ryco-cli 0.1.20 → 0.1.21

package/dist/{collectUint8StreamText-B3klZuIF.mjs → collectUint8StreamText-D8TBiBWk.mjs}

@@ -360,6 +360,7 @@ const AdvertisedEndpoint = Schema.Struct({
 	isDefault: Schema.optional(Schema.Boolean),
 	description: Schema.optional(TrimmedNonEmptyString)
 });
+const RELAY_E2EE_CAPABILITY_STATEMENT_MAX_BYTES = 5190;
 const RELAY_MAX_CONTROL_FRAME_BYTES = 262144;
 const RELAY_MAX_DATA_CHUNK_BYTES = 262144;
 const RELAY_MAX_DATA_FRAME_OVERHEAD_BYTES = 1024;
@@ -422,7 +423,11 @@ const RELAY_FRAME_TYPES = [
 	"channel.close",
 	"ping",
 	"pong",
-	"error"
+	"error",
+	"node.e2ee.statement",
+	"node.e2ee.statement.ack",
+	"e2ee.verifier-keys",
+	"e2ee.enrollment-revoked"
 ];
 const RELAY_PROTOCOL_ERROR_CODES = [
 	"invalid_encoding",
@@ -433,7 +438,7 @@ const RELAY_PROTOCOL_ERROR_CODES = [
 	...RELAY_CLOSE_REASONS
 ];
 const UInt16 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(65535));
-const UInt32 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(4294967295));
+const UInt32$1 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(4294967295));
 const RetryAfterMs = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(RELAY_MAX_RETRY_AFTER_MS));
 const ProtocolFields = {
 	protocolMajor: UInt16,
@@ -452,11 +457,25 @@ const RelayEffectiveRole = Schema.Literals([
 const RelayProtocolErrorCode = Schema.Literals(RELAY_PROTOCOL_ERROR_CODES);
 const RelayNodeId = Schema.String.check(Schema.isPattern(/^node_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(48)).pipe(Schema.brand("RelayNodeId"));
 const RelayChannelId = Schema.String.check(Schema.isPattern(/^ch_[A-Za-z0-9_-]{22}$/), Schema.isMaxLength(25)).pipe(Schema.brand("RelayChannelId"));
-const RelaySequence = UInt32.pipe(Schema.brand("RelaySequence"));
+const NativeE2eeEnrollmentId = Schema.String.check(Schema.isPattern(/^enr_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(47)).pipe(Schema.brand("NativeE2eeEnrollmentId"));
+const HubGrantVerificationKeyId = Schema.String.check(Schema.isPattern(/^hgk_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(47)).pipe(Schema.brand("HubGrantVerificationKeyId"));
+const RelayTicketId = Schema.String.check(Schema.isPattern(/^rtk_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(47)).pipe(Schema.brand("RelayTicketId"));
+const NativeE2eeEnrollmentRevision = UInt32$1.check(Schema.isGreaterThanOrEqualTo(1)).pipe(Schema.brand("NativeE2eeEnrollmentRevision"));
+const E2eeAuthorizationEpoch = UInt32$1.pipe(Schema.brand("E2eeAuthorizationEpoch"));
+const E2eeKeysetGeneration = UInt32$1.pipe(Schema.brand("E2eeKeysetGeneration"));
+const RelayConnectorGeneration = UInt32$1.pipe(Schema.brand("RelayConnectorGeneration"));
+const RelaySequence = UInt32$1.pipe(Schema.brand("RelaySequence"));
 const RelayHeartbeatNonce = boundedBytes(8, 8);
 const RelayAuthenticationNonce = boundedBytes(32, 32);
 const RelaySignatureMaterial = boundedBytes(64, 512);
 const RelayTicketMaterial = boundedBytes(32, 64);
+const RelayE2eeDigest = boundedBytes(32, 32).pipe(Schema.brand("RelayE2eeDigest"));
+const RelayAccountGrantContext = Schema.Tuple([
+	Schema.Literal(2),
+	RelayTicketId,
+	RelayE2eeDigest,
+	RelayE2eeDigest
+]);
 const RelayLimits = Schema.Struct({
 	maxControlFrameBytes: Schema.Int.check(Schema.isGreaterThanOrEqualTo(RELAY_MIN_CONTROL_FRAME_BYTES), Schema.isLessThanOrEqualTo(RELAY_MAX_CONTROL_FRAME_BYTES)),
 	maxDataChunkBytes: Schema.Int.check(Schema.isGreaterThanOrEqualTo(RELAY_MIN_DATA_CHUNK_BYTES), Schema.isLessThanOrEqualTo(RELAY_MAX_DATA_CHUNK_BYTES)),
@@ -485,7 +504,11 @@ const minorVersionSupportsCloseReason = (protocolMinor, reason) => reason === vo
 const minorVersionSupportsAuthorizedChannel = (input) => {
 	const hasCapability = input.capability !== void 0;
 	const hasEffectiveRole = input.effectiveRole !== void 0;
-	if (input.protocolMinor >= 2) return hasCapability && hasEffectiveRole ? void 0 : "protocol minor version 2 or newer requires channel authorization metadata";
+	if (input.accountGrantContext !== void 0 && input.protocolMinor < 3) return "account grant context requires protocol minor version 3 or newer";
+	if (input.protocolMinor >= 2) {
+		if (!hasCapability || !hasEffectiveRole) return "protocol minor version 2 or newer requires channel authorization metadata";
+		return;
+	}
 	return !hasCapability && !hasEffectiveRole ? void 0 : "channel authorization metadata requires protocol minor version 2 or newer";
 };
 const RelayNodeAuthHandshake = Schema.Struct({
@@ -513,8 +536,43 @@ const RelayChannelOpenFrame = Schema.Struct({
 	...ProtocolFields,
 	channelId: RelayChannelId,
 	capability: Schema.optionalKey(RelayCapability),
-	effectiveRole: Schema.optionalKey(RelayEffectiveRole)
+	effectiveRole: Schema.optionalKey(RelayEffectiveRole),
+	accountGrantContext: Schema.optionalKey(RelayAccountGrantContext)
 }).check(Schema.makeFilter(minorVersionSupportsAuthorizedChannel));
+const minor3Frame = (fields) => Schema.Struct({
+	...fields,
+	...ProtocolFields
+}).check(Schema.makeFilter((frame) => frame.protocolMinor >= 3 ? void 0 : "frame requires protocol minor version 3 or newer"));
+const RelayNodeE2eeStatementFrame = minor3Frame({
+	type: Schema.Literal("node.e2ee.statement"),
+	connectorGeneration: RelayConnectorGeneration,
+	statement: boundedBytes(1, RELAY_E2EE_CAPABILITY_STATEMENT_MAX_BYTES),
+	statementDigest: RelayE2eeDigest,
+	expiresAt: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER))
+});
+const RelayNodeE2eeStatementAckFrame = minor3Frame({
+	type: Schema.Literal("node.e2ee.statement.ack"),
+	connectorGeneration: RelayConnectorGeneration,
+	statementDigest: RelayE2eeDigest
+});
+const RelayHubGrantVerificationKey = Schema.Struct({
+	keyId: HubGrantVerificationKeyId,
+	publicKey: boundedBytes(32, 32),
+	notBefore: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)),
+	notAfter: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER))
+}).check(Schema.makeFilter((key) => key.notAfter > key.notBefore ? void 0 : "notAfter must be after notBefore"));
+const RelayE2eeVerifierKeysFrame = minor3Frame({
+	type: Schema.Literal("e2ee.verifier-keys"),
+	generation: E2eeKeysetGeneration,
+	keys: Schema.Array(RelayHubGrantVerificationKey).check(Schema.isMinLength(1), Schema.isMaxLength(4), Schema.makeFilter((keys) => new Set(keys.map((key) => key.keyId)).size === keys.length ? void 0 : "grant verification key ids must be distinct"))
+});
+const RelayE2eeEnrollmentRevokedFrame = minor3Frame({
+	type: Schema.Literal("e2ee.enrollment-revoked"),
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	deviceAuthEpoch: E2eeAuthorizationEpoch
+});
 const RelayChannelAcceptFrame = Schema.Struct({
 	type: Schema.Literal("channel.accept"),
 	...ProtocolFields,
@@ -568,7 +626,7 @@ const RelaySupportedVersionRange = Schema.Struct({
 const RELAY_SUPPORTED_VERSION_RANGE = RelaySupportedVersionRange.make({
 	protocolMajor: 1,
 	minimumMinor: 0,
-	maximumMinor: 2
+	maximumMinor: 3
 });
 const RelayErrorFrame = Schema.Struct({
 	type: Schema.Literal("error"),
@@ -599,7 +657,11 @@ const RelayControlFrame = Schema.Union([
 	RelayChannelCloseFrame,
 	RelayPingFrame,
 	RelayPongFrame,
-	RelayErrorFrame
+	RelayErrorFrame,
+	RelayNodeE2eeStatementFrame,
+	RelayNodeE2eeStatementAckFrame,
+	RelayE2eeVerifierKeysFrame,
+	RelayE2eeEnrollmentRevokedFrame
 ]);
 const RelayFrame = Schema.Union([RelayControlFrame, RelayDataFrame]);
 //#endregion
@@ -655,7 +717,7 @@ const HubConnectorStatus = Schema.Struct({
 	if (status.state === "degraded" && status.degradedMode === void 0) return "degraded status requires degradedMode";
 	if (status.state !== "degraded" && status.degradedMode !== void 0) return "degradedMode is allowed only for degraded status";
 	if (status.state === "online") {
-		if (status.protocolMajor !== 1 || status.protocolMinor !== 2) return "online status requires the supported relay protocol";
+		if (status.protocolMajor !== 1 || status.protocolMinor === void 0 || status.protocolMinor < 2 || status.protocolMinor > 3) return "online status requires the supported relay protocol";
 	} else if (status.protocolMajor !== void 0 || status.protocolMinor !== void 0) return "protocol is exposed only while online";
 	if (status.nextRetryAt !== void 0 && status.degradedMode !== "backing_off") return "nextRetryAt requires backing_off";
 	if (status.state !== "online" && status.activeChannels !== 0) return "active channels require online status";
@@ -726,16 +788,16 @@ const HubEnrollmentStartResult = Schema.Struct({
 	...HubEnrollmentCeremonyDetail.fields
 });
 const HOSTED_IDENTITY_MAX_ANTI_BOT_ASSERTION_CHARS = 8192;
-const strict$3 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
-const EpochMs$1 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+const strict$4 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
+const EpochMs$2 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
 const Opaque256 = Schema.String.check(Schema.isMinLength(43), Schema.isMaxLength(43), Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
-const AccountId$1 = Schema.String.check(Schema.isPattern(/^acct_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(48));
+const HubAccountId = Schema.String.check(Schema.isPattern(/^acct_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(48));
 const SessionId$1 = Schema.String.check(Schema.isPattern(/^sess_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(48));
 const BoundedDisplayName = Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(200));
 const BoundedSpaceDisplayName = Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(100));
 const BoundedPassword = Schema.String.check(Schema.isMinLength(12), Schema.isMaxLength(256));
 const AntiBotAssertion = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(HOSTED_IDENTITY_MAX_ANTI_BOT_ASSERTION_CHARS));
-const IdempotencyKey = Opaque256.pipe(Schema.brand("HostedIdentityIdempotencyKey"));
+const IdempotencyKey$1 = Opaque256.pipe(Schema.brand("HostedIdentityIdempotencyKey"));
 const SignupAttemptSecret = Opaque256.pipe(Schema.brand("PublicSignupAttemptSecret"));
 const SignupActivationSecret = Opaque256.pipe(Schema.brand("PublicSignupActivationSecret"));
 const PasswordLoginAttemptSecret = Opaque256.pipe(Schema.brand("PasswordLoginAttemptSecret"));
@@ -748,10 +810,10 @@ const MailToken = Opaque256.pipe(Schema.brand("HostedIdentityMailToken"));
 const EmailCode = Schema.String.check(Schema.isPattern(/^[0-9]{6}$/));
 const TotpCode = Schema.String.check(Schema.isPattern(/^[0-9]{6}$/));
 const JsonObject = Schema.Unknown.check(Schema.makeFilter((value) => typeof value === "object" && value !== null && !Array.isArray(value) ? void 0 : "value must be an object"));
-const strictTimed = (fields) => strict$3(Schema.Struct({
+const strictTimed = (fields) => strict$4(Schema.Struct({
 	...fields,
-	issuedAt: EpochMs$1,
-	expiresAt: EpochMs$1
+	issuedAt: EpochMs$2,
+	expiresAt: EpochMs$2
 }).check(Schema.makeFilter((value) => {
 	const timed = value;
 	return timed.expiresAt > timed.issuedAt ? void 0 : "expiresAt must be after issuedAt";
@@ -769,14 +831,14 @@ const HubNormalizedEmail = Schema.String.check(Schema.isMinLength(3), Schema.isM
 const HubLoginIdentifier = Schema.Union([HubUsername, HubNormalizedEmail]).pipe(Schema.brand("HubLoginIdentifier"));
 const PublicSignupTurnstileSiteKey = Schema.String.check(Schema.isMinLength(10), Schema.isMaxLength(128), Schema.isPattern(/^[A-Za-z0-9_-]+$/));
 Schema.Union([
-	strict$3(Schema.Struct({ status: Schema.Literal("disabled") })),
-	strict$3(Schema.Struct({
+	strict$4(Schema.Struct({ status: Schema.Literal("disabled") })),
+	strict$4(Schema.Struct({
 		status: Schema.Literal("enabled"),
-		antiBot: strict$3(Schema.Struct({ provider: Schema.Literal("bypass") }))
+		antiBot: strict$4(Schema.Struct({ provider: Schema.Literal("bypass") }))
 	})),
-	strict$3(Schema.Struct({
+	strict$4(Schema.Struct({
 		status: Schema.Literal("enabled"),
-		antiBot: strict$3(Schema.Struct({
+		antiBot: strict$4(Schema.Struct({
 			provider: Schema.Literal("turnstile"),
 			siteKey: PublicSignupTurnstileSiteKey
 		}))
@@ -784,21 +846,21 @@ Schema.Union([
 ]);
 const ExternalIdentityProvider = Schema.Literal("github");
 const ExternalIdentityLogin = Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(100), Schema.isPattern(/^[A-Za-z0-9-]+$/));
-const ExternalIdentitySummary = strict$3(Schema.Struct({
+const ExternalIdentitySummary = strict$4(Schema.Struct({
 	provider: ExternalIdentityProvider,
 	login: ExternalIdentityLogin,
 	displayName: Schema.NullOr(BoundedDisplayName),
-	connectedAt: EpochMs$1,
-	lastUsedAt: Schema.NullOr(EpochMs$1)
+	connectedAt: EpochMs$2,
+	lastUsedAt: Schema.NullOr(EpochMs$2)
 }).check(Schema.makeFilter((value) => value.lastUsedAt === null || value.lastUsedAt >= value.connectedAt ? void 0 : "lastUsedAt must not precede connectedAt")));
-const ExternalIdentityProviderPolicy = strict$3(Schema.Struct({
+const ExternalIdentityProviderPolicy = strict$4(Schema.Struct({
 	provider: ExternalIdentityProvider,
 	login: Schema.Literal(true),
 	signup: Schema.Boolean,
 	link: Schema.Literal(true)
 }));
 const ExternalIdentityProviders = Schema.Array(ExternalIdentityProviderPolicy).check(Schema.isMaxLength(1), Schema.makeFilter((providers) => new Set(providers.map((provider) => provider.provider)).size === providers.length ? void 0 : "external identity providers must be unique"));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	version: Schema.Literal(1),
 	providers: ExternalIdentityProviders
 }));
@@ -818,14 +880,14 @@ const GitHubAuthorizationUrl = Schema.String.check(Schema.isNonEmpty(), Schema.i
 		return "authorization URL must be absolute";
 	}
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	provider: ExternalIdentityProvider,
 	intent: Schema.Literals(["authenticate", "link"]),
 	returnTo: Schema.optionalKey(ExternalIdentityReturnPath)
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	authorizationUrl: GitHubAuthorizationUrl,
-	expiresAt: EpochMs$1
+	expiresAt: EpochMs$2
 }));
 const ExternalIdentityPendingErrorCode = Schema.Literals([
 	"external_provider_unavailable",
@@ -838,72 +900,72 @@ const ExternalIdentityPendingErrorCode = Schema.Literals([
 	"username_unavailable"
 ]);
 Schema.Union([
-	strict$3(Schema.Struct({ status: Schema.Literal("none") })),
-	strict$3(Schema.Struct({
+	strict$4(Schema.Struct({ status: Schema.Literal("none") })),
+	strict$4(Schema.Struct({
 		status: Schema.Literal("signup"),
 		provider: ExternalIdentityProvider,
 		suggestedUsername: Schema.NullOr(HubUsername),
 		displayName: Schema.NullOr(BoundedDisplayName),
-		expiresAt: EpochMs$1
+		expiresAt: EpochMs$2
 	})),
-	strict$3(Schema.Struct({
+	strict$4(Schema.Struct({
 		status: Schema.Literal("link"),
 		externalIdentity: ExternalIdentitySummary,
-		expiresAt: EpochMs$1
+		expiresAt: EpochMs$2
 	})),
-	strict$3(Schema.Struct({
+	strict$4(Schema.Struct({
 		status: Schema.Literal("error"),
 		provider: ExternalIdentityProvider,
 		code: ExternalIdentityPendingErrorCode
 	}))
 ]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	provider: ExternalIdentityProvider,
 	username: HubUsername,
 	antiBotAssertion: AntiBotAssertion,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(Schema.Struct({ totpCode: Schema.optionalKey(TotpCode) }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({ totpCode: Schema.optionalKey(TotpCode) }));
+strict$4(Schema.Struct({
 	status: Schema.Literal("connected"),
 	externalIdentity: ExternalIdentitySummary
 }));
-strict$3(Schema.Struct({ totpCode: Schema.optionalKey(TotpCode) }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({ totpCode: Schema.optionalKey(TotpCode) }));
+strict$4(Schema.Struct({
 	status: Schema.Literal("disconnected"),
 	signedOut: Schema.Boolean
 }));
 const ExternalIdentitySummaries = Schema.Array(ExternalIdentitySummary).check(Schema.isMaxLength(1), Schema.makeFilter((identities) => new Set(identities.map((identity) => identity.provider)).size === identities.length ? void 0 : "external identity providers must be unique"));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	passwordConfigured: Schema.Boolean,
 	totpEnrolled: Schema.Boolean,
 	emailDeliveryConfigured: Schema.Boolean,
-	email: Schema.NullOr(strict$3(Schema.Struct({
+	email: Schema.NullOr(strict$4(Schema.Struct({
 		address: HubNormalizedEmail,
 		verified: Schema.Boolean
 	}))),
 	externalIdentities: ExternalIdentitySummaries
 }));
-const HubActiveSpaceSummary = strict$3(Schema.Struct({
+const HubActiveSpaceSummary = strict$4(Schema.Struct({
 	id: HubSpaceId,
 	kind: HubSpaceKind,
 	displayName: BoundedSpaceDisplayName,
 	role: HubSpaceRole
 }));
-const HubPublicAccount = strict$3(Schema.Struct({
-	id: AccountId$1,
+const HubPublicAccount = strict$4(Schema.Struct({
+	id: HubAccountId,
 	username: HubUsername,
 	displayName: BoundedDisplayName,
-	createdAt: EpochMs$1,
+	createdAt: EpochMs$2,
 	disabledAt: Schema.Null
 }));
-const HubPublicBrowserSession = strict$3(Schema.Struct({
+const HubPublicBrowserSession = strict$4(Schema.Struct({
 	id: SessionId$1,
-	accountId: AccountId$1,
+	accountId: HubAccountId,
 	activeSpaceId: HubSpaceId,
-	createdAt: EpochMs$1,
-	expiresAt: EpochMs$1,
-	lastSeenAt: EpochMs$1,
+	createdAt: EpochMs$2,
+	expiresAt: EpochMs$2,
+	lastSeenAt: EpochMs$2,
 	revokedAt: Schema.Null,
 	revocationReasonCode: Schema.Null
 }).check(Schema.makeFilter((session) => session.expiresAt > session.createdAt && session.lastSeenAt >= session.createdAt && session.lastSeenAt <= session.expiresAt ? void 0 : "browser session timestamps are inconsistent")));
@@ -921,11 +983,11 @@ function hubSessionIdentityConsistency(value) {
 	const matches = value.spaces.filter((space) => space.id === value.activeSpace.id);
 	return matches.length === 1 && matches[0]?.role === value.activeSpace.role ? void 0 : "active space must appear exactly once in spaces";
 }
-const HubBrowserSessionResponse = strict$3(Schema.Struct({
+const HubBrowserSessionResponse = strict$4(Schema.Struct({
 	...HubSessionIdentityFields,
 	csrfToken: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(4096))
 }).check(Schema.makeFilter(hubSessionIdentityConsistency)));
-const HubSessionIdentity = strict$3(Schema.Struct(HubSessionIdentityFields).check(Schema.makeFilter(hubSessionIdentityConsistency)));
+const HubSessionIdentity = strict$4(Schema.Struct(HubSessionIdentityFields).check(Schema.makeFilter(hubSessionIdentityConsistency)));
 const NativeIdentityAttemptId = Schema.String.check(Schema.isPattern(/^nident_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(50)).pipe(Schema.brand("NativeIdentityAttemptId"));
 const NativeIdentityLoginAttemptId = Schema.String.check(Schema.isPattern(/^nlogin_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(50)).pipe(Schema.brand("NativeIdentityLoginAttemptId"));
 const NativeIdentityResetAttemptId = Schema.String.check(Schema.isPattern(/^nreset_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(50)).pipe(Schema.brand("NativeIdentityResetAttemptId"));
@@ -934,7 +996,7 @@ const NativeIdentityTimedAttempt = {
 	attemptSecret: NativeIdentityAttemptSecret,
 	resendAfterMs: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(9e5))
 };
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	email: HubNormalizedEmail,
 	antiBotAssertion: AntiBotAssertion
 }));
@@ -942,14 +1004,14 @@ strictTimed({
 	status: Schema.Literal("accepted"),
 	...NativeIdentityTimedAttempt
 });
-const NativeIdentityMailboxProof = Schema.Union([strict$3(Schema.Struct({
+const NativeIdentityMailboxProof = Schema.Union([strict$4(Schema.Struct({
 	kind: Schema.Literal("link_token"),
 	token: MailToken
-})), strict$3(Schema.Struct({
+})), strict$4(Schema.Struct({
 	kind: Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	attemptId: NativeIdentityAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	proof: NativeIdentityMailboxProof
@@ -967,41 +1029,41 @@ const NativeIdentityActivation = {
 	attemptId: NativeIdentityAttemptId,
 	activationSecret: NativeIdentityActivationSecret
 };
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	...NativeIdentityActivation,
 	username: HubUsername
 }));
-strict$3(Schema.Struct({ status: Schema.Literal("claimed") }));
-strict$3(Schema.Struct(NativeIdentityActivation));
-strict$3(Schema.Struct({ options: JsonObject }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({ status: Schema.Literal("claimed") }));
+strict$4(Schema.Struct(NativeIdentityActivation));
+strict$4(Schema.Struct({ options: JsonObject }));
+strict$4(Schema.Struct({
 	...NativeIdentityActivation,
 	response: JsonObject,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	...NativeIdentityActivation,
 	password: BoundedPassword,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	status: Schema.Literal("complete"),
 	identity: HubSessionIdentity,
 	token: NativeIdentitySessionToken
 }));
 const NativeIdentityRecoveryCodes = Schema.Array(Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(512))).check(Schema.isMinLength(1), Schema.isMaxLength(256));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	status: Schema.Literal("complete"),
 	identity: HubSessionIdentity,
 	token: NativeIdentitySessionToken,
 	recoveryCodes: NativeIdentityRecoveryCodes
 }));
-Schema.Union([strict$3(Schema.Struct({
+Schema.Union([strict$4(Schema.Struct({
 	kind: Schema.Literal("username"),
 	username: HubUsername,
 	password: BoundedPassword,
 	antiBotAssertion: Schema.optionalKey(AntiBotAssertion)
-})), strict$3(Schema.Struct({
+})), strict$4(Schema.Struct({
 	kind: Schema.Literal("verified_email"),
 	...NativeIdentityActivation,
 	password: BoundedPassword
@@ -1012,22 +1074,22 @@ strictTimed({
 	attemptSecret: NativeIdentityAttemptSecret,
 	factor: Schema.Literals(["totp", "email_code"])
 });
-Schema.Union([strict$3(Schema.Struct({
+Schema.Union([strict$4(Schema.Struct({
 	attemptId: NativeIdentityLoginAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	factor: Schema.Literal("totp"),
 	code: TotpCode
-})), strict$3(Schema.Struct({
+})), strict$4(Schema.Struct({
 	attemptId: NativeIdentityLoginAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	factor: Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	code: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(512)),
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	identifier: HubLoginIdentifier,
 	antiBotAssertion: Schema.optionalKey(AntiBotAssertion)
 }));
@@ -1037,7 +1099,7 @@ strictTimed({
 	attemptSecret: NativeIdentityAttemptSecret,
 	resendAfterMs: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(9e5))
 });
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	attemptId: NativeIdentityResetAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	proof: NativeIdentityMailboxProof
@@ -1048,17 +1110,17 @@ strictTimed({
 	resetSecret: NativeIdentityResetSecret,
 	requiresTotp: Schema.Boolean
 });
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	attemptId: NativeIdentityResetAttemptId,
 	resetSecret: NativeIdentityResetSecret,
 	password: BoundedPassword,
-	factor: Schema.Union([strict$3(Schema.Struct({ kind: Schema.Literal("none") })), strict$3(Schema.Struct({
+	factor: Schema.Union([strict$4(Schema.Struct({ kind: Schema.Literal("none") })), strict$4(Schema.Struct({
 		kind: Schema.Literal("totp"),
 		code: TotpCode
 	}))])
 }));
-strict$3(Schema.Struct({ status: Schema.Literal("complete") }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({ status: Schema.Literal("complete") }));
+strict$4(Schema.Struct({
 	attemptId: Schema.Union([
 		NativeIdentityAttemptId,
 		NativeIdentityLoginAttemptId,
@@ -1066,9 +1128,9 @@ strict$3(Schema.Struct({
 	]),
 	attemptSecret: Schema.Union([NativeIdentityAttemptSecret, NativeIdentityActivationSecret])
 }));
-strict$3(Schema.Struct({ status: Schema.Literal("cancelled") }));
+strict$4(Schema.Struct({ status: Schema.Literal("cancelled") }));
 const PublicSignupAttemptId = Schema.String.check(Schema.isPattern(/^signup_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(50)).pipe(Schema.brand("PublicSignupAttemptId"));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	username: HubUsername,
 	email: HubNormalizedEmail,
 	antiBotAssertion: AntiBotAssertion,
@@ -1080,14 +1142,14 @@ strictTimed({
 	attemptSecret: SignupAttemptSecret,
 	resendAfterMs: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(9e5))
 });
-const PublicSignupMailboxProof = Schema.Union([strict$3(Schema.Struct({
+const PublicSignupMailboxProof = Schema.Union([strict$4(Schema.Struct({
 	kind: Schema.Literal("link_token"),
 	token: MailToken
-})), strict$3(Schema.Struct({
+})), strict$4(Schema.Struct({
 	kind: Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	attemptId: PublicSignupAttemptId,
 	attemptSecret: SignupAttemptSecret,
 	proof: PublicSignupMailboxProof
@@ -1101,26 +1163,26 @@ const PublicSignupActivation = {
 	attemptId: PublicSignupAttemptId,
 	activationSecret: SignupActivationSecret
 };
-strict$3(Schema.Struct(PublicSignupActivation));
-strict$3(Schema.Struct({ options: JsonObject }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct(PublicSignupActivation));
+strict$4(Schema.Struct({ options: JsonObject }));
+strict$4(Schema.Struct({
 	...PublicSignupActivation,
 	response: JsonObject,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	...PublicSignupActivation,
 	password: BoundedPassword,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	status: Schema.Literal("complete"),
 	identity: HubBrowserSessionResponse,
 	recoveryCodes: Schema.Array(Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(512))).check(Schema.isMinLength(1), Schema.isMaxLength(256))
 }));
 const PasswordLoginAttemptId = Schema.String.check(Schema.isPattern(/^login_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(49)).pipe(Schema.brand("PasswordLoginAttemptId"));
 const PasswordLoginFactor = Schema.Literals(["totp", "email_code"]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	identifier: HubLoginIdentifier,
 	password: BoundedPassword,
 	antiBotAssertion: Schema.optional(AntiBotAssertion)
@@ -1131,43 +1193,43 @@ strictTimed({
 	attemptSecret: PasswordLoginAttemptSecret,
 	factor: PasswordLoginFactor
 });
-Schema.Union([strict$3(Schema.Struct({
+Schema.Union([strict$4(Schema.Struct({
 	attemptId: PasswordLoginAttemptId,
 	attemptSecret: PasswordLoginAttemptSecret,
 	factor: Schema.Literal("totp"),
 	code: TotpCode
-})), strict$3(Schema.Struct({
+})), strict$4(Schema.Struct({
 	attemptId: PasswordLoginAttemptId,
 	attemptSecret: PasswordLoginAttemptSecret,
 	factor: Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	identifier: HubLoginIdentifier,
 	antiBotAssertion: Schema.optional(AntiBotAssertion)
 }));
-strict$3(Schema.Struct({ status: Schema.Literal("accepted") }));
+strict$4(Schema.Struct({ status: Schema.Literal("accepted") }));
 const PasswordResetAttemptId = Schema.String.check(Schema.isPattern(/^reset_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(49)).pipe(Schema.brand("PasswordResetAttemptId"));
-strict$3(Schema.Struct({ token: MailToken }));
+strict$4(Schema.Struct({ token: MailToken }));
 strictTimed({
 	status: Schema.Literal("verified"),
 	attemptId: PasswordResetAttemptId,
 	attemptSecret: PasswordResetAttemptSecret,
 	requiresTotp: Schema.Boolean
 });
-const PasswordResetFactor = Schema.Union([strict$3(Schema.Struct({ kind: Schema.Literal("none") })), strict$3(Schema.Struct({
+const PasswordResetFactor = Schema.Union([strict$4(Schema.Struct({ kind: Schema.Literal("none") })), strict$4(Schema.Struct({
 	kind: Schema.Literal("totp"),
 	code: TotpCode
 }))]);
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	attemptId: PasswordResetAttemptId,
 	attemptSecret: PasswordResetAttemptSecret,
 	password: BoundedPassword,
 	factor: PasswordResetFactor
 }));
-strict$3(Schema.Struct({ status: Schema.Literal("complete") }));
-strict$3(Schema.Struct({ spaceId: HubSpaceId }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({ status: Schema.Literal("complete") }));
+strict$4(Schema.Struct({ spaceId: HubSpaceId }));
+strict$4(Schema.Struct({
 	activeSpace: HubActiveSpaceSummary,
 	spaces: HubSpaces
 }).check(Schema.makeFilter((value) => {
@@ -1179,7 +1241,7 @@ const DesktopInstallationId = Schema.String.check(Schema.isPattern(/^install_[A-
 const NativeNodeClaimId = Schema.String.check(Schema.isPattern(/^nclaim_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(50)).pipe(Schema.brand("NativeNodeClaimId"));
 const NativeNodeClaimEnvironmentId = Schema.String.check(Schema.isPattern(/^env_[A-Za-z0-9_-]{22}$/), Schema.isMaxLength(26)).pipe(Schema.brand("NativeNodeClaimEnvironmentId"));
 const NativeNodeClaimPublicKey = Schema.String.check(Schema.isMinLength(43), Schema.isMaxLength(43), Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/)).pipe(Schema.brand("NativeNodeClaimPublicKey"));
-const NativeNodeClaimMetadata = strict$3(Schema.Struct({
+const NativeNodeClaimMetadata = strict$4(Schema.Struct({
 	environmentId: NativeNodeClaimEnvironmentId,
 	label: Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(100)),
 	platformOs: Schema.Literals([
@@ -1198,7 +1260,7 @@ const NativeNodeClaimMetadata = strict$3(Schema.Struct({
 	publicKey: NativeNodeClaimPublicKey,
 	fingerprint: HubNodePublicKeyFingerprint
 }));
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	installationId: DesktopInstallationId,
 	node: NativeNodeClaimMetadata
 }));
@@ -1207,7 +1269,7 @@ const NativeNodeClaimStartResponse = strictTimed({
 	transcriptVersion: Schema.Literal(1),
 	claimId: NativeNodeClaimId,
 	challenge: Opaque256,
-	accountId: AccountId$1,
+	accountId: HubAccountId,
 	spaceId: HubSpaceId,
 	sessionId: SessionId$1,
 	dpopKeyThumbprint: Opaque256,
@@ -1215,16 +1277,16 @@ const NativeNodeClaimStartResponse = strictTimed({
 	environmentId: NativeNodeClaimEnvironmentId,
 	nodeFingerprint: HubNodePublicKeyFingerprint
 });
-strict$3(Schema.Struct({
+strict$4(Schema.Struct({
 	claimId: NativeNodeClaimId,
 	challenge: Opaque256,
 	signature: Schema.String.check(Schema.isMinLength(86), Schema.isMaxLength(86), Schema.isPattern(/^[A-Za-z0-9_-]{85}[AQgw]$/)),
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-const NativeNodeClaimFinishResponse = strict$3(Schema.Struct({
+const NativeNodeClaimFinishResponse = strict$4(Schema.Struct({
 	status: Schema.Literal("claimed"),
 	disposition: Schema.Literals(["created", "reconnected"]),
-	node: strict$3(Schema.Struct({
+	node: strict$4(Schema.Struct({
 		id: RelayNodeId,
 		activeKeyId: Schema.String.check(Schema.isPattern(/^nkey_[A-Za-z0-9_-]{22}$/), Schema.isMaxLength(27)),
 		environmentId: NativeNodeClaimEnvironmentId,
@@ -1233,10 +1295,10 @@ const NativeNodeClaimFinishResponse = strict$3(Schema.Struct({
 		effectiveRole: Schema.Literal("owner")
 	}))
 }));
-Schema.Union([strict$3(Schema.Struct({
+Schema.Union([strict$4(Schema.Struct({
 	error: Schema.Literal("node_claim_rejected"),
 	retryable: Schema.Literal(false)
-})), strict$3(Schema.Struct({
+})), strict$4(Schema.Struct({
 	error: Schema.Literal("node_claim_unavailable"),
 	retryable: Schema.Literal(true),
 	retryAfterMs: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(3e5)))
@@ -1248,7 +1310,7 @@ const NATIVE_HANDOFF_CALLBACK_URIS = [
 	"ryco://hosted/complete"
 ];
 const NATIVE_HANDOFF_MAX_URL_CHARS = 2048;
-const strict$2 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
+const strict$3 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
 const Base64Url256$1 = Schema.String.check(Schema.isMinLength(43), Schema.isMaxLength(43), Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
 const isBase64Url256 = Schema.is(Base64Url256$1);
 const NativeHandoffId = Base64Url256$1.pipe(Schema.brand("NativeHandoffId"));
@@ -1257,7 +1319,7 @@ const NativeHandoffCode = Base64Url256$1.pipe(Schema.brand("NativeHandoffCode"))
 const NativeHandoffCodeVerifier = Base64Url256$1.pipe(Schema.brand("NativeHandoffCodeVerifier"));
 const NativeHandoffCodeChallenge = Base64Url256$1.pipe(Schema.brand("NativeHandoffCodeChallenge"));
 const NativeHandoffCallbackUri = Schema.Literals(NATIVE_HANDOFF_CALLBACK_URIS);
-const EpochMs = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+const EpochMs$1 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
 const BoundedDeviceLabel = Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(64));
 const RelyingPartyId = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(253), Schema.isPattern(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/i));
 const DisplayName = Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(64));
@@ -1269,28 +1331,28 @@ const NativeIdentityLoginMethod = Schema.Literals([
 	"recovery_code"
 ]);
 const uniqueNonEmpty = (item, maximum) => Schema.Array(item).check(Schema.isMinLength(1), Schema.isMaxLength(maximum), Schema.makeFilter((values) => new Set(values).size === values.length ? void 0 : "values must be unique"));
-const NativeIdentityAntiBot = Schema.Union([strict$2(Schema.Struct({ provider: Schema.Literal("bypass") })), strict$2(Schema.Struct({
+const NativeIdentityAntiBot = Schema.Union([strict$3(Schema.Struct({ provider: Schema.Literal("bypass") })), strict$3(Schema.Struct({
 	provider: Schema.Literal("turnstile"),
 	siteKey: NativeIdentityTurnstileSiteKey
 }))]);
-const NativeIdentityCapability = strict$2(Schema.Struct({
+const NativeIdentityCapability = strict$3(Schema.Struct({
 	version: Schema.Literal(2),
-	email: strict$2(Schema.Struct({
+	email: strict$3(Schema.Struct({
 		verification: Schema.Literal("required"),
 		antiBot: NativeIdentityAntiBot
 	})),
-	signup: Schema.Union([strict$2(Schema.Struct({ status: Schema.Literal("disabled") })), strict$2(Schema.Struct({
+	signup: Schema.Union([strict$3(Schema.Struct({ status: Schema.Literal("disabled") })), strict$3(Schema.Struct({
 		status: Schema.Literal("enabled"),
 		primaryCredentials: uniqueNonEmpty(NativeIdentityPrimaryCredential, 2)
 	}))]),
-	login: strict$2(Schema.Struct({
+	login: strict$3(Schema.Struct({
 		methods: uniqueNonEmpty(NativeIdentityLoginMethod, 3),
-		passwordSecondFactor: strict$2(Schema.Struct({
+		passwordSecondFactor: strict$3(Schema.Struct({
 			totp: Schema.Literal("when_enrolled"),
 			fallback: Schema.Literal("verified_email_code")
 		}))
 	})),
-	recovery: strict$2(Schema.Struct({
+	recovery: strict$3(Schema.Struct({
 		recoveryCode: Schema.Boolean,
 		passwordReset: Schema.Boolean
 	}))
@@ -1339,29 +1401,29 @@ function validCallbackResponse(value, outcome) {
 }
 const ApprovedCallbackUrl = Schema.String.check(Schema.makeFilter((value) => validCallbackResponse(value, "approved") ? void 0 : "invalid approved callback URL"));
 const CancelledCallbackUrl = Schema.String.check(Schema.makeFilter((value) => validCallbackResponse(value, "cancelled") ? void 0 : "invalid cancelled callback URL"));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	service: Schema.Literal("ryco-hub"),
 	protocolVersion: Schema.Literal(1),
-	nativeHandoff: strict$2(Schema.Struct({
+	nativeHandoff: strict$3(Schema.Struct({
 		mode: Schema.Literal(NATIVE_HANDOFF_MODE),
 		version: Schema.Literal(1)
 	})),
-	relyingParty: strict$2(Schema.Struct({
+	relyingParty: strict$3(Schema.Struct({
 		id: RelyingPartyId,
 		displayName: DisplayName
 	})),
 	nativeIdentity: Schema.optionalKey(NativeIdentityCapability)
 }));
-const NativeHandoffSignInPurpose = strict$2(Schema.Struct({
+const NativeHandoffSignInPurpose = strict$3(Schema.Struct({
 	kind: Schema.Literal("sign_in"),
 	providerHint: Schema.optionalKey(ExternalIdentityProvider)
 }));
-const NativeHandoffConnectExternalIdentityPurpose = strict$2(Schema.Struct({
+const NativeHandoffConnectExternalIdentityPurpose = strict$3(Schema.Struct({
 	kind: Schema.Literal("connect_external_identity"),
 	provider: ExternalIdentityProvider
 }));
 const NativeHandoffPurpose = Schema.Union([NativeHandoffSignInPurpose, NativeHandoffConnectExternalIdentityPurpose]);
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	redirectUri: NativeHandoffCallbackUri,
 	codeChallenge: NativeHandoffCodeChallenge,
 	codeChallengeMethod: Schema.Literal("S256"),
@@ -1369,25 +1431,25 @@ strict$2(Schema.Struct({
 	deviceLabel: BoundedDeviceLabel,
 	purpose: Schema.optionalKey(NativeHandoffPurpose)
 }));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	handoffId: NativeHandoffId,
 	authorizationUrl: AuthorizationUrl,
-	expiresAt: EpochMs
+	expiresAt: EpochMs$1
 }));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	status: Schema.Literal("pending"),
 	deviceLabel: BoundedDeviceLabel,
-	expiresAt: EpochMs,
+	expiresAt: EpochMs$1,
 	providerHint: Schema.optionalKey(ExternalIdentityProvider)
 }));
-strict$2(Schema.Struct({ redirectUri: ApprovedCallbackUrl }));
-strict$2(Schema.Struct({ redirectUri: CancelledCallbackUrl }));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({ redirectUri: ApprovedCallbackUrl }));
+strict$3(Schema.Struct({ redirectUri: CancelledCallbackUrl }));
+strict$3(Schema.Struct({
 	handoffId: NativeHandoffId,
 	code: NativeHandoffCode,
 	codeVerifier: NativeHandoffCodeVerifier
 }));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	handoffId: NativeHandoffId,
 	code: NativeHandoffCode,
 	codeVerifier: NativeHandoffCodeVerifier,
@@ -1398,7 +1460,7 @@ const AccountId = Schema.String.check(Schema.isPattern(/^acct_[A-Za-z0-9_-]{22,4
 const SessionId = Schema.String.check(Schema.isPattern(/^sess_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(48));
 const SessionFamilyId = Schema.String.check(Schema.isPattern(/^sfam_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(48));
 const NullableSessionLabel = Schema.NullOr(Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(64)));
-const NativeHandoffAccount = strict$2(Schema.Struct({
+const NativeHandoffAccount = strict$3(Schema.Struct({
 	id: AccountId,
 	displayName: Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(200)),
 	role: Schema.Literals([
@@ -1406,32 +1468,241 @@ const NativeHandoffAccount = strict$2(Schema.Struct({
 		"operator",
 		"owner"
 	]),
-	createdAt: EpochMs,
+	createdAt: EpochMs$1,
 	disabledAt: Schema.Null
 }));
-const NativeHandoffSession = strict$2(Schema.Struct({
+const NativeHandoffSession = strict$3(Schema.Struct({
 	id: SessionId,
 	accountId: AccountId,
 	familyId: SessionFamilyId,
 	clientLabel: NullableSessionLabel,
 	kind: Schema.Literal("native"),
-	createdAt: EpochMs,
-	expiresAt: EpochMs,
-	lastSeenAt: EpochMs,
+	createdAt: EpochMs$1,
+	expiresAt: EpochMs$1,
+	lastSeenAt: EpochMs$1,
 	replacedBySessionId: Schema.Null,
 	revokedAt: Schema.Null,
 	revocationReasonCode: Schema.Null
 }).check(Schema.makeFilter((session) => session.expiresAt > session.createdAt && session.lastSeenAt >= session.createdAt && session.lastSeenAt <= session.expiresAt ? void 0 : "native session timestamps are inconsistent")));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	account: NativeHandoffAccount,
 	session: NativeHandoffSession,
 	token: Base64Url256$1
 }).check(Schema.makeFilter((value) => value.session.accountId === value.account.id ? void 0 : "native session account does not match")));
-strict$2(Schema.Struct({
+strict$3(Schema.Struct({
 	status: Schema.Literal("connected"),
 	purpose: NativeHandoffConnectExternalIdentityPurpose,
 	externalIdentity: ExternalIdentitySummary
 }));
+const NATIVE_E2EE_MAX_GRANT_KEYS = 4;
+const HUB_DEVICE_GRANT_MAX_BYTES = 2048;
+const HUB_DEVICE_GRANT_BASE64URL_MAX_CHARS = 2731;
+const CLIENT_PREKEY_CERTIFICATE_BASE64URL_MAX_CHARS = 1459;
+const NODE_E2EE_CAPABILITY_STATEMENT_BASE64URL_MAX_CHARS = 6920;
+const strict$2 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
+const UInt32 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(4294967295));
+const EpochMs = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+const ExactBytes = (length) => Schema.Uint8Array.check(Schema.isMinLength(length), Schema.isMaxLength(length));
+const Base64Url = (minimum, maximum) => Schema.String.check(Schema.isMinLength(minimum), Schema.isMaxLength(maximum), Schema.isPattern(/^[A-Za-z0-9_-]+$/), Schema.makeFilter((value) => value.length % 4 === 1 ? "invalid unpadded base64url length" : void 0));
+const Base64Url32 = Base64Url(43, 43);
+const Base64UrlP256 = Base64Url(87, 87);
+const HubDeviceGrantId = Schema.String.check(Schema.isPattern(/^hgr_[A-Za-z0-9_-]{22,43}$/), Schema.isMaxLength(47)).pipe(Schema.brand("HubDeviceGrantId"));
+const NodeE2eeContinuityId = Schema.String.check(Schema.isPattern(/^nct_[A-Za-z0-9_-]{22}$/), Schema.isMaxLength(26)).pipe(Schema.brand("NodeE2eeContinuityId"));
+const NativeE2eePlatform = Schema.Literals([
+	"darwin",
+	"linux",
+	"windows",
+	"ios",
+	"android"
+]);
+const NativeE2eeReportedKeyBacking = Schema.Literals([
+	"secure-enclave",
+	"strongbox",
+	"tee",
+	"tpm",
+	"hardware-backed",
+	"unavailable"
+]);
+const NativeE2eeUsableKeyBacking = Schema.Literals([
+	"secure-enclave",
+	"strongbox",
+	"tee",
+	"tpm",
+	"hardware-backed"
+]);
+const NativeE2eeEnrollmentStatus = Schema.Literals([
+	"active",
+	"revoked",
+	"superseded"
+]);
+Schema.Literals([
+	"locally-verified",
+	"account-enrolled",
+	"web-unsigned"
+]);
+const NodeE2eeAdmissionPolicy = Schema.Literals([
+	"compatibility",
+	"require-e2ee",
+	"require-native-e2ee",
+	"require-locally-approved-native-e2ee"
+]);
+const HubDeviceGrantEnvelope = Base64Url(1, HUB_DEVICE_GRANT_BASE64URL_MAX_CHARS).pipe(Schema.brand("HubDeviceGrantEnvelope"));
+const E2eeDigestBase64Url = Base64Url32.pipe(Schema.brand("E2eeDigestBase64Url"));
+const BoundedCapabilities = Schema.Array(RelayCapability).check(Schema.isMinLength(1), Schema.isMaxLength(32), Schema.makeFilter((values) => new Set(values).size === values.length ? void 0 : "capabilities must be distinct"));
+const HubOrigin = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(128), Schema.isPattern(/^https?:\/\/[^\s/]+$/));
+const DeviceLabel = Schema.Trim.check(Schema.isNonEmpty(), Schema.isMaxLength(100));
+const AppVersion = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(64));
+const IdempotencyKey = Base64Url32.pipe(Schema.brand("NativeE2eeIdempotencyKey"));
+const ReasonCode = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(64), Schema.isPattern(/^[a-z][a-z0-9_]*$/));
+const HubDeviceGrantClaims = strict$2(Schema.Struct({
+	version: Schema.Literal(1),
+	suiteId: Schema.Literal(2),
+	issuerHubOrigin: HubOrigin,
+	keyId: HubGrantVerificationKeyId,
+	grantId: HubDeviceGrantId,
+	accountId: HubAccountId,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	deviceAuthEpoch: E2eeAuthorizationEpoch,
+	deviceIdentityAlgorithm: Schema.Literal("p256"),
+	deviceIdentityPublicKey: ExactBytes(65),
+	deviceIdentityFingerprint: ExactBytes(32),
+	deviceAgreementAlgorithm: Schema.Literal("x25519"),
+	deviceAgreementPublicKey: ExactBytes(32),
+	deviceAgreementFingerprint: ExactBytes(32),
+	clientPrekeyCertificateDigest: ExactBytes(32),
+	nodeId: RelayNodeId,
+	nodeIdentityAlgorithm: Schema.Literal("ed25519"),
+	nodeIdentityPublicKey: ExactBytes(32),
+	nodeIdentityFingerprint: ExactBytes(32),
+	nodeAgreementAlgorithm: Schema.Literal("x25519"),
+	nodeAgreementPublicKey: ExactBytes(32),
+	nodeAgreementFingerprint: ExactBytes(32),
+	nodeContinuityId: NodeE2eeContinuityId,
+	nodePolicyGeneration: UInt32,
+	nodeCapabilityStatementDigest: ExactBytes(32),
+	relayTicketId: RelayTicketId,
+	maximumRole: RelayEffectiveRole,
+	capabilities: BoundedCapabilities,
+	issuedAt: EpochMs,
+	notBefore: EpochMs,
+	expiresAt: EpochMs,
+	nonce: ExactBytes(32)
+}).check(Schema.makeFilter((claims) => claims.notBefore <= claims.issuedAt && claims.issuedAt < claims.expiresAt && claims.expiresAt - claims.issuedAt <= 12e4 ? void 0 : "invalid grant validity interval")));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	hubOrigin: HubOrigin,
+	accountId: HubAccountId,
+	enrollmentId: NativeE2eeEnrollmentId,
+	expectedEnrollmentRevision: Schema.optionalKey(UInt32),
+	identityPublicKey: Base64UrlP256,
+	identityFingerprint: Base64Url32,
+	agreementPublicKey: Base64Url32,
+	agreementFingerprint: Base64Url32,
+	clientPrekeyCertificate: Base64Url(1, CLIENT_PREKEY_CERTIFICATE_BASE64URL_MAX_CHARS),
+	clientPrekeyCertificateDigest: Base64Url32,
+	certificateExpiresAt: EpochMs,
+	platform: NativeE2eePlatform,
+	appVersion: AppVersion,
+	reportedKeyBacking: NativeE2eeUsableKeyBacking,
+	deviceLabel: DeviceLabel,
+	requestedMaximumRole: RelayEffectiveRole,
+	requestedCapabilities: BoundedCapabilities,
+	enrollmentNonce: Base64Url32,
+	idempotencyKey: IdempotencyKey
+}));
+const AccountE2eeDeviceSummary = strict$2(Schema.Struct({
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	deviceAuthEpoch: E2eeAuthorizationEpoch,
+	platform: NativeE2eePlatform,
+	appVersion: AppVersion,
+	reportedKeyBacking: NativeE2eeReportedKeyBacking,
+	deviceLabel: DeviceLabel,
+	identityFingerprint: Base64Url32,
+	agreementFingerprint: Base64Url32,
+	clientPrekeyCertificateDigest: Base64Url32,
+	certificateExpiresAt: EpochMs,
+	status: NativeE2eeEnrollmentStatus,
+	createdAt: EpochMs,
+	updatedAt: EpochMs,
+	lastUsedAt: Schema.NullOr(EpochMs),
+	revokedAt: Schema.NullOr(EpochMs)
+}).check(Schema.makeFilter((device) => {
+	if (device.updatedAt < device.createdAt) return "updatedAt must not precede createdAt";
+	if (device.lastUsedAt !== null && device.lastUsedAt < device.createdAt) return "lastUsedAt must not precede createdAt";
+	if (device.revokedAt !== null && device.revokedAt < device.createdAt) return "revokedAt must not precede createdAt";
+	if (device.status === "active" && device.revokedAt !== null) return "active enrollment cannot have revokedAt";
+	if (device.status !== "active" && device.revokedAt === null) return "inactive enrollment requires revokedAt";
+})));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	enrollment: AccountE2eeDeviceSummary
+}));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	devices: Schema.Array(AccountE2eeDeviceSummary).check(Schema.isMaxLength(128), Schema.makeFilter((devices) => new Set(devices.map((device) => `${device.enrollmentId}:${device.enrollmentRevision}`)).size === devices.length ? void 0 : "device enrollment revisions must be distinct"))
+}));
+strict$2(Schema.Struct({
+	expectedEnrollmentRevision: NativeE2eeEnrollmentRevision,
+	deviceLabel: DeviceLabel
+}));
+strict$2(Schema.Struct({
+	expectedEnrollmentRevision: NativeE2eeEnrollmentRevision,
+	reasonCode: ReasonCode
+}));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	enrollment: AccountE2eeDeviceSummary
+}));
+const HubGrantVerificationKey = strict$2(Schema.Struct({
+	keyId: HubGrantVerificationKeyId,
+	publicKey: Base64Url32,
+	notBefore: EpochMs,
+	notAfter: EpochMs
+}).check(Schema.makeFilter((key) => key.notAfter > key.notBefore ? void 0 : "notAfter must be after notBefore")));
+const HubGrantVerificationKeys = Schema.Array(HubGrantVerificationKey).check(Schema.isMinLength(1), Schema.isMaxLength(NATIVE_E2EE_MAX_GRANT_KEYS), Schema.makeFilter((keys) => new Set(keys.map((key) => key.keyId)).size === keys.length ? void 0 : "grant verification key ids must be distinct"));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	generation: E2eeKeysetGeneration,
+	keys: HubGrantVerificationKeys
+}));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	nodeId: RelayNodeId,
+	capability: RelayCapability,
+	protocolMajor: Schema.Literal(1),
+	protocolMinor: Schema.Literal(3),
+	suiteId: Schema.Literal(2),
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	clientPrekeyCertificateDigest: Base64Url32
+}));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	ticket: Base64Url(43, 86),
+	ticketId: RelayTicketId,
+	expiresAt: EpochMs,
+	protocolMajor: Schema.Literal(1),
+	protocolMinor: Schema.Literal(3),
+	suiteId: Schema.Literal(2),
+	deviceGrant: HubDeviceGrantEnvelope,
+	deviceGrantDigest: E2eeDigestBase64Url,
+	nodeCapabilityStatement: Base64Url(1, NODE_E2EE_CAPABILITY_STATEMENT_BASE64URL_MAX_CHARS),
+	nodeCapabilityStatementDigest: E2eeDigestBase64Url,
+	keysetGeneration: E2eeKeysetGeneration,
+	capability: RelayCapability,
+	effectiveRole: RelayEffectiveRole
+}));
+strict$2(Schema.Struct({
+	protocolVersion: Schema.Literal(1),
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	deviceAuthEpoch: E2eeAuthorizationEpoch
+}));
 const LOCAL_INTRODUCTION_DESCRIPTOR_PATH = "/api/desktop/e2ee/local-introduction/descriptor";
 const LOCAL_INTRODUCTION_COMPLETE_PATH = "/api/desktop/e2ee/local-introduction/complete";
 const LOCAL_INTRODUCTION_CONTROL_HEADER = "x-ryco-desktop-control";
@@ -11805,4 +12076,4 @@ const collectUint8StreamText = (input) => {
 	})));
 };
 //#endregion
-export { AgentControlExternalOverviewResult as $, DESKTOP_NATIVE_NODE_CLAIM_COMMIT_PATH as $a, ThreadStatusBucketOverriddenPayload as $i, ClaudeSettings as $n, ThreadId as $o, OrchestrationEventType as $r, AgentControlMcpRecentActivityResult as $t, AGENT_CONTROL_MCP_AUTOMATION_LIST_PROMPT_MAX_CHARS as A, VcsProcessTimeoutError as Aa, ProjectionPendingApprovalDecision as Ai, AtlassianConnectionStatus as An, AuthRevokeClientSessionInput as Ao, CONTEXT_HANDOFF_INSPECTION_MAX_RESPONSE_BYTES as Ar, AgentControlMcpProposeAutomationUpdateInput as At, AGENT_CONTROL_TERMINAL_PROPOSAL_STATUSES as B, ModelCapabilities as Ba, ThreadDeletedPayload as Bi, McpProviderCapabilities as Bn, EnvironmentId$1 as Bo, DEFAULT_PROJECT_METADATA_DIR as Br, AgentControlMcpProposeProjectCreateInput as Bt, AGENT_CONTROL_DEVICE_ACTION_KINDS as C, SourceControlProviderError as Ca, PROVIDER_SEND_TURN_MAX_INPUT_CHARS as Ci, DeviceUdid as Cn, RelayChannelId as Co, ProviderSteerTurnInput as Cr, AgentControlMcpListThreadsInput as Ct, AGENT_CONTROL_EXTERNAL_MCP_TOOL_NAMES as D, VcsOutputDecodeError as Da, ProjectMetaUpdatedPayload as Di, AtlassianCapability as Dn, AuthBootstrapInput as Do, CONTEXT_HANDOFF_ACTIVITY_KIND as Dr, AgentControlMcpOrchestrationEventsResult as Dt, AGENT_CONTROL_EXTERNAL_MCP_TOOLS as E, VcsDriverKind as Ea, ProjectDeletedPayload as Ei, ThreadPriorityRpcError as En, RelayProtocolVersion as Eo, AgentTokenMode as Er, AgentControlMcpOperationalReadInput as Et, AGENT_CONTROL_MCP_TOOLS as F, DEFAULT_GIT_TEXT_GENERATION_MODEL as Fa, RuntimeMode as Fi, McpInventoryResource as Fn, AtlassianResourceId as Fo, ContextHandoffDigest as Fr, AgentControlMcpProposeDeviceInstallInput as Ft, AgentControlAutomationDefinition as G, DEFAULT_TERMINAL_ID as Ga, ThreadMetaUpdatedPayload as Gi, McpServerWritableConfig as Gn, PositiveInt as Go, OrchestrationAggregateKind as Gr, AgentControlMcpReadAutomationInput as Gt, AgentControlActionKind as H, ProviderInstanceId as Ha, ThreadGoalUpdatedPayload as Hi, McpServer as Hn, IsoDateTime as Ho, ModelSelection as Hr, AgentControlMcpProposeProjectUpdateInput as Ht, AGENT_CONTROL_MCP_TOOL_NAMES as I, DEFAULT_GIT_TEXT_GENERATION_MODEL_BY_PROVIDER as Ia, ThreadActivityAppendedPayload as Ii, McpInventoryResourceTemplate as In, AuthSessionId as Io, ContextHandoffEndpointSnapshot as Ir, AgentControlMcpProposeDeviceLaunchInput as It, AgentControlAutomationRunId as J, TerminalNotRunningError as Ja, ThreadRevertedPayload as Ji, McpWorkspaceId as Jn, RuntimeItemId as Jo, OrchestrationCheckpointSummary as Jr, AgentControlMcpReadDeviceContentInput as Jt, AgentControlAutomationId as K, TerminalCwdError as Ka, ThreadPriorityProjectedRanking as Ki, McpSettingsError as Kn, ProjectId as Ko, OrchestrationCheckpointFile as Kr, AgentControlMcpReadAutomationResult as Kt, AGENT_CONTROL_MCP_WAIT_TIMEOUT_MS_DEFAULT as L, DEFAULT_GIT_TEXT_GENERATION_OPTIONS_BY_PROVIDER as La, ThreadArchivedPayload as Li, McpInventoryTool as Ln, CheckpointRef as Lo, ContextHandoffInspectionError as Lr, AgentControlMcpProposeDeviceOpenUrlInput as Lt, AGENT_CONTROL_MCP_OPERATIONAL_RANGE_MAX_MS as M, ThreadPriorityBatchId as Ma, ProviderApprovalDecision as Mi, GitCommandError as Mn, AuthRpcError as Mo, ChatAttachment as Mr, AgentControlMcpProposeDeviceBootInput as Mt, AGENT_CONTROL_MCP_OPERATIONAL_RETENTION_MS as N, ThreadPriorityCandidateId as Na, ProviderInteractionMode as Ni, GitManagerError as Nn, ApprovalRequestId as No, ClientOrchestrationCommand as Nr, AgentControlMcpProposeDeviceDetachInput as Nt, AGENT_CONTROL_EXTERNAL_PAIRING_CODE_TTL_MS as O, VcsProcessExitError as Oa, ProjectMetadataDir as Oi, AtlassianConnectionError as On, AuthClientMetadataDeviceType as Oo, CONTEXT_HANDOFF_ERROR_MAX_CHARS as Or, AgentControlMcpProposeAutomationCancelInput as Ot, AGENT_CONTROL_MCP_READ_THREAD_TEXT_BUDGET_CHARS as P, ThreadPriorityFingerprint as Pa, ProviderSessionRuntimeStatus as Pi, TextGenerationError as Pn, AtlassianConnectionId as Po, ContextHandoffActivityPayload as Pr, AgentControlMcpProposeDeviceInputInput as Pt, AgentControlExternalIntegration as Q, OpenError as Qa, ThreadSettlementOverride as Qi, ServerProviderUpdateError as Qn, RuntimeTaskId as Qo, OrchestrationEventMetadata as Qr, AgentControlMcpReadThreadResult as Qt, AGENT_CONTROL_MCP_WAIT_TIMEOUT_MS_MAX as R, DEFAULT_MODEL as Ra, ThreadAttachedToWorktreePayload as Ri, McpListServersResult as Rn, CommandId as Ro, ContextHandoffMode as Rr, AgentControlMcpProposeDeviceRecordingInput as Rt, AGENT_CONTROL_CAPABILITIES as S, SOURCE_CONTROL_WORKFLOW_LOG_MAX_BYTES as Sa, PROVIDER_SEND_TURN_MAX_IMAGE_BYTES as Si, DeviceRpcError as Sn, RelayCapability as So, ProviderSessionStartInput as Sr, AgentControlMcpListProjectsResult as St, AGENT_CONTROL_EXTERNAL_CREDENTIAL_AUDIENCE as T, truncateSourceControlDetailContent as Ta, ProjectCreatedPayload as Ti, ThreadPriorityCandidateRanking as Tn, RelayFrame as To, ProviderStopSessionInput as Tr, AgentControlMcpMutationResult as Tt, AgentControlActionPlan as U, defaultInstanceIdForDriver as Ua, ThreadInteractionModeSetPayload as Ui, McpServerConfig as Un, MessageId as Uo, ORCHESTRATION_WS_METHODS as Ur, AgentControlMcpProposeSettingsChangeInput as Ut, AGENT_CONTROL_WS_METHODS as V, ProviderDriverKind as Va, ThreadGoalClearedPayload as Vi, McpProviderSupport as Vn, EventId as Vo, DEFAULT_PROVIDER_INTERACTION_MODE as Vr, AgentControlMcpProposeProjectRemoveInput as Vt, AgentControlAutomation as W, isProviderDriverKind as Wa, ThreadMessageSentPayload as Wi, McpServerName as Wn, NonNegativeInt as Wo, OrchestrationActorKind as Wr, AgentControlMcpProviderRuntimeEventsResult as Wt, AgentControlExternalCapabilitiesResult as X, TerminalSubscriptionResyncError as Xa, ThreadSessionSetPayload as Xi, UsageReadError as Xn, RuntimeSessionId as Xo, OrchestrationDispatchCommandError as Xr, AgentControlMcpReadDeviceStateResult as Xt, AgentControlCapability as Y, TerminalSessionLookupError as Ya, ThreadRuntimeModeSetPayload as Yi, OpinionatedPluginError as Yn, RuntimeRequestId as Yo, OrchestrationCommandReceiptStatus as Yr, AgentControlMcpReadDeviceStateInput as Yt, AgentControlExternalCreateTaskInput as Z, EDITORS as Za, ThreadSettledPayload as Zi, ServerProvider as Zn, RuntimeSubagentId as Zo, OrchestrationEvent as Zr, AgentControlMcpReadThreadInput as Zt, ProjectWriteFileError as _, ThreadGoal as _a, OrchestrationThreadHistoryCursor as _i, AgentControlRpcError as _n, RELAY_MAX_DATA_CHUNK_BYTES as _o, isToolLifecycleItemType as _r, AgentControlMcpListAutomationsInput as _t, WS_METHODS as a, TurnDispatchMode as aa, OrchestrationGetWorkflowScriptError as ai, AgentControlOperationId as an, LOCAL_INTRODUCTION_COMPLETE_PATH as ao, OpenCodeSettings as ar, AgentControlIntegrationId as at, AGENT_CONTROL_AUTOMATION_MIN_INTERVAL_MS as b, WorkItemProviderError as ba, PROVIDER_SEND_TURN_MAX_ATTACHMENT_TOTAL_BYTES as bi, DEVICE_SWIPE_DURATION_MAX_MS as bn, RELAY_MAX_RPC_MESSAGE_BYTES as bo, ProviderRespondToUserInputInput as br, AgentControlMcpListDevicesResult as bt, WsRpcGroup as c, WorktreeDeletedPayload as ca, OrchestrationProposedPlanId as ci, AgentControlPlanDigest as cn, LOCAL_INTRODUCTION_MAX_BODY_BYTES as co, ThreadEnvMode as cr, AgentControlMcpControlRequestResult as ct, PROJECT_STAGE_FILE_MAX_BYTES as d, WorktreeRestoredPayload as da, OrchestrationSession as di, AgentControlProposal as dn, HubEnrollmentCeremonyDetail as do, KeybindingsConfigError as dr, AgentControlMcpDiagnosticsSummaryResult as dt, ThreadTokenModeSetPayload as ea, OrchestrationGetFullThreadDiffError as ei, AgentControlMcpSendMessageInput as en, DESKTOP_NATIVE_NODE_CLAIM_DESCRIPTOR_PATH as eo, CodexSettings as er, TrimmedNonEmptyString as es, AgentControlExternalProjectScope as et, ProjectListEntriesError as f, WorktreeSourceControlStateUpdatedPayload as fa, OrchestrationSessionStatus as fi, AgentControlProposalId as fn, HubEnrollmentStartResult as fo, MODEL_PICKER_JUMP_KEYBINDING_COMMANDS as fr, AgentControlMcpInstallation as ft, ProjectStageFileReferenceError as g, WorktreeId as ga, OrchestrationThreadActivityTone as gi, AgentControlRiskTag as gn, RELAY_MAX_CONTROL_FRAME_BYTES as go, ToolLifecycleItemType as gr, AgentControlMcpListAutomationRunsResult as gt, ProjectSearchEntriesError as h, Worktree as ha, OrchestrationThread as hi, AgentControlResultEnvelope as hn, RELAY_FRAME_TYPES as ho, RuntimeSubagentStatus as hr, AgentControlMcpListAutomationRunsInput as ht, fromLenientJson as i, ThreadUnsettledPayload as ia, OrchestrationGetTurnDiffResult as ii, AgentControlOperation as in, DesktopNativeNodeClaimSignRequest as io, GrokSettings as ir, AgentControlExternalWaitForTaskInput as it, AGENT_CONTROL_MCP_MESSAGE_TEXT_MAX_CHARS as j, VcsUnsupportedOperationError as ja, ProjectionPendingApprovalStatus as ji, AtlassianProduct as jn, AuthRevokePairingLinkInput as jo, CONTEXT_HANDOFF_WS_METHODS as jr, AgentControlMcpProposeDeviceAttachInput as jt, AGENT_CONTROL_EXTERNAL_PROPOSAL_TTL_MS as k, VcsProcessSpawnError as ka, ProjectScript as ki, AtlassianConnectionKind as kn, AuthCreatePairingCredentialInput as ko, CONTEXT_HANDOFF_INSPECTION_CHUNK_MAX_BYTES as kr, AgentControlMcpProposeAutomationCreateInput as kt, FilesystemBrowseError as l, WorktreeManualPositionSetPayload as la, OrchestrationReadModel as li, AgentControlPrincipal as ln, LocalIntroductionCompleteRequest as lo, KeybindingRule as lr, AgentControlMcpCreateThreadsInput as lt, ProjectReadFileError as m, StatusBucket as ma, OrchestrationStopBackgroundTaskError as mi, AgentControlRequestId as mn, RELAY_AUTHENTICATION_DEADLINE_MS as mo, THREAD_JUMP_KEYBINDING_COMMANDS as mr, AgentControlMcpInterruptThreadInput as mt, decodeJsonResult as n, ThreadTurnInterruptRequestedPayload as na, OrchestrationGetTaskOutputError as ni, AgentControlMcpUpdateThreadInput as nn, DESKTOP_NATIVE_NODE_CLAIM_SIGN_PATH as no, CursorSettings as nr, AgentControlExternalTaskId as nt, WsDeviceRpcGroup as o, WorktreeArchivedPayload as oa, OrchestrationMessage as oi, AgentControlOperationState as on, LOCAL_INTRODUCTION_CONTROL_HEADER as oo, ServerSettings as or, AgentControlMcpCapabilitiesResult as ot, ProjectReadFileBinaryError as p, PullRequestState as pa, OrchestrationShellSnapshot as pi, AgentControlProposalStatus as pn, HubIdentitySummary as po, ResolvedKeybindingRule as pr, AgentControlMcpInstallationId as pt, AgentControlAutomationRun as q, TerminalHistoryError as qa, ThreadProposedPlanUpsertedPayload as qi, McpWorkspace as qn, ProviderItemId as qo, OrchestrationCheckpointStatus as qr, AgentControlMcpReadControlRequestInput as qt, formatSchemaError as r, ThreadUnarchivedPayload as ra, OrchestrationGetTurnDiffError as ri, AgentControlMcpWaitForControlRequestInput as rn, DesktopNativeNodeClaimCommitRequest as ro, DEFAULT_SERVER_SETTINGS as rr, AgentControlExternalTaskIdInput as rt, WsHostedRpcGroup as s, WorktreeCreatedPayload as sa, OrchestrationMessageRole as si, AgentControlOperationStatus as sn, LOCAL_INTRODUCTION_DESCRIPTOR_PATH as so, ServerSettingsError as sr, AgentControlMcpContextResult as st, collectUint8StreamText as t, ThreadTurnDiffCompletedPayload as ta, OrchestrationGetSnapshotError as ti, AgentControlMcpSettingsSummaryResult as tn, DESKTOP_NATIVE_NODE_CLAIM_MAX_BODY_BYTES as to, CopilotSettings as tr, TurnId as ts, AgentControlExternalRpcError as tt, PROJECT_READ_FILE_BINARY_MAX_BYTES as u, WorktreeMetaUpdatedPayload as ua, OrchestrationReplayEventsError as ui, AgentControlPromptSummary as un, HubConnectorStatus as uo, KeybindingsConfig as ur, AgentControlMcpDiagnosticsSummaryInput as ut, AGENT_CONTROL_ACTION_CAPABILITIES as v, WORK_ITEM_DETAIL_BODY_MAX_BYTES as va, OrchestrationThreadHistoryError as vi, DEVICE_CAPABILITY_LABELS as vn, RELAY_MAX_DATA_FRAME_BYTES as vo, ProviderInterruptTurnInput as vr, AgentControlMcpListAutomationsResult as vt, AGENT_CONTROL_ERROR_CODES as w, SourceControlRepositoryError as wa, ProjectAvatarSetPayload as wi, ThreadPriorityBatchSnapshot as wn, RelayEffectiveRole as wo, ProviderStopBackgroundTaskInput as wr, AgentControlMcpListThreadsResult as wt, AGENT_CONTROL_AUTOMATION_PROPOSAL_TTL_MS as x, WorkItemProviderKind as xa, PROVIDER_SEND_TURN_MAX_FILE_BYTES as xi, DEVICE_WS_METHODS as xn, RELAY_SUPPORTED_VERSION_RANGE as xo, ProviderSendTurnInput as xr, AgentControlMcpListProjectsInput as xt, AGENT_CONTROL_AUTOMATION_MAX_HORIZON_MS as y, WORK_ITEM_DETAIL_COMMENT_BODY_MAX_BYTES as ya, OrchestrationWorktreeShell as yi, DEVICE_FRAME_MAGIC as yn, RELAY_MAX_RETRY_AFTER_MS as yo, ProviderRespondToRequestInput as yr, AgentControlMcpListDevicesInput as yt, AGENT_CONTROL_RISK_TAGS as z, MODEL_SLUG_ALIASES_BY_PROVIDER as za, ThreadCreatedPayload as zi, McpOauthLoginResult as zn, ContextHandoffId as zo, DEFAULT_AGENT_TOKEN_MODE as zr, AgentControlMcpProposeDeviceShutdownInput as zt };
+export { AgentControlExternalOverviewResult as $, DESKTOP_NATIVE_NODE_CLAIM_COMMIT_PATH as $a, ThreadStatusBucketOverriddenPayload as $i, ClaudeSettings as $n, RuntimeItemId as $o, OrchestrationEventType as $r, AgentControlMcpRecentActivityResult as $t, AGENT_CONTROL_MCP_AUTOMATION_LIST_PROMPT_MAX_CHARS as A, VcsProcessTimeoutError as Aa, ProjectionPendingApprovalDecision as Ai, AtlassianConnectionStatus as An, RelayFrame as Ao, CONTEXT_HANDOFF_INSPECTION_MAX_RESPONSE_BYTES as Ar, AgentControlMcpProposeAutomationUpdateInput as At, AGENT_CONTROL_TERMINAL_PROPOSAL_STATUSES as B, ModelCapabilities as Ba, ThreadDeletedPayload as Bi, McpProviderCapabilities as Bn, AtlassianResourceId as Bo, DEFAULT_PROJECT_METADATA_DIR as Br, AgentControlMcpProposeProjectCreateInput as Bt, AGENT_CONTROL_DEVICE_ACTION_KINDS as C, SourceControlProviderError as Ca, PROVIDER_SEND_TURN_MAX_INPUT_CHARS as Ci, DeviceUdid as Cn, RELAY_MAX_DATA_FRAME_BYTES as Co, ProviderSteerTurnInput as Cr, AgentControlMcpListThreadsInput as Ct, AGENT_CONTROL_EXTERNAL_MCP_TOOL_NAMES as D, VcsOutputDecodeError as Da, ProjectMetaUpdatedPayload as Di, AtlassianCapability as Dn, RelayCapability as Do, CONTEXT_HANDOFF_ACTIVITY_KIND as Dr, AgentControlMcpOrchestrationEventsResult as Dt, AGENT_CONTROL_EXTERNAL_MCP_TOOLS as E, VcsDriverKind as Ea, ProjectDeletedPayload as Ei, ThreadPriorityRpcError as En, RELAY_SUPPORTED_VERSION_RANGE as Eo, AgentTokenMode as Er, AgentControlMcpOperationalReadInput as Et, AGENT_CONTROL_MCP_TOOLS as F, DEFAULT_GIT_TEXT_GENERATION_MODEL as Fa, RuntimeMode as Fi, McpInventoryResource as Fn, AuthRevokeClientSessionInput as Fo, ContextHandoffDigest as Fr, AgentControlMcpProposeDeviceInstallInput as Ft, AgentControlAutomationDefinition as G, DEFAULT_TERMINAL_ID as Ga, ThreadMetaUpdatedPayload as Gi, McpServerWritableConfig as Gn, EnvironmentId$1 as Go, OrchestrationAggregateKind as Gr, AgentControlMcpReadAutomationInput as Gt, AgentControlActionKind as H, ProviderInstanceId as Ha, ThreadGoalUpdatedPayload as Hi, McpServer as Hn, CheckpointRef as Ho, ModelSelection as Hr, AgentControlMcpProposeProjectUpdateInput as Ht, AGENT_CONTROL_MCP_TOOL_NAMES as I, DEFAULT_GIT_TEXT_GENERATION_MODEL_BY_PROVIDER as Ia, ThreadActivityAppendedPayload as Ii, McpInventoryResourceTemplate as In, AuthRevokePairingLinkInput as Io, ContextHandoffEndpointSnapshot as Ir, AgentControlMcpProposeDeviceLaunchInput as It, AgentControlAutomationRunId as J, TerminalNotRunningError as Ja, ThreadRevertedPayload as Ji, McpWorkspaceId as Jn, MessageId as Jo, OrchestrationCheckpointSummary as Jr, AgentControlMcpReadDeviceContentInput as Jt, AgentControlAutomationId as K, TerminalCwdError as Ka, ThreadPriorityProjectedRanking as Ki, McpSettingsError as Kn, EventId as Ko, OrchestrationCheckpointFile as Kr, AgentControlMcpReadAutomationResult as Kt, AGENT_CONTROL_MCP_WAIT_TIMEOUT_MS_DEFAULT as L, DEFAULT_GIT_TEXT_GENERATION_OPTIONS_BY_PROVIDER as La, ThreadArchivedPayload as Li, McpInventoryTool as Ln, AuthRpcError as Lo, ContextHandoffInspectionError as Lr, AgentControlMcpProposeDeviceOpenUrlInput as Lt, AGENT_CONTROL_MCP_OPERATIONAL_RANGE_MAX_MS as M, ThreadPriorityBatchId as Ma, ProviderApprovalDecision as Mi, GitCommandError as Mn, AuthBootstrapInput as Mo, ChatAttachment as Mr, AgentControlMcpProposeDeviceBootInput as Mt, AGENT_CONTROL_MCP_OPERATIONAL_RETENTION_MS as N, ThreadPriorityCandidateId as Na, ProviderInteractionMode as Ni, GitManagerError as Nn, AuthClientMetadataDeviceType as No, ClientOrchestrationCommand as Nr, AgentControlMcpProposeDeviceDetachInput as Nt, AGENT_CONTROL_EXTERNAL_PAIRING_CODE_TTL_MS as O, VcsProcessExitError as Oa, ProjectMetadataDir as Oi, AtlassianConnectionError as On, RelayChannelId as Oo, CONTEXT_HANDOFF_ERROR_MAX_CHARS as Or, AgentControlMcpProposeAutomationCancelInput as Ot, AGENT_CONTROL_MCP_READ_THREAD_TEXT_BUDGET_CHARS as P, ThreadPriorityFingerprint as Pa, ProviderSessionRuntimeStatus as Pi, TextGenerationError as Pn, AuthCreatePairingCredentialInput as Po, ContextHandoffActivityPayload as Pr, AgentControlMcpProposeDeviceInputInput as Pt, AgentControlExternalIntegration as Q, OpenError as Qa, ThreadSettlementOverride as Qi, ServerProviderUpdateError as Qn, ProviderItemId as Qo, OrchestrationEventMetadata as Qr, AgentControlMcpReadThreadResult as Qt, AGENT_CONTROL_MCP_WAIT_TIMEOUT_MS_MAX as R, DEFAULT_MODEL as Ra, ThreadAttachedToWorktreePayload as Ri, McpListServersResult as Rn, ApprovalRequestId as Ro, ContextHandoffMode as Rr, AgentControlMcpProposeDeviceRecordingInput as Rt, AGENT_CONTROL_CAPABILITIES as S, SOURCE_CONTROL_WORKFLOW_LOG_MAX_BYTES as Sa, PROVIDER_SEND_TURN_MAX_IMAGE_BYTES as Si, DeviceRpcError as Sn, RELAY_MAX_DATA_CHUNK_BYTES as So, ProviderSessionStartInput as Sr, AgentControlMcpListProjectsResult as St, AGENT_CONTROL_EXTERNAL_CREDENTIAL_AUDIENCE as T, truncateSourceControlDetailContent as Ta, ProjectCreatedPayload as Ti, ThreadPriorityCandidateRanking as Tn, RELAY_MAX_RPC_MESSAGE_BYTES as To, ProviderStopSessionInput as Tr, AgentControlMcpMutationResult as Tt, AgentControlActionPlan as U, defaultInstanceIdForDriver as Ua, ThreadInteractionModeSetPayload as Ui, McpServerConfig as Un, CommandId as Uo, ORCHESTRATION_WS_METHODS as Ur, AgentControlMcpProposeSettingsChangeInput as Ut, AGENT_CONTROL_WS_METHODS as V, ProviderDriverKind as Va, ThreadGoalClearedPayload as Vi, McpProviderSupport as Vn, AuthSessionId as Vo, DEFAULT_PROVIDER_INTERACTION_MODE as Vr, AgentControlMcpProposeProjectRemoveInput as Vt, AgentControlAutomation as W, isProviderDriverKind as Wa, ThreadMessageSentPayload as Wi, McpServerName as Wn, ContextHandoffId as Wo, OrchestrationActorKind as Wr, AgentControlMcpProviderRuntimeEventsResult as Wt, AgentControlExternalCapabilitiesResult as X, TerminalSubscriptionResyncError as Xa, ThreadSessionSetPayload as Xi, UsageReadError as Xn, PositiveInt as Xo, OrchestrationDispatchCommandError as Xr, AgentControlMcpReadDeviceStateResult as Xt, AgentControlCapability as Y, TerminalSessionLookupError as Ya, ThreadRuntimeModeSetPayload as Yi, OpinionatedPluginError as Yn, NonNegativeInt as Yo, OrchestrationCommandReceiptStatus as Yr, AgentControlMcpReadDeviceStateInput as Yt, AgentControlExternalCreateTaskInput as Z, EDITORS as Za, ThreadSettledPayload as Zi, ServerProvider as Zn, ProjectId as Zo, OrchestrationEvent as Zr, AgentControlMcpReadThreadInput as Zt, ProjectWriteFileError as _, ThreadGoal as _a, OrchestrationThreadHistoryCursor as _i, AgentControlRpcError as _n, HubIdentitySummary as _o, isToolLifecycleItemType as _r, AgentControlMcpListAutomationsInput as _t, WS_METHODS as a, TurnDispatchMode as aa, OrchestrationGetWorkflowScriptError as ai, AgentControlOperationId as an, LOCAL_INTRODUCTION_COMPLETE_PATH as ao, OpenCodeSettings as ar, TrimmedNonEmptyString as as, AgentControlIntegrationId as at, AGENT_CONTROL_AUTOMATION_MIN_INTERVAL_MS as b, WorkItemProviderError as ba, PROVIDER_SEND_TURN_MAX_ATTACHMENT_TOTAL_BYTES as bi, DEVICE_SWIPE_DURATION_MAX_MS as bn, RELAY_FRAME_TYPES as bo, ProviderRespondToUserInputInput as br, AgentControlMcpListDevicesResult as bt, WsRpcGroup as c, WorktreeDeletedPayload as ca, OrchestrationProposedPlanId as ci, AgentControlPlanDigest as cn, LOCAL_INTRODUCTION_MAX_BODY_BYTES as co, ThreadEnvMode as cr, AgentControlMcpControlRequestResult as ct, PROJECT_STAGE_FILE_MAX_BYTES as d, WorktreeRestoredPayload as da, OrchestrationSession as di, AgentControlProposal as dn, HubDeviceGrantClaims as do, KeybindingsConfigError as dr, AgentControlMcpDiagnosticsSummaryResult as dt, ThreadTokenModeSetPayload as ea, OrchestrationGetFullThreadDiffError as ei, AgentControlMcpSendMessageInput as en, DESKTOP_NATIVE_NODE_CLAIM_DESCRIPTOR_PATH as eo, CodexSettings as er, RuntimeRequestId as es, AgentControlExternalProjectScope as et, ProjectListEntriesError as f, WorktreeSourceControlStateUpdatedPayload as fa, OrchestrationSessionStatus as fi, AgentControlProposalId as fn, NATIVE_E2EE_MAX_GRANT_KEYS as fo, MODEL_PICKER_JUMP_KEYBINDING_COMMANDS as fr, AgentControlMcpInstallation as ft, ProjectStageFileReferenceError as g, WorktreeId as ga, OrchestrationThreadActivityTone as gi, AgentControlRiskTag as gn, HubEnrollmentStartResult as go, ToolLifecycleItemType as gr, AgentControlMcpListAutomationRunsResult as gt, ProjectSearchEntriesError as h, Worktree as ha, OrchestrationThread as hi, AgentControlResultEnvelope as hn, HubEnrollmentCeremonyDetail as ho, RuntimeSubagentStatus as hr, AgentControlMcpListAutomationRunsInput as ht, fromLenientJson as i, ThreadUnsettledPayload as ia, OrchestrationGetTurnDiffResult as ii, AgentControlOperation as in, DesktopNativeNodeClaimSignRequest as io, GrokSettings as ir, ThreadId as is, AgentControlExternalWaitForTaskInput as it, AGENT_CONTROL_MCP_MESSAGE_TEXT_MAX_CHARS as j, VcsUnsupportedOperationError as ja, ProjectionPendingApprovalStatus as ji, AtlassianProduct as jn, RelayProtocolVersion as jo, CONTEXT_HANDOFF_WS_METHODS as jr, AgentControlMcpProposeDeviceAttachInput as jt, AGENT_CONTROL_EXTERNAL_PROPOSAL_TTL_MS as k, VcsProcessSpawnError as ka, ProjectScript as ki, AtlassianConnectionKind as kn, RelayEffectiveRole as ko, CONTEXT_HANDOFF_INSPECTION_CHUNK_MAX_BYTES as kr, AgentControlMcpProposeAutomationCreateInput as kt, FilesystemBrowseError as l, WorktreeManualPositionSetPayload as la, OrchestrationReadModel as li, AgentControlPrincipal as ln, LocalIntroductionCompleteRequest as lo, KeybindingRule as lr, AgentControlMcpCreateThreadsInput as lt, ProjectReadFileError as m, StatusBucket as ma, OrchestrationStopBackgroundTaskError as mi, AgentControlRequestId as mn, HubConnectorStatus as mo, THREAD_JUMP_KEYBINDING_COMMANDS as mr, AgentControlMcpInterruptThreadInput as mt, decodeJsonResult as n, ThreadTurnInterruptRequestedPayload as na, OrchestrationGetTaskOutputError as ni, AgentControlMcpUpdateThreadInput as nn, DESKTOP_NATIVE_NODE_CLAIM_SIGN_PATH as no, CursorSettings as nr, RuntimeSubagentId as ns, AgentControlExternalTaskId as nt, WsDeviceRpcGroup as o, WorktreeArchivedPayload as oa, OrchestrationMessage as oi, AgentControlOperationState as on, LOCAL_INTRODUCTION_CONTROL_HEADER as oo, ServerSettings as or, TurnId as os, AgentControlMcpCapabilitiesResult as ot, ProjectReadFileBinaryError as p, PullRequestState as pa, OrchestrationShellSnapshot as pi, AgentControlProposalStatus as pn, NodeE2eeAdmissionPolicy as po, ResolvedKeybindingRule as pr, AgentControlMcpInstallationId as pt, AgentControlAutomationRun as q, TerminalHistoryError as qa, ThreadProposedPlanUpsertedPayload as qi, McpWorkspace as qn, IsoDateTime as qo, OrchestrationCheckpointStatus as qr, AgentControlMcpReadControlRequestInput as qt, formatSchemaError as r, ThreadUnarchivedPayload as ra, OrchestrationGetTurnDiffError as ri, AgentControlMcpWaitForControlRequestInput as rn, DesktopNativeNodeClaimCommitRequest as ro, DEFAULT_SERVER_SETTINGS as rr, RuntimeTaskId as rs, AgentControlExternalTaskIdInput as rt, WsHostedRpcGroup as s, WorktreeCreatedPayload as sa, OrchestrationMessageRole as si, AgentControlOperationStatus as sn, LOCAL_INTRODUCTION_DESCRIPTOR_PATH as so, ServerSettingsError as sr, AgentControlMcpContextResult as st, collectUint8StreamText as t, ThreadTurnDiffCompletedPayload as ta, OrchestrationGetSnapshotError as ti, AgentControlMcpSettingsSummaryResult as tn, DESKTOP_NATIVE_NODE_CLAIM_MAX_BODY_BYTES as to, CopilotSettings as tr, RuntimeSessionId as ts, AgentControlExternalRpcError as tt, PROJECT_READ_FILE_BINARY_MAX_BYTES as u, WorktreeMetaUpdatedPayload as ua, OrchestrationReplayEventsError as ui, AgentControlPromptSummary as un, HUB_DEVICE_GRANT_MAX_BYTES as uo, KeybindingsConfig as ur, AgentControlMcpDiagnosticsSummaryInput as ut, AGENT_CONTROL_ACTION_CAPABILITIES as v, WORK_ITEM_DETAIL_BODY_MAX_BYTES as va, OrchestrationThreadHistoryError as vi, DEVICE_CAPABILITY_LABELS as vn, HubGrantVerificationKeyId as vo, ProviderInterruptTurnInput as vr, AgentControlMcpListAutomationsResult as vt, AGENT_CONTROL_ERROR_CODES as w, SourceControlRepositoryError as wa, ProjectAvatarSetPayload as wi, ThreadPriorityBatchSnapshot as wn, RELAY_MAX_RETRY_AFTER_MS as wo, ProviderStopBackgroundTaskInput as wr, AgentControlMcpListThreadsResult as wt, AGENT_CONTROL_AUTOMATION_PROPOSAL_TTL_MS as x, WorkItemProviderKind as xa, PROVIDER_SEND_TURN_MAX_FILE_BYTES as xi, DEVICE_WS_METHODS as xn, RELAY_MAX_CONTROL_FRAME_BYTES as xo, ProviderSendTurnInput as xr, AgentControlMcpListProjectsInput as xt, AGENT_CONTROL_AUTOMATION_MAX_HORIZON_MS as y, WORK_ITEM_DETAIL_COMMENT_BODY_MAX_BYTES as ya, OrchestrationWorktreeShell as yi, DEVICE_FRAME_MAGIC as yn, RELAY_AUTHENTICATION_DEADLINE_MS as yo, ProviderRespondToRequestInput as yr, AgentControlMcpListDevicesInput as yt, AGENT_CONTROL_RISK_TAGS as z, MODEL_SLUG_ALIASES_BY_PROVIDER as za, ThreadCreatedPayload as zi, McpOauthLoginResult as zn, AtlassianConnectionId as zo, DEFAULT_AGENT_TOKEN_MODE as zr, AgentControlMcpProposeDeviceShutdownInput as zt };