
-            /**
-             * @description R2 endpoint URL
-             * @example https://accountid.r2.cloudflarestorage.com
-             */
-            bucketEndpoint: string;
-            /** @description R2 access key ID */
-            accessKeyId: string;
-            /**
-             * Format: password
-             * @description R2 secret access key
-             */
-            secretAccessKey: string;
-            /**
-             * @description Prefix within the bucket (optional)
-             * @example data/
-             */
-            bucketPrefix?: string;
-        };
-        /**
-         * S3-Compatible
-         * @description Mount configuration for S3-compatible storage (MinIO, Backblaze B2, etc.)
-         */
-        S3CompatibleMount: {
-            /**
-             * @description Mount type identifier (enum property replaced by openapi-typescript)
-             * @enum {string}
-             */
-            type: "s3-compatible";
-            /**
-             * @description Bucket name
-             * @example my-bucket
-             */
-            bucketName: string;
-            /**
-             * @description S3-compatible endpoint URL
-             * @example https://s3.us-west-001.backblazeb2.com
-             */
-            bucketEndpoint: string;
-            /** @description Access key ID */
-            accessKeyId: string;
-            /**
-             * Format: password
-             * @description Secret access key
-             */
-            secretAccessKey: string;
-            /**
-             * @description Prefix within the bucket (optional)
-             * @example data/
-             */
-            bucketPrefix?: string;
-        };
-        /**
-         * Azure Blob Storage
-         * @description Mount configuration for Azure Blob Storage containers
-         */
-        AzureBlobMount: {
-            /**
-             * @description Mount type identifier (enum property replaced by openapi-typescript)
-             * @enum {string}
-             */
-            type: "azure-blob";
-            /**
-             * @description Azure blob container name
-             * @example my-container
-             */
-            containerName: string;
-            /**
-             * @description Azure blob endpoint URL (optional if storageAccountName provided)
-             * @example https://myaccount.blob.core.windows.net
-             */
-            endpoint?: string;
-            /**
-             * @description Azure storage account name (used to derive endpoint if not provided)
-             * @example myaccount
-             */
-            storageAccountName?: string;
-            /** @description Azure AD tenant ID */
-            tenantId: string;
-            /** @description Azure AD application client ID */
-            clientId: string;
-            /**
-             * Format: password
-             * @description Azure AD application client secret
-             */
-            clientSecret: string;
-            /**
-             * @description Prefix within the container
-             * @example data/
-             */
-            bucketPrefix?: string;
-        };
-        TokenUser: {
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "token";
-            /**
-             * @deprecated
-             * @description Deprecated. Client-provided token. If omitted, the server generates a cryptographically secure token and returns it in the response.
-             */
-            principal?: string;
-            nickname: string;
-            /**
-             * @deprecated
-             * @description Deprecated. Last 4 characters of the token. Required when principal is provided; ignored when the server generates the token.
-             */
-            tokenSuffix?: string;
-        };
-        AwsStsUser: {
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "awssts";
-            /** @description IAM principal ARN */
-            principal: string;
-        };
-        DiskUser: components["schemas"]["TokenUser"] | components["schemas"]["AwsStsUser"];
-        DiskResponse: {
-            /**
-             * @description Disk ID
-             * @example dsk-0123456789abcdef
-             */
-            id: string;
-            /** @description Disk name */
-            name: string;
-            /** @description Owning organization ID */
-            organization: string;
-            /**
-             * @description Disk status
-             * @enum {string}
-             */
-            status: "available" | "creating" | "deleting" | "deleted" | "failed";
-            /** @description Filesystem handler status */
-            fsHandlerStatus?: string;
-            /** @description Cloud provider */
-            provider: string;
-            /** @description Disk region (e.g., aws-us-east-1, gcp-us-central1) */
-            region: string;
-            /**
-             * Format: date-time
-             * @description Creation timestamp
-             */
-            createdAt: string;
-            /**
-             * Format: date-time
-             * @description Last access timestamp
-             */
-            lastAccessed?: string;
-            /**
-             * Format: int64
-             * @description Total data size in bytes
-             */
-            dataSize?: number;
-            /** @description Monthly usage amount formatted as a currency string (e.g., "$1.23") */
-            monthlyUsage?: string;
-            mounts?: components["schemas"]["MountResponse"][];
-            metrics?: components["schemas"]["DiskMetrics"];
-            connectedClients?: components["schemas"]["ConnectedClient"][];
-            authorizedUsers?: components["schemas"]["AuthorizedUser"][];
-            /**
-             * @description IP allowlist for mount access. Empty means all IPs are allowed.
-             * @example [
-             *       "203.0.113.0/24"
-             *     ]
-             */
-            allowedIps?: string[];
-            /**
-             * @description Capabilities supported by this disk. Determined at creation
-             *     time and immutable thereafter. Defined values:
-             *
-             *     * `checkpoints` — checkpoints can be created on this disk. Not
-             *       available for disks with bring-your-own buckets.
-             * @example [
-             *       "checkpoints"
-             *     ]
-             */
-            capabilities?: "checkpoints"[];
-        };
-        MountResponse: {
-            /** @description Mount identifier */
-            id?: string;
-            /**
-             * @description Storage backend type
-             * @enum {string}
-             */
-            type?: "s3" | "gcs" | "r2" | "s3-compatible" | "azure-blob";
-            /** @description Mount path */
-            path?: string;
-            /** @description Bucket/container name */
-            name?: string;
-            /**
-             * @description Access mode
-             * @example rw
-             * @enum {string}
-             */
-            accessMode?: "rw" | "ro";
-            config?: components["schemas"]["MountConfigResponse"];
-            /**
-             * @description Current connection status
-             * @enum {string}
-             */
-            connectionStatus?: "connected" | "disconnected";
-            /** @description Authentication error message (if disconnected) */
-            authError?: string;
-            /**
-             * @description How the mount authenticates to the storage backend
-             * @enum {string}
-             */
-            authorizationType?: "iam" | "accessKeys" | "oauth";
-        };
-        /** @description Mount configuration details (secrets omitted) */
-        MountConfigResponse: {
-            /** @description Bucket name */
-            bucketName?: string;
-            /** @description Storage endpoint URL */
-            bucketEndpoint?: string;
-            /** @description Prefix within the bucket */
-            bucketPrefix?: string;
-            /** @description Session identifier for IAM-authorized mounts */
-            sessionId?: string;
-        };
-        DiskMetrics: {
-            /** @description Data transfer amount with unit (e.g., "1.5 GB") */
-            dataTransfer?: string;
-            /** @description Total request count as a formatted string (e.g., "1,234") */
-            requests?: string;
-            /** @description Average response time with unit (e.g., "45ms") */
-            avgResponseTime?: string;
-        };
-        ConnectedClient: {
-            id?: string;
-            ipAddress?: string;
-            /** Format: date-time */
-            connectedAt?: string;
-        };
-        AuthorizedUser: {
-            /** @enum {string} */
-            type?: "token" | "awssts";
-            /**
-             * @deprecated
-             * @description Use identifier instead. Only populated for awssts type (the IAM ARN).
-             */
-            principal?: string;
-            nickname?: string;
-            tokenSuffix?: string;
-            /** @description The generated mount token. Only present in the response when the server generates the token (i.e. principal was not provided). This value is shown exactly once and cannot be retrieved again. */
-            token?: string;
-            /** @description Stable identifier for this user, returned in creation and list responses. Use this value with DELETE /api/disks/{id}/users/{type}?identifier={identifier} to remove the user. For awssts users, this is the IAM ARN. */
-            identifier?: string;
-            /** Format: date-time */
-            createdAt?: string;
-        };
-        /** @description All API responses use a standard envelope with `success: boolean` and `data` (on success) or `error: string` (on failure). The ApiResponse_* schemas each define the specific `data` shape for their endpoint. */
-        ApiResponse_DiskList: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["DiskResponse"][];
-        };
-        ApiResponse_Disk: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["DiskResponse"];
-        };
-        ApiResponse_CreateDisk: {
-            /** @example true */
-            success: boolean;
-            data: {
-                /** @example dsk-0123456789abcdef */
-                diskId?: string;
-                authorizedUsers?: components["schemas"]["AuthorizedUser"][];
-            };
-        };
-        ApiResponse_AuthorizedUser: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["AuthorizedUser"];
-        };
-        ApiResponse_AllowedIPs: {
-            /** @example true */
-            success: boolean;
-            data: {
-                /**
-                 * @example [
-                 *       "203.0.113.0/24",
-                 *       "198.51.100.42"
-                 *     ]
-                 */
-                allowedIps: string[];
-            };
-        };
-        CreateApiTokenRequest: {
-            /** @description Token name */
-            name: string;
-            /** @description Token description */
-            description?: string;
-        };
-        ApiTokenResponse: {
-            /** @description Token hash/ID */
-            id?: string;
-            name?: string;
-            description?: string;
-            /** @description Last 4 characters of the token */
-            tokenSuffix?: string;
-            /** Format: date-time */
-            createdAt?: string;
-            /** Format: date-time */
-            lastUsedAt?: string;
-        };
-        ApiResponse_TokenList: {
-            /** @example true */
-            success: boolean;
-            data: {
-                tokens?: components["schemas"]["ApiTokenResponse"][];
-            };
-        };
-        ApiResponse_TokenCreated: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["ApiTokenResponse"] & {
-                /**
-                 * @description Full token value (only shown at creation)
-                 * @example key-abc123...
-                 */
-                token?: string;
-            };
-        };
-        ExecDiskRequest: {
-            /**
-             * @description Shell command to execute inside the container
-             * @example ls -la /mnt/archil
-             */
-            command: string;
-        };
-        ExecDiskResult: {
-            /**
-             * @description Exit code of the command (0 = success)
-             * @example 0
-             */
-            exitCode: number;
-            /** @description Standard output from the command */
-            stdout: string;
-            /** @description Standard error from the command */
-            stderr: string;
-            timing: components["schemas"]["ExecTiming"];
-        };
-        /** @description Server-measured timings for an exec request. */
-        ExecTiming: {
-            /**
-             * @description End-to-end wall clock measured on the server, from request arrival to response.
-             * @example 2450
-             */
-            totalMs: number;
-            /**
-             * @description Time spent queueing, scheduling, booting/claiming a VM, and mounting the filesystem before the command started running.
-             * @example 150
-             */
-            queueMs: number;
-            /**
-             * @description Time the user's command itself ran, measured by the runtime.
-             * @example 2300
-             */
-            executeMs: number;
-        };
-        ApiResponse_ExecDisk: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["ExecDiskResult"];
-        };
-        ExecRequest: {
-            /**
-             * @description Map of relative path under `/mnt/archil` to the disk to mount
-             *     there. At least one entry is required. Relative paths must be
-             *     non-empty, non-absolute, and contain no `.` or `..` segments.
-             *
-             *     Each value is either a plain disk ID string (mounts the disk's
-             *     root, read-write) or an object that additionally selects a
-             *     subdirectory of the disk and/or marks the mount as read-only.
-             * @example {
-             *       "data": "dsk-abc123",
-             *       "logs": {
-             *         "disk": "dsk-def456",
-             *         "subdirectory": "app/logs",
-             *         "readOnly": true
-             *       }
-             *     }
-             */
-            disks: {
-                [key: string]: string | components["schemas"]["ExecMount"];
-            };
-            /**
-             * @description Shell command to execute inside the container
-             * @example ls -la /mnt/archil/data /mnt/archil/logs
-             */
-            command: string;
-        };
-        ExecMount: {
-            /**
-             * @description Disk ID to mount at this relative path
-             * @example dsk-abc123
-             */
-            disk: string;
-            /**
-             * @description Subdirectory of the disk to expose at the mountpoint. Must be a
-             *     relative path with no `.` or `..` segments. When omitted, the
-             *     disk's root is exposed.
-             * @example app/logs
-             */
-            subdirectory?: string;
-            /**
-             * @description When true, the disk is mounted read-only inside the container.
-             *     Writes against the mount fail with EROFS.
-             * @default false
-             */
-            readOnly: boolean;
-        };
-        ApiResponse_Exec: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["ExecDiskResult"];
-        };
-        GrepDiskRequest: {
-            /**
-             * @description Directory on the disk to search, relative to the disk root.
-             *     An empty string or "/" means the disk root.
-             * @example data/logs
-             */
-            directory: string;
-            /**
-             * @description Extended regular expression (passed to `grep -E`)
-             * @example ERROR|FATAL
-             */
-            pattern: string;
-            /**
-             * @description When true, walks subdirectories breadth-first.
-             * @default false
-             */
-            recursive: boolean;
-            /**
-             * @description Wall-clock deadline for the entire request. Capped at 30
-             *     seconds because the runtime exec container itself is bounded
-             *     at ~30s; longer requests would have their workers killed
-             *     mid-scan.
-             * @default 30
-             */
-            maxDurationSeconds: number;
-            /**
-             * @description Maximum number of parallel grep workers. Higher values finish
-             *     larger datasets within the deadline but consume more runtime
-             *     capacity. The controlplane clamps this to the fleet's
-             *     currently-available capacity.
-             * @default 50
-             */
-            concurrency: number;
-            /**
-             * @description Stop scanning once the aggregator has this many matches.
-             *     Returned matches are a sample of whichever workers reported
-             *     first, not the lexicographically first N.
-             * @default 1000
-             */
-            maxResults: number;
-        };
-        GrepMatch: {
-            /**
-             * @description Path to the file (relative to the disk root).
-             * @example data/logs/2026-05-03.log
-             */
-            file: string;
-            /**
-             * @description 1-based line number where the match occurred.
-             * @example 142
-             */
-            line: number;
-            /** @description The matching line. */
-            text: string;
-        };
-        /**
-         * @description Why the search stopped.
-         *     - `completed`: every file under the directory was scanned successfully.
-         *     - `incomplete`: pipeline ran to its natural end but one or more
-         *       batches errored (invalid regex, unreadable file, runtime issue).
-         *       Results may be partial or wrong; do not rely on completeness.
-         *     - `max_results`: hit `maxResults` before scanning everything.
-         *     - `deadline`: hit `maxDurationSeconds`.
-         *     - `list_failed`: directory listing failed; partial results
-         *       may be present.
-         * @enum {string}
-         */
-        GrepStoppedReason: "completed" | "incomplete" | "max_results" | "deadline" | "list_failed";
-        GrepDiskResult: {
-            matches: components["schemas"]["GrepMatch"][];
-            stoppedReason: components["schemas"]["GrepStoppedReason"];
-            /** @description Files actually fed to a grep container. */
-            filesScanned: number;
-            /** @description Number of grep containers started for this request. */
-            containersDispatched: number;
-            /**
-             * Format: double
-             * @description Sum of per-container execution time in seconds, measured by the
-             *     runtime. Approximates billable container-seconds.
-             */
-            computeSecondsUsed: number;
-            /** @description End-to-end wall clock measured by the server. */
-            durationMs: number;
-            /**
-             * @description Wall-clock time spent enumerating files via listObjects, from
-             *     the request's start to the moment listing fully drained (or
-             *     was canceled). Listing and matching overlap, so listingMs +
-             *     grepMs typically exceeds durationMs.
-             */
-            listingMs: number;
-            /**
-             * @description Wall-clock time spent matching, from the first grep container
-             *     being dispatched to the last container reporting results. 0 if
-             *     no batches ran.
-             */
-            grepMs: number;
-        };
-        ApiResponse_GrepDisk: {
-            /** @example true */
-            success: boolean;
-            data: components["schemas"]["GrepDiskResult"];
-        };
-    };
-    responses: {
-        /** @description Invalid or missing authentication credentials */
-        Unauthorized: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["ErrorResponse"];
-            };
-        };
-        /** @description Validation error */
-        ValidationError: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["ErrorResponse"];
-            };
-        };
-        /** @description Resource not found */
-        NotFound: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["ErrorResponse"];
-            };
-        };
-        /** @description Internal server error */
-        InternalError: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["ErrorResponse"];
-            };
-        };
-    };
-    parameters: {
-        /** @description Disk ID (format `dsk-{16 hex chars}`) */
-        DiskId: string;
-        /** @description Maximum number of items to return */
-        Limit: number;
-        /** @description Pagination cursor from a previous response */
-        Cursor: string;
-    };
-    requestBodies: never;
-    headers: never;
-    pathItems: never;
-}
-interface operations {
-    listDisks: {
-        parameters: {
-            query?: {
-                /** @description Maximum number of items to return */
-                limit?: components["parameters"]["Limit"];
-                /** @description Pagination cursor from a previous response */
-                cursor?: components["parameters"]["Cursor"];
-                /** @description Filter disks by exact name match. */
-                name?: string;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description List of disks */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_DiskList"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    createDisk: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateDiskRequest"];
-            };
-        };
-        responses: {
-            /** @description Disk with this name already exists and configuration matches (idempotent) */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_CreateDisk"];
-                };
-            };
-            /** @description Disk created successfully */
-            201: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_CreateDisk"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            /** @description Access denied (e.g., preview region not enabled) */
-            403: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"];
-                };
-            };
-            /** @description Disk with this name already exists but configuration differs */
-            409: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"];
-                };
-            };
-            500: components["responses"]["InternalError"];
-        };
-    };
-    getDisk: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Disk details */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_Disk"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    deleteDisk: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Disk deleted successfully */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_Empty"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    addDiskUser: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["DiskUser"];
-            };
-        };
-        responses: {
-            /** @description User added successfully */
-            201: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_AuthorizedUser"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    removeDiskUser: {
-        parameters: {
-            query?: {
-                /** @description Identifier of the user to remove, as returned in the creation or list response. For awssts users, this is the IAM ARN. */
-                identifier?: string;
-                /**
-                 * @deprecated
-                 * @description Use identifier instead.
-                 */
-                principal?: string;
-            };
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-                /** @description The type of user authentication */
-                userType: "token" | "awssts";
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description User removed successfully */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_Message"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    getAllowedIPs: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Current IP allowlist */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_AllowedIPs"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    setAllowedIPs: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description List of IPs or CIDR ranges. Empty array removes restrictions.
-                     * @example [
-                     *       "203.0.113.0/24",
-                     *       "198.51.100.42"
-                     *     ]
-                     */
-                    allowedIps: string[];
-                };
-            };
-        };
-        responses: {
-            /** @description Allowlist updated */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_AllowedIPs"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    execDisk: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ExecDiskRequest"];
-            };
-        };
-        responses: {
-            /** @description Command completed */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_ExecDisk"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-            /** @description Command timed out */
-            504: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"];
-                };
-            };
-        };
-    };
-    grepDisk: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Disk ID (format `dsk-{16 hex chars}`) */
-                id: components["parameters"]["DiskId"];
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["GrepDiskRequest"];
-            };
-        };
-        responses: {
-            /** @description Grep completed (possibly stopped early) */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_GrepDisk"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    exec: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ExecRequest"];
-            };
-        };
-        responses: {
-            /** @description Command completed */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_Exec"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-            /** @description Command timed out */
-            504: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"];
-                };
-            };
-        };
-    };
-    listApiTokens: {
-        parameters: {
-            query?: {
-                /** @description Maximum number of items to return */
-                limit?: components["parameters"]["Limit"];
-                /** @description Pagination cursor from a previous response */
-                cursor?: components["parameters"]["Cursor"];
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description List of API tokens */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_TokenList"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    createApiToken: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateApiTokenRequest"];
-            };
-        };
-        responses: {
-            /** @description Token created successfully */
-            201: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_TokenCreated"];
-                };
-            };
-            400: components["responses"]["ValidationError"];
-            401: components["responses"]["Unauthorized"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-    deleteApiToken: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description The token ID (hash) */
-                id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Token deleted successfully */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiResponse_Message"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-            500: components["responses"]["InternalError"];
-        };
-    };
-}
-
-type ApiClient = Client<paths>;
-
-type DiskResponse = components["schemas"]["DiskResponse"];
-type MountResponse = components["schemas"]["MountResponse"];
-type MountConfigResponse = components["schemas"]["MountConfigResponse"];
-type DiskMetrics = components["schemas"]["DiskMetrics"];
-type ConnectedClient = components["schemas"]["ConnectedClient"];
-type AuthorizedUser = components["schemas"]["AuthorizedUser"];
-type CreateDiskRequest = components["schemas"]["CreateDiskRequest"];
-type MountConfig = components["schemas"]["MountConfig"];
-type S3Mount = components["schemas"]["S3Mount"];
-type GCSMount = components["schemas"]["GCSMount"];
-type R2Mount = components["schemas"]["R2Mount"];
-type S3CompatibleMount = components["schemas"]["S3CompatibleMount"];
-type AzureBlobMount = components["schemas"]["AzureBlobMount"];
-type DiskUser = components["schemas"]["DiskUser"];
-type TokenUser = components["schemas"]["TokenUser"];
-type AwsStsUser = components["schemas"]["AwsStsUser"];
-type CreateApiTokenRequest = components["schemas"]["CreateApiTokenRequest"];
-type ApiTokenResponse = components["schemas"]["ApiTokenResponse"];
-type ExecDiskResult = components["schemas"]["ExecDiskResult"];
-type ExecRequest = components["schemas"]["ExecRequest"];
-type GrepDiskResult = components["schemas"]["GrepDiskResult"];
-type GrepMatch = components["schemas"]["GrepMatch"];
-type GrepStoppedReason = components["schemas"]["GrepStoppedReason"];
-type DiskStatus = DiskResponse["status"];
-
-interface MountOptions {
-    authToken?: string;
-    logLevel?: string;
-    serverAddress?: string;
-    insecure?: boolean;
-}
-type ExecResult = ExecDiskResult;
-type GrepResult = GrepDiskResult;
-
-interface GrepOptions {
-    /**
-     * Directory on the disk to search, relative to the disk root. An empty
-     * string or "/" means the disk root.
-     */
-    directory: string;
-    /** Extended regular expression (passed to `grep -E`). */
-    pattern: string;
-    /** Walk subdirectories breadth-first. Defaults to false. */
-    recursive?: boolean;
-    /** Wall-clock deadline for the entire request. Defaults to 30s. */
-    maxDurationSeconds?: number;
-    /**
-     * Maximum number of parallel grep workers. Higher values finish larger
-     * datasets within the deadline but consume more runtime capacity. The
-     * controlplane clamps this to the fleet's currently-available capacity.
-     * Defaults to 50.
-     */
-    concurrency?: number;
-    /**
-     * Stop scanning once the aggregator has this many matches. Returned
-     * matches are a sample of whichever workers reported first, not the
-     * lexicographically first N. Defaults to 1000.
-     */
-    maxResults?: number;
-}
-interface ShareUrlOptions {
-    /**
-     * Lifetime of the URL in seconds — any positive integer, up to 604800
-     * (7 days). Defaults to 86400 (24 hours).
-     */
-    expiresIn?: number;
-}
-interface ShareUrlResult {
-    /** Public, signed, time-limited URL that downloads the file. */
-    url: string;
-    /** Lifetime of the URL in seconds. */
-    expiresIn: number;
-}
-interface ListObjectsOptions {
-    /**
-     * List the entire subtree under the prefix. When false (the default), only
-     * the immediate level is returned — direct objects in `objects` and
-     * subdirectory prefixes in `commonPrefixes`, like listing a single directory.
-     * When true, every key under the prefix is returned flat (and
-     * `commonPrefixes` is empty).
-     */
-    recursive?: boolean;
-    /**
-     * Return only the first page instead of auto-paginating. By default
-     * listObjects follows continuation tokens until the listing is exhausted and
-     * returns every matching key. With `singlePage: true` it makes one request
-     * and the result carries `isTruncated` / `nextContinuationToken` so you can
-     * page manually (pass the token back via `continuationToken`).
-     */
-    singlePage?: boolean;
-    /**
-     * Stop after this many objects total (only meaningful when auto-paginating).
-     * The result's `isTruncated` is true if the cap cut the listing short.
-     */
-    limit?: number;
-    /** Start listing from this continuation token (from a prior `nextContinuationToken`). */
-    continuationToken?: string;
-    /** Return keys lexicographically after this one. */
-    startAfter?: string;
-}
-interface S3Object {
-    /** Object key (path on the disk). */
-    key: string;
-    /** Size in bytes. */
-    size: number;
-    /** Entity tag (quoted MD5 for single-part objects). */
-    etag?: string;
-    /** Last-modified time, if reported by the server. */
-    lastModified?: Date;
-}
-interface PutObjectResult {
-    /** Entity tag the server assigned (quoted, per S3 — e.g. `"\"abc123\""`). */
-    etag?: string;
-}
-interface ObjectMetadata {
-    /** Size in bytes. */
-    size: number;
-    /** Entity tag (quoted MD5 for single-part objects). */
-    etag?: string;
-    /** MIME type the object was stored with, if any. */
-    contentType?: string;
-    /** Last-modified time, if reported by the server. */
-    lastModified?: Date;
-}
-interface ListObjectsResult {
-    /** Objects in this page. */
-    objects: S3Object[];
-    /** Directory-like prefixes rolled up by `delimiter` (empty if no delimiter). */
-    commonPrefixes: string[];
-    /** True if more keys exist beyond this page. */
-    isTruncated: boolean;
-    /** Token to pass as `continuationToken` to fetch the next page. */
-    nextContinuationToken?: string;
-    /** Number of keys returned in this page. */
-    keyCount: number;
-    /** The prefix the listing was filtered by, echoed back by the server. */
-    prefix?: string;
-}
-/** A part to list in {@link Disk.completeMultipartUpload}. */
-interface UploadPart {
-    /** 1-based part number (1..=10000), strictly increasing across the list. */
-    partNumber: number;
-    /** Entity tag returned by {@link Disk.uploadPart} for this part. */
-    etag: string;
-}
-/** Handle to an in-progress multipart upload, returned by {@link Disk.createMultipartUpload}. */
-interface MultipartUpload {
-    /** Server-assigned upload id; pass to uploadPart/complete/abort/listParts. */
-    uploadId: string;
-    /** The object key this upload targets. */
-    key: string;
-    /** The bucket (disk id) the upload lives in. */
-    bucket: string;
-}
-/** The assembled object, returned by {@link Disk.completeMultipartUpload}. */
-interface CompletedMultipartUpload {
-    /** Multipart entity tag — S3's `md5(concat(partMd5s))-N` form. */
-    etag?: string;
-    /** Resource path of the completed object. */
-    location?: string;
-    /** The bucket (disk id). */
-    bucket?: string;
-    /** The object key. */
-    key?: string;
-}
-/** One part in a {@link Disk.listParts} listing. */
-interface PartInfo {
-    /** 1-based part number. */
-    partNumber: number;
-    /** Entity tag the server assigned to this part. */
-    etag?: string;
-    /** Size in bytes. */
-    size: number;
-    /** Time the part was uploaded, if reported. */
-    lastModified?: Date;
-}
-interface ListPartsOptions {
-    /** Cap parts returned in one page (server clamps to 1000). */
-    maxParts?: number;
-    /** Return parts after this part number (for pagination). */
-    partNumberMarker?: number;
-}
-interface PartListing {
-    /** The bucket (disk id), echoed by the server. */
-    bucket?: string;
-    /** The object key, echoed by the server. */
-    key?: string;
-    /** The upload id, echoed by the server. */
-    uploadId?: string;
-    /** Parts in this page, ascending by part number. */
-    parts: PartInfo[];
-    /** True if more parts exist beyond this page. */
-    isTruncated: boolean;
-    /** The part-number marker this page started after. */
-    partNumberMarker: number;
-    /** Pass back as `partNumberMarker` to fetch the next page. */
-    nextPartNumberMarker?: number;
-    /** Max parts the server was asked to return. */
-    maxParts: number;
-}
-/** One in-progress upload in a {@link Disk.listMultipartUploads} listing. */
-interface MultipartUploadSummary {
-    /** The object key the upload targets. */
-    key: string;
-    /** The upload id. */
-    uploadId: string;
-    /** When the upload was initiated, if reported. */
-    initiated?: Date;
-}
-interface ListMultipartUploadsOptions {
-    /** Only list uploads whose key begins with this prefix. */
-    prefix?: string;
-    /** Roll keys up to this delimiter into `commonPrefixes` (S3 supports "/"). */
-    delimiter?: string;
-    /** Resume listing keys after this one (with `uploadIdMarker`). */
-    keyMarker?: string;
-    /** Resume listing uploads after this upload id (requires `keyMarker`). */
-    uploadIdMarker?: string;
-    /** Cap uploads returned in one page (server clamps to 1000). */
-    maxUploads?: number;
-}
-interface MultipartUploadListing {
-    /** The bucket (disk id), echoed by the server. */
-    bucket?: string;
-    /** In-progress uploads in this page. */
-    uploads: MultipartUploadSummary[];
-    /** Key prefixes rolled up by `delimiter` (empty if no delimiter). */
-    commonPrefixes: string[];
-    /** True if more uploads exist beyond this page. */
-    isTruncated: boolean;
-    /** The key marker this page started after, echoed back. */
-    keyMarker?: string;
-    /** The upload-id marker this page started after, echoed back. */
-    uploadIdMarker?: string;
-    /** Pass back as `keyMarker` (with `nextUploadIdMarker`) for the next page. */
-    nextKeyMarker?: string;
-    /** Pass back as `uploadIdMarker` (with `nextKeyMarker`) for the next page. */
-    nextUploadIdMarker?: string;
-    /** The prefix the listing was filtered by, echoed back. */
-    prefix?: string;
-    /** The delimiter used, echoed back. */
-    delimiter?: string;
-    /** Max uploads the server was asked to return. */
-    maxUploads?: number;
-}
-interface DeleteObjectsOptions {
-    /**
-     * Quiet mode: the server omits the per-key success list and returns only
-     * failures, so the result's `deleted` array is empty. Cuts response size on
-     * large batches. Defaults to false.
-     */
-    quiet?: boolean;
-}
-/** A single per-key failure within a {@link Disk.deleteObjects} batch. */
-interface DeleteObjectsError {
-    /** The key that failed to delete. */
-    key: string;
-    /** S3 error code (e.g. "AccessDenied", "OperationAborted"), if provided. */
-    code?: string;
-    /** Human-readable failure detail, if provided. */
-    message?: string;
-}
-interface DeleteObjectsResult {
-    /** Keys the server confirmed deleted (empty in quiet mode). */
-    deleted: string[];
-    /** Per-key failures; empty when every key was deleted. */
-    errors: DeleteObjectsError[];
-}
-interface PutObjectOptions {
-    /** MIME type to store the object with. Default "application/octet-stream". */
-    contentType?: string;
-    /**
-     * Bodies larger than this take the multipart path; bodies at or below it take
-     * a single PutObject. Defaults to `partSize` (16 MiB), so by default the
-     * switch happens at the part size. Set it lower (e.g. 5 MiB) to start using
-     * multipart sooner, or to `Infinity` to force a single PutObject.
-     */
-    multipartThreshold?: number;
-    /**
-     * Bytes per part on the multipart path. Clamped to a minimum of 5 MiB (the S3
-     * floor for every part but the last). Default 16 MiB.
-     */
-    partSize?: number;
-    /** Max parts uploaded in parallel on the multipart path. Default 4. */
-    concurrency?: number;
-}
-/**
- * The S3 transport function {@link DiskMultipart} uses, supplied by the owning
- * {@link Disk} so the namespace shares the disk's credential and endpoint.
- * @internal
- */
-type S3RequestFn = (method: "GET" | "PUT" | "DELETE" | "HEAD" | "POST", key: string, opts?: {
-    body?: string | Uint8Array | ArrayBuffer;
-    contentType?: string;
-    query?: Record<string, string | number>;
-    retry?: boolean;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    statusText: string;
-    headers: Headers;
-    body: Uint8Array;
-}>;
-declare class Disk {
-    readonly id: string;
-    readonly name: string;
-    readonly organization: string;
-    readonly status: DiskStatus;
-    readonly provider: string;
-    readonly region: string;
-    readonly createdAt: string;
-    readonly fsHandlerStatus?: string;
-    readonly lastAccessed?: string;
-    readonly dataSize?: number;
-    readonly monthlyUsage?: string;
-    readonly mounts?: MountResponse[];
-    readonly metrics?: DiskMetrics;
-    readonly connectedClients?: ConnectedClient[];
-    readonly authorizedUsers?: AuthorizedUser[];
-    readonly allowedIps?: string[];
-    /** @internal */
-    private readonly _client;
-    /** @internal */
-    private readonly _archilRegion;
-    /** Base URL for the S3-compatible API (port 9000 ingress). Empty if unset. */
-    private readonly _s3BaseUrl;
-    /** Lazily-constructed multipart namespace (see {@link multipart}). @internal */
-    private _multipart?;
-    /** @internal */
-    constructor(data: DiskResponse, client: ApiClient, archilRegion: string, s3BaseUrl?: string);
-    toJSON(): DiskResponse;
-    addUser(user: DiskUser): Promise<AuthorizedUser>;
-    removeUser(userType: "token" | "awssts", identifier: string): Promise<void>;
-    createToken(nickname: string): Promise<AuthorizedUser & {
-        token: string;
-        identifier: string;
-    }>;
-    removeTokenUser(identifier: string): Promise<void>;
-    getAllowedIPs(): Promise<string[]>;
-    setAllowedIPs(allowedIps: string[]): Promise<string[]>;
-    addAllowedIP(ip: string): Promise<string[]>;
-    removeAllowedIP(ip: string): Promise<string[]>;
-    delete(): Promise<void>;
-    /**
-     * Execute a command in a container with this disk mounted.
-     * Blocks until the command completes and returns stdout, stderr, and exit code.
-     */
-    exec(command: string): Promise<ExecResult>;
-    /**
-     * Constant-time parallel grep across files on this disk. Listing and
-     * matching are fanned out across ephemeral exec containers; the request
-     * finishes within the supplied time budget regardless of dataset size.
-     *
-     * The returned `stoppedReason` says whether the search ran to completion
-     * or short-circuited on `maxResults` / `maxDurationSeconds`. When
-     * stopping early, the matches returned are a sample (whichever workers
-     * reported first), not the lexicographically first N.
-     */
-    grep(opts: GrepOptions): Promise<GrepResult>;
-    /**
-     * Create a signed, time-limited URL that lets anyone download a single file
-     * from this disk without authentication. The returned URL embeds a
-     * cryptographically signed token carrying the disk, the file's key, and an
-     * expiry — share it directly; no API key is needed to redeem it.
-     *
-     * @param key   Path to the file on the disk (e.g. "reports/2026-01/data.pdf").
-     * @param opts  `expiresIn` sets the URL lifetime in seconds (any positive
-     *              integer, max 604800 = 7 days). Defaults to 24h.
-     */
-    share(key: string, opts?: ShareUrlOptions): Promise<ShareUrlResult>;
-    /**
-     * Read an object from the disk via the S3-compatible GetObject API and return
-     * its full contents as bytes. Throws `ArchilS3Error` if the object does not
-     * exist (status 404, code "NoSuchKey") or the request is rejected; use
-     * `headObject`/`objectExists` to check existence without throwing.
-     *
-     * @param key  Path on the disk (e.g. "reports/2026-01/data.json")
-     */
-    getObject(key: string): Promise<Uint8Array>;
-    /**
-     * Fetch an object's metadata (size, etag, content type, last-modified) without
-     * downloading its contents, via the S3-compatible HeadObject API. Returns
-     * `null` if the object does not exist.
-     *
-     * @param key  Path on the disk (e.g. "reports/2026-01/data.json")
-     */
-    headObject(key: string): Promise<ObjectMetadata | null>;
-    /** Whether an object exists on the disk (a HeadObject that maps 404 → false). */
-    objectExists(key: string): Promise<boolean>;
-    /**
-     * Write an object to the disk via the S3-compatible API. Handles any size:
-     * bodies at or below `multipartThreshold` (defaults to `partSize`, i.e.
-     * 16 MiB) go through a single PutObject request; larger bodies are uploaded as
-     * a multipart upload — split into `partSize` parts, uploaded with bounded
-     * `concurrency` (default 4), and assembled. A failed part aborts the upload so
-     * nothing is left half-staged. For manual control over the multipart
-     * lifecycle, use the {@link multipart} namespace.
-     *
-     * Faster than exec for large files — no container overhead, no command-length
-     * limits. Returns the entity tag the server assigned (a multipart upload's tag
-     * is S3's `md5(concat(partMd5s))-N` form rather than a plain MD5).
-     *
-     * @param key      Path on the disk (e.g. "reports/2026-01/data.json")
-     * @param body     Contents as a string, Uint8Array/Buffer, or ArrayBuffer
-     * @param options  Either a content-type string, or {@link PutObjectOptions}
-     *                 (`contentType`, `multipartThreshold`, `partSize`,
-     *                 `concurrency`). Content type defaults to
-     *                 "application/octet-stream".
-     */
-    putObject(key: string, body: string | Uint8Array | ArrayBuffer, options?: string | PutObjectOptions): Promise<PutObjectResult>;
-    /**
-     * Upload a large body through the multipart lifecycle: split into `partSize`
-     * parts, upload them with bounded concurrency, then complete — aborting the
-     * upload if any part fails so nothing is left half-staged. @internal
-     */
-    private _putMultipart;
-    /**
-     * Append bytes to an object via the S3-compatible PutObject append extension
-     * (`?append=true`). If the object already exists the bytes are appended to it;
-     * if it doesn't, it is created. Returns the entity tag of the full object
-     * after the append.
-     *
-     * Each call may append at most 1 MiB — the server rejects a larger body with
-     * `EntityTooLarge`. To grow an object past that, append in chunks (or use
-     * {@link putObject} for a one-shot large write).
-     *
-     * Unlike most operations this is NOT auto-retried on a transient error:
-     * append isn't idempotent, so retrying a succeeded-but-unacknowledged append
-     * would duplicate the bytes. On a transient failure, re-append yourself only
-     * after confirming the object's size.
-     *
-     * @param key          Path on the disk (e.g. "logs/app.log")
-     * @param body         Bytes to append (string, Uint8Array/Buffer, or ArrayBuffer)
-     * @param contentType  MIME type, applied only when the object is newly created.
-     */
-    appendObject(key: string, body: string | Uint8Array | ArrayBuffer, contentType?: string): Promise<PutObjectResult>;
-    /**
-     * Delete an object from the disk via the S3-compatible DeleteObject API.
-     * Idempotent: deleting a key that doesn't exist resolves successfully, per
-     * S3 semantics.
-     *
-     * @param key  Path on the disk (e.g. "project/dist/server.cjs")
-     */
-    deleteObject(key: string): Promise<void>;
-    /**
-     * List objects on the disk via the S3-compatible ListObjectsV2 API. By
-     * default this follows continuation tokens until the listing is exhausted and
-     * returns every matching key. Use `limit` to cap the total, `singlePage` for a
-     * single request, or {@link listObjectsPages} to stream pages without loading
-     * everything into memory.
-     *
-     * @param prefix  Only return keys beginning with this prefix (omit for all).
-     * @param opts    Listing and pagination options.
-     */
-    listObjects(prefix?: string, opts?: ListObjectsOptions): Promise<ListObjectsResult>;
-    /**
-     * Yield ListObjectsV2 pages lazily, following continuation tokens. A
-     * memory-friendly way to process a large listing without materializing it:
-     *
-     * ```ts
-     * for await (const page of disk.listObjectsPages("logs/")) {
-     *   for (const obj of page.objects) process(obj);
-     * }
-     * ```
-     *
-     * @param prefix  Only return keys beginning with this prefix (omit for all).
-     * @param opts    Listing options (`limit` / `singlePage` are ignored here —
-     *                control your own loop).
-     */
-    listObjectsPages(prefix?: string, opts?: ListObjectsOptions): AsyncGenerator<ListObjectsResult>;
-    /** Fetch a single ListObjectsV2 page. @internal */
-    private _listObjectsPage;
-    /**
-     * Delete up to many objects in a single S3-compatible DeleteObjects request.
-     * Unlike {@link deleteObject}, failures are reported per key rather than
-     * thrown: the result's `deleted` lists the keys that were removed and
-     * `errors` lists the ones that weren't (with the server's code/message). A
-     * key that didn't exist still counts as deleted, per S3 semantics.
-     *
-     * The server caps a single request at 1000 keys; this method transparently
-     * splits larger inputs into 1000-key batches and merges the results.
-     *
-     * @param keys  Object keys to delete.
-     * @param opts  `quiet` suppresses the per-key success list server-side.
-     */
-    deleteObjects(keys: string[], opts?: DeleteObjectsOptions): Promise<DeleteObjectsResult>;
-    /**
-     * The advanced, opt-in multipart-upload API. Drive the raw lifecycle
-     * yourself — `create` → `uploadPart` → `complete` (or `abort`), plus
-     * `listParts` / `listUploads`. Most callers don't need this: {@link putObject}
-     * runs the whole lifecycle automatically for large bodies. Reach for it only
-     * when you need manual control (e.g. uploading parts from separate processes),
-     * and note you then own part-size, memory, and concurrency management.
-     */
-    get multipart(): DiskMultipart;
-    /**
-     * Send a single request to the disk's S3-compatible endpoint. This reuses the
-     * control-plane client purely for its credential and transport — the same
-     * `Authorization` header is sent and verified by the same code server-side —
-     * pointed at the S3 host. Returns the response status and fully-buffered body
-     * so callers can inspect both regardless of the verb used.
-     *
-     * The S3 routes (`/{diskId}/{key}` for objects, `/{diskId}` for the bucket)
-     * are not part of the typed control-plane API, so the path and per-request
-     * options are passed untyped. An empty `key` targets the bucket itself (used
-     * by listObjects).
-     *
-     * @internal
-     */
-    private _s3Request;
-    /**
-     * Connect to this disk's data plane via the native ArchilClient.
-     *
-     * Requires the native module to be available (platform-specific .node binary).
-     */
-    mount(opts?: MountOptions): Promise<unknown>;
-}
-/**
- * The advanced, opt-in multipart-upload namespace, reached via {@link Disk.multipart}.
- * Drives the raw S3 multipart lifecycle — `create` → `uploadPart` → `complete`
- * (or `abort`), plus `listParts` / `listUploads`. Prefer {@link Disk.putObject},
- * which runs this lifecycle automatically for large bodies; use this only when
- * you need manual control, in which case you own part-size, memory, and
- * concurrency management.
- */
-declare class DiskMultipart {
-    private readonly diskId;
-    private readonly s3Request;
-    /** @internal */
-    constructor(diskId: string, s3Request: S3RequestFn);
-    /**
-     * Start a multipart upload (CreateMultipartUpload) and return its `uploadId`.
-     *
-     * @param key          Path on the disk the finished object will live at.
-     * @param contentType  MIME type to store the object with.
-     */
-    create(key: string, contentType?: string): Promise<MultipartUpload>;
-    /**
-     * Upload one part (UploadPart) and return its entity tag, which you must
-     * collect (with its part number) and pass to {@link complete}. Every part
-     * except the last must be at least 5 MiB.
-     *
-     * @param key         The upload's object key.
-     * @param uploadId    The id from {@link create}.
-     * @param partNumber  1-based part number (1..=10000).
-     * @param body        Part contents as a string, Uint8Array/Buffer, or ArrayBuffer.
-     */
-    uploadPart(key: string, uploadId: string, partNumber: number, body: string | Uint8Array | ArrayBuffer): Promise<UploadPart>;
-    /**
-     * Finish a multipart upload (CompleteMultipartUpload), assembling the listed
-     * parts into one object. Parts are sorted by part number before submission
-     * (the server requires strictly-increasing order).
-     *
-     * Unlike the other operations this is NOT auto-retried on a transient error:
-     * the gateway isn't idempotent for completion, so a retry after a
-     * successful-but-unacknowledged complete would return a spurious NoSuchUpload.
-     * On a transient failure, re-drive completion yourself only after confirming
-     * the object isn't already present.
-     *
-     * @param key       The upload's object key.
-     * @param uploadId  The id from {@link create}.
-     * @param parts     The `{ partNumber, etag }` pairs from {@link uploadPart}.
-     */
-    complete(key: string, uploadId: string, parts: UploadPart[]): Promise<CompletedMultipartUpload>;
-    /**
-     * Abort a multipart upload (AbortMultipartUpload), discarding every staged
-     * part. Idempotent against an upload that's already gone (404 / NoSuchUpload
-     * resolves successfully).
-     *
-     * @param key       The upload's object key.
-     * @param uploadId  The id from {@link create}.
-     */
-    abort(key: string, uploadId: string): Promise<void>;
-    /**
-     * List the parts already uploaded for an in-progress upload (ListParts).
-     * Returns a single page; follow `nextPartNumberMarker` (when `isTruncated`)
-     * to page through the rest.
-     *
-     * @param key       The upload's object key.
-     * @param uploadId  The id from {@link create}.
-     * @param opts      `maxParts` / `partNumberMarker` pagination controls.
-     */
-    listParts(key: string, uploadId: string, opts?: ListPartsOptions): Promise<PartListing>;
-    /**
-     * List in-progress multipart uploads on the disk (ListMultipartUploads).
-     * Returns a single page; follow `nextKeyMarker` / `nextUploadIdMarker` (when
-     * `isTruncated`) for the rest.
-     *
-     * @param opts  Prefix/delimiter filter and pagination markers.
-     */
-    listUploads(opts?: ListMultipartUploadsOptions): Promise<MultipartUploadListing>;
-}
-/**
- * Choose the part size for a `totalBytes` multipart upload. Returns
- * `requestedPartSize` unless splitting at that size would exceed the server's
- * 10,000-part cap, in which case it grows the part size (rounded up to a whole
- * MiB) so the body fits in ≤ 10,000 parts — mirroring boto3's chunk-size
- * adjustment. Parts only ever get larger, so they stay above the 5 MiB floor.
- */
-declare function effectiveUploadPartSize(totalBytes: number, requestedPartSize: number): number;
+import { A as AwsStsUser, B as ExecRequest, C as S3Object, D as effectiveUploadPartSize, E as UploadPart, F as DiskMetrics, G as MountConfigResponse, H as GrepMatch, I as DiskResponse, J as S3CompatibleMount, K as MountResponse, L as DiskStatus, M as ConnectedClient, N as CreateApiTokenRequest, O as ApiTokenResponse, P as CreateDiskRequest, Q as ApiClient, R as DiskUser, S as PutObjectResult, T as ShareUrlResult, U as GrepStoppedReason, V as GCSMount, W as MountConfig, X as TokenUser, Y as S3Mount, Z as FileSystem, _ as MultipartUploadSummary, a as Disk, b as PartListing, c as GrepOptions, d as ListObjectsOptions, f as ListObjectsResult, g as MultipartUploadListing, h as MultipartUpload, i as DeleteObjectsResult, j as AzureBlobMount, k as AuthorizedUser, l as GrepResult, m as MountOptions, n as DeleteObjectsError, o as DiskMultipart, p as ListPartsOptions, q as R2Mount, r as DeleteObjectsOptions, s as ExecResult, t as CompletedMultipartUpload, u as ListMultipartUploadsOptions, v as ObjectMetadata, w as ShareUrlOptions, x as PutObjectOptions, y as PartInfo, z as ExecDiskResult } from "./disk-BLF7FFqG.cjs";
 
+//#region src/disks.d.ts
 interface ListDisksOptions {
-    limit?: number;
-    cursor?: string;
-    name?: string;
+  limit?: number;
+  cursor?: string;
+  name?: string;
 }
 interface CreateDiskResult {
-    disk: Disk;
-    token: string | null;
-    tokenIdentifier: string | null;
-    authorizedUsers: AuthorizedUser[];
+  disk: Disk;
+  token: string | null;
+  tokenIdentifier: string | null;
+  authorizedUsers: AuthorizedUser[];
 }
 declare class Disks {
-    /** @internal */
-    private readonly _client;
-    /** @internal */
-    private readonly _region;
-    /** @internal */
-    private readonly _s3BaseUrl?;
-    /** @internal */
-    constructor(client: ApiClient, region: string, s3BaseUrl?: string);
-    list(opts?: ListDisksOptions): Promise<Disk[]>;
-    get(id: string): Promise<Disk>;
-    /**
-     * Create a new disk with an auto-generated mount token.
-     *
-     * Returns the Disk, the one-time token (save it — it cannot be retrieved
-     * again), and the token identifier for later management.
-     */
-    create(req: CreateDiskRequest): Promise<CreateDiskResult>;
-}
-
+  /** @internal */
+  private readonly _client;
+  /** @internal */
+  private readonly _region;
+  /** @internal */
+  private readonly _s3BaseUrl?;
+  /** @internal */
+  constructor(client: ApiClient, region: string, s3BaseUrl?: string);
+  list(opts?: ListDisksOptions): Promise<Disk[]>;
+  get(id: string): Promise<Disk>;
+  /**
+   * Create a new disk with an auto-generated mount token.
+   *
+   * Returns the Disk, the one-time token (save it — it cannot be retrieved
+   * again), and the token identifier for later management.
+   */
+  create(req: CreateDiskRequest): Promise<CreateDiskResult>;
+}
+//#endregion
+//#region src/tokens.d.ts
 interface ListTokensOptions {
-    limit?: number;
-    cursor?: string;
+  limit?: number;
+  cursor?: string;
 }
 declare class Tokens {
-    /** @internal */
-    private readonly _client;
-    /** @internal */
-    constructor(client: ApiClient);
-    list(opts?: ListTokensOptions): Promise<ApiTokenResponse[]>;
-    create(req: CreateApiTokenRequest): Promise<ApiTokenResponse & {
-        token?: string;
-    }>;
-    delete(id: string): Promise<void>;
+  /** @internal */
+  private readonly _client;
+  /** @internal */
+  constructor(client: ApiClient);
+  list(opts?: ListTokensOptions): Promise<ApiTokenResponse[]>;
+  create(req: CreateApiTokenRequest): Promise<ApiTokenResponse & {
+    token?: string;
+  }>;
+  delete(id: string): Promise<void>;
 }
-
+//#endregion
+//#region src/workspace.d.ts
+/** Anything that can run a multi-disk exec — i.e. an `Archil` client. A narrow
+ * structural type so this module doesn't import the Archil class (avoiding a
+ * value-import cycle with archil.ts). */
+interface WorkspaceExecCapable {
+  exec(opts: ExecOptions): Promise<ExecResult>;
+}
+/**
+ * A key-routed filesystem spanning several Archil disks. Each disk is mounted
+ * under a name and addressed as the first segment of a key (`<name>/...`);
+ * `getObject`, `putObject`, `deleteObject`, `listObjects`, and `grep` route to
+ * the right disk by that segment (and `listObjects` / `grep` fan out across all
+ * of them when the key/prefix doesn't name one). Implements the same
+ * {@link FileSystem} surface as a single {@link Disk}, so it works anywhere a
+ * disk does. Mounts can be changed at runtime with {@link addDisk} /
+ * {@link removeDisk}.
+ */
+declare class Workspace implements FileSystem {
+  private readonly client;
+  private readonly mounts;
+  /** @internal Use `archil.workspace({ ... })`. */
+  constructor(client: WorkspaceExecCapable, mounts: Record<string, ExecMount>);
+  /** Mount (or replace) a disk at `name`; its objects are addressed as
+   * `<name>/...`. Accepts a `Disk` or a mount spec (read-only / subdirectory /
+   * conditional / delegation checkouts); a bare disk-id string is rejected —
+   * fetch the disk first. */
+  addDisk(name: string, disk: ExecMount): this;
+  /** Unmount the disk at `name`. Returns whether a disk was removed. Refuses to
+   * remove the last disk — a workspace must always have at least one (the same
+   * invariant the constructor enforces), else fan-out/exec would have nothing to
+   * route to. */
+  removeDisk(name: string): boolean;
+  /** The names of the currently-mounted disks. */
+  diskNames(): string[];
+  private unknownDisk;
+  /** Resolve a workspace key (`<name>/...`) to the disk and the disk-relative key. */
+  private route;
+  /** Mounts touched by a key prefix; an empty prefix fans out to all of them. */
+  private covered;
+  /** Map a workspace-relative key to the disk's key, applying the mount's subdirectory. */
+  private diskKey;
+  /** Map a disk key back to its workspace key (`<name>/...`), stripping the mount subdirectory. */
+  private abs;
+  getObject(key: string): Promise<Uint8Array>;
+  putObject(key: string, body: string | Uint8Array | ArrayBuffer, contentType?: string): Promise<PutObjectResult>;
+  deleteObject(key: string): Promise<void>;
+  listObjects(prefix?: string, opts?: ListObjectsOptions): Promise<ListObjectsResult>;
+  grep(opts: GrepOptions): Promise<GrepResult>;
+  exec(command: string): Promise<ExecResult>;
+}
+//#endregion
+//#region src/archil.d.ts
 interface ArchilOptions {
-    /** API key. Falls back to ARCHIL_API_KEY env var if not provided. */
-    apiKey?: string;
-    /** Region. Falls back to ARCHIL_REGION env var if not provided. */
-    region?: string;
-    /** Override the control plane base URL (useful for testing). */
-    baseUrl?: string;
-    /**
-     * Override the S3-compatible API base URL used by Disk#getObject /
-     * putObject / deleteObject. Falls back to ARCHIL_S3_BASE_URL, then to the
-     * control plane URL with its `control.` hostname prefix swapped for `s3.`.
-     */
-    s3BaseUrl?: string;
+  /** API key. Falls back to ARCHIL_API_KEY env var if not provided. */
+  apiKey?: string;
+  /** Region. Falls back to ARCHIL_REGION env var if not provided. */
+  region?: string;
+  /** Override the control plane base URL (useful for testing). */
+  baseUrl?: string;
+  /**
+   * Override the S3-compatible API base URL used by Disk#getObject /
+   * putObject / deleteObject. Falls back to ARCHIL_S3_BASE_URL, then to the
+   * control plane URL with its `control.` hostname prefix swapped for `s3.`.
+   */
+  s3BaseUrl?: string;
 }
 /**
  * Options that apply to a single mounted disk in an exec request.
- * Use this object form when you need to pin the mount to a subdirectoryectory
- * of the disk and/or mount it read-only; for the default case (mount
- * the disk's root, read-write), pass a `Disk` or disk-id string instead.
+ * Use this object form when you need to pin the mount to a subdirectory
+ * of the disk, mount it read-only, mount it in conditional mode, or request
+ * delegation checkouts; for the default case (mount the disk's root,
+ * read-write with no checkout), pass a `Disk` or disk-id string instead.
  */
 interface ExecMountSpec {
-    /** Disk to mount, by `Disk` instance or raw disk id string. */
-    disk: Disk | string;
-    /**
-     * Subdirectory of the disk to expose at the mountpoint. Must be a
-     * relative path with no `.` or `..` segments. When omitted, the disk's
-     * root is exposed.
-     */
-    subdirectory?: string;
-    /**
-     * When true, mount the disk read-only inside the container. Writes
-     * against the mount fail with EROFS. Defaults to false.
-     */
-    readOnly?: boolean;
+  /** Disk to mount, by `Disk` instance or raw disk id string. */
+  disk: Disk | string;
+  /**
+   * Subdirectory of the disk to expose at the mountpoint. Must be a
+   * relative path with no `.` or `..` segments. When omitted, the disk's
+   * root is exposed.
+   */
+  subdirectory?: string;
+  /**
+   * When true, mount the disk read-only inside the container. Writes
+   * against the mount fail with EROFS. Defaults to false.
+   */
+  readOnly?: boolean;
+  /**
+   * When true, mount the disk in conditional mode, where mutating operations
+   * are sent directly to the server without a delegation checkout. This
+   * enables concurrent writes from multiple clients to the same disk.
+   * Defaults to false.
+   */
+  conditional?: boolean;
+  /**
+   * Milliseconds to wait in the delegation queue for each requested checkout.
+   * If set without `checkoutPaths`, the exposed mount root is acquired during
+   * mount setup. Cannot be combined with `readOnly: true`.
+   */
+  queueMs?: number;
+  /**
+   * Paths relative to this disk's exposed mount root to check out before the
+   * command starts. May be set without `queueMs`; those checkouts try
+   * immediately without waiting in the delegation queue. Cannot be combined
+   * with `readOnly: true`.
+   */
+  checkoutPaths?: string[];
 }
 /**
  * One disk to mount in an exec request. Either a `Disk`/disk-id string
  * (mounts the disk's root, read-write) or an `ExecMountSpec` object that
- * additionally selects a subdirectoryectory of the disk and/or marks the mount
- * as read-only. Used by Archil#exec — the map key is the relative path
- * under /mnt/archil at which to mount the disk.
+ * additionally selects a subdirectory of the disk and/or marks the mount as
+ * read-only, conditional, or requests delegation checkouts. Used
+ * by Archil#exec, where the map key is the relative path under /mnt/archil at
+ * which to mount the disk.
  */
 type ExecMount = Disk | string | ExecMountSpec;
 interface ExecOptions {
-    /**
-     * Disks to mount, keyed by the relative path under `/mnt/archil` at which
-     * to mount each one. At least one entry is required. Paths must be
-     * non-empty, non-absolute, and contain no `.` or `..` segments.
-     */
-    disks: Record<string, ExecMount>;
-    /** Shell command to run inside the container. */
-    command: string;
+  /**
+   * Disks to mount, keyed by the relative path under `/mnt/archil` at which
+   * to mount each one. At least one entry is required. Paths must be
+   * non-empty, non-absolute, and contain no `.` or `..` segments.
+   */
+  disks: Record<string, ExecMount>;
+  /** Shell command to run inside the container. */
+  command: string;
 }
 declare class Archil {
-    readonly disks: Disks;
-    readonly tokens: Tokens;
-    /** @internal */
-    private readonly _client;
-    constructor(opts?: ArchilOptions);
-    /**
-     * Run a command in a container with multiple disks mounted simultaneously,
-     * each at its own relative path under `/mnt/archil`. Blocks until the
-     * command completes and returns its stdout, stderr, exit code, and timing.
-     */
-    exec(opts: ExecOptions): Promise<ExecDiskResult>;
-}
-
+  readonly disks: Disks;
+  readonly tokens: Tokens;
+  /** @internal */
+  private readonly _client;
+  constructor(opts?: ArchilOptions);
+  /**
+   * Run a command in a container with multiple disks mounted simultaneously,
+   * each at its own relative path under `/mnt/archil`. Blocks until the
+   * command completes and returns its stdout, stderr, exit code, and timing.
+   */
+  exec(opts: ExecOptions): Promise<ExecDiskResult>;
+  /**
+   * Build an agent filesystem toolset spanning several disks at once. `mounts`
+   * maps a relative path to a disk (or `ExecMountSpec`), exactly like
+   * {@link exec}; each disk appears under `/mnt/archil/<path>`. Hand the result
+   * to a framework adapter (`createDiskTools(workspace)`) to get tools that route
+   * file operations by path and fan `grep`/`list_files` out across the disks.
+   */
+  workspace(mounts: Record<string, ExecMount>): Workspace;
+}
+//#endregion
+//#region src/errors.d.ts
 /**
  * Base class for every error the SDK throws. Catch with `instanceof ArchilError`
  * to handle control-plane and S3 failures uniformly; `status` is the HTTP status
  * code and `code` a machine-readable error code when the server provided one.
  */
 declare class ArchilError extends Error {
-    /** HTTP status code associated with the failure. */
-    readonly status: number;
-    /** Machine-readable error code (e.g. an S3 code like "NoSuchKey"), if known. */
-    readonly code?: string;
-    constructor(message: string, status: number, code?: string);
+  /** HTTP status code associated with the failure. */
+  readonly status: number;
+  /** Machine-readable error code (e.g. an S3 code like "NoSuchKey"), if known. */
+  readonly code?: string;
+  constructor(message: string, status: number, code?: string);
 }
 /** Error from the control-plane REST API. */
 declare class ArchilApiError extends ArchilError {
-    constructor(message: string, status: number, code?: string);
+  constructor(message: string, status: number, code?: string);
 }
 /**
  * Error from the S3-compatible object API (getObject/putObject/deleteObject/
@@ -2153,31 +222,33 @@ declare class ArchilApiError extends ArchilError {
  * rather than a raw blob, while keeping the full body on `raw` for debugging.
  */
 declare class ArchilS3Error extends ArchilError {
-    /** S3 request id, if the gateway returned one. */
-    readonly requestId?: string;
-    /** Raw response body (the XML document), for debugging. */
-    readonly raw: string;
-    constructor(opts: {
-        operation: string;
-        statusCode: number;
-        statusText?: string;
-        code?: string;
-        message?: string;
-        requestId?: string;
-        raw: string;
-    });
+  /** S3 request id, if the gateway returned one. */
+  readonly requestId?: string;
+  /** Raw response body (the XML document), for debugging. */
+  readonly raw: string;
+  constructor(opts: {
+    operation: string;
+    statusCode: number;
+    statusText?: string;
+    code?: string;
+    message?: string;
+    requestId?: string;
+    raw: string;
+  });
 }
-
+//#endregion
+//#region src/version.d.ts
 declare const VERSION: string;
 declare const USER_AGENT: string;
-
+//#endregion
+//#region src/index.d.ts
 declare function configure(options: ArchilOptions): void;
 declare function createDisk(req: CreateDiskRequest): Promise<CreateDiskResult>;
 declare function listDisks(opts?: ListDisksOptions): Promise<Disk[]>;
 declare function getDisk(id: string): Promise<Disk>;
 declare function listApiKeys(opts?: ListTokensOptions): Promise<ApiTokenResponse[]>;
 declare function createApiKey(req: CreateApiTokenRequest): Promise<ApiTokenResponse & {
-    token?: string;
+  token?: string;
 }>;
 declare function deleteApiKey(id: string): Promise<void>;
 /**
@@ -2186,5 +257,10 @@ declare function deleteApiKey(id: string): Promise<void>;
  * command completes and returns its stdout, stderr, exit code, and timing.
  */
 declare function exec(opts: ExecOptions): Promise<ExecDiskResult>;
-
-export { type ApiTokenResponse, Archil, ArchilApiError, ArchilError, type ArchilOptions, ArchilS3Error, type AuthorizedUser, type AwsStsUser, type AzureBlobMount, type CompletedMultipartUpload, type ConnectedClient, type CreateApiTokenRequest, type CreateDiskRequest, type CreateDiskResult, type DeleteObjectsError, type DeleteObjectsOptions, type DeleteObjectsResult, Disk, type DiskMetrics, DiskMultipart, type DiskResponse, type DiskStatus, type DiskUser, Disks, type ExecMount, type ExecMountSpec, type ExecOptions, type ExecRequest, type ExecResult, type GCSMount, type GrepMatch, type GrepOptions, type GrepResult, type GrepStoppedReason, type ListDisksOptions, type ListMultipartUploadsOptions, type ListObjectsOptions, type ListObjectsResult, type ListPartsOptions, type ListTokensOptions, type MountConfig, type MountConfigResponse, type MountOptions, type MountResponse, type MultipartUpload, type MultipartUploadListing, type MultipartUploadSummary, type ObjectMetadata, type PartInfo, type PartListing, type PutObjectOptions, type PutObjectResult, type R2Mount, type S3CompatibleMount, type S3Mount, type S3Object, type ShareUrlOptions, type ShareUrlResult, type TokenUser, Tokens, USER_AGENT, type UploadPart, VERSION, configure, createApiKey, createDisk, deleteApiKey, effectiveUploadPartSize, exec, getDisk, listApiKeys, listDisks };
+/**
+ * Build an agent filesystem toolset spanning several disks, using the
+ * module-level client. See {@link Archil.workspace}.
+ */
+declare function workspace(mounts: Record<string, ExecMount>): Workspace;
+//#endregion
+export { type ApiTokenResponse, Archil, ArchilApiError, ArchilError, type ArchilOptions, ArchilS3Error, type AuthorizedUser, type AwsStsUser, type AzureBlobMount, type CompletedMultipartUpload, type ConnectedClient, type CreateApiTokenRequest, type CreateDiskRequest, type CreateDiskResult, type DeleteObjectsError, type DeleteObjectsOptions, type DeleteObjectsResult, Disk, type DiskMetrics, DiskMultipart, type DiskResponse, type DiskStatus, type DiskUser, Disks, type ExecMount, type ExecMountSpec, type ExecOptions, type ExecRequest, type ExecResult, type FileSystem, type GCSMount, type GrepMatch, type GrepOptions, type GrepResult, type GrepStoppedReason, type ListDisksOptions, type ListMultipartUploadsOptions, type ListObjectsOptions, type ListObjectsResult, type ListPartsOptions, type ListTokensOptions, type MountConfig, type MountConfigResponse, type MountOptions, type MountResponse, type MultipartUpload, type MultipartUploadListing, type MultipartUploadSummary, type ObjectMetadata, type PartInfo, type PartListing, type PutObjectOptions, type PutObjectResult, type R2Mount, type S3CompatibleMount, type S3Mount, type S3Object, type ShareUrlOptions, type ShareUrlResult, type TokenUser, Tokens, USER_AGENT, type UploadPart, VERSION, Workspace, configure, createApiKey, createDisk, deleteApiKey, effectiveUploadPartSize, exec, getDisk, listApiKeys, listDisks, workspace };