t3code-cli 0.3.0 → 0.4.0

package/dist/upstream-t3code/packages/contracts/src/auth.d.ts

@@ -52,8 +52,10 @@ export type ServerAuthBootstrapMethod = typeof ServerAuthBootstrapMethod.Type;
  *   app after bootstrap/pairing
  * - `bearer-access-token`: scoped token suitable for non-cookie or
  *   non-browser clients
+ * - `dpop-access-token`: scoped proof-of-possession token used by managed
+ *   relay connections
  */
-export declare const ServerAuthSessionMethod: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+export declare const ServerAuthSessionMethod: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
 export type ServerAuthSessionMethod = typeof ServerAuthSessionMethod.Type;
 export declare const AuthOrchestrationReadScope: "orchestration:read";
 export declare const AuthOrchestrationOperateScope: "orchestration:operate";
@@ -95,7 +97,7 @@ export declare const AuthEnvironmentBootstrapTokenType: "urn:t3:params:oauth:tok
 export declare const ServerAuthDescriptor: Schema.Struct<{
     readonly policy: Schema.Literals<readonly ["desktop-managed-local", "loopback-browser", "remote-reachable", "unsafe-no-auth"]>;
     readonly bootstrapMethods: Schema.$Array<Schema.Literals<readonly ["desktop-bootstrap", "one-time-token"]>>;
-    readonly sessionMethods: Schema.$Array<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>>;
+    readonly sessionMethods: Schema.$Array<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>>;
     readonly sessionCookieName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
 }>;
 export type ServerAuthDescriptor = typeof ServerAuthDescriptor.Type;
@@ -106,7 +108,7 @@ export type AuthBrowserSessionRequest = typeof AuthBrowserSessionRequest.Type;
 export declare const AuthBrowserSessionResult: Schema.Struct<{
     readonly authenticated: Schema.Literal<true>;
     readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-    readonly sessionMethod: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+    readonly sessionMethod: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
     readonly expiresAt: Schema.DateTimeUtc;
 }>;
 export type AuthBrowserSessionResult = typeof AuthBrowserSessionResult.Type;
@@ -132,7 +134,7 @@ export type AuthTokenExchangeRequest = typeof AuthTokenExchangeRequest.Type;
 export declare const AuthAccessTokenResult: Schema.Struct<{
     readonly access_token: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly issued_token_type: Schema.Literal<"urn:ietf:params:oauth:token-type:access_token">;
-    readonly token_type: Schema.Literal<"Bearer">;
+    readonly token_type: Schema.Literals<readonly ["Bearer", "DPoP"]>;
     readonly expires_in: Schema.Number;
     readonly scope: Schema.decodeTo<Schema.String, Schema.String, never, never>;
 }>;
@@ -172,7 +174,7 @@ export declare const AuthClientSession: Schema.Struct<{
     readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
     readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-    readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+    readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
     readonly client: Schema.Struct<{
         readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
         readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -202,7 +204,7 @@ export declare const AuthAccessSnapshot: Schema.Struct<{
         readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
         readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
         readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-        readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+        readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
         readonly client: Schema.Struct<{
             readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
             readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -237,7 +239,7 @@ export declare const AuthAccessStreamSnapshotEvent: Schema.Struct<{
             readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
             readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
             readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-            readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+            readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
             readonly client: Schema.Struct<{
                 readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
                 readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -298,7 +300,7 @@ export declare const AuthAccessStreamClientUpsertedEvent: Schema.Struct<{
         readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
         readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
         readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-        readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+        readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
         readonly client: Schema.Struct<{
             readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
             readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -342,7 +344,7 @@ export declare const AuthAccessStreamEvent: Schema.Union<readonly [Schema.Struct
             readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
             readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
             readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-            readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+            readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
             readonly client: Schema.Struct<{
                 readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
                 readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -386,7 +388,7 @@ export declare const AuthAccessStreamEvent: Schema.Union<readonly [Schema.Struct
         readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
         readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
         readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-        readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+        readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
         readonly client: Schema.Struct<{
             readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
             readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -428,11 +430,11 @@ export declare const AuthSessionState: Schema.Struct<{
     readonly auth: Schema.Struct<{
         readonly policy: Schema.Literals<readonly ["desktop-managed-local", "loopback-browser", "remote-reachable", "unsafe-no-auth"]>;
         readonly bootstrapMethods: Schema.$Array<Schema.Literals<readonly ["desktop-bootstrap", "one-time-token"]>>;
-        readonly sessionMethods: Schema.$Array<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>>;
+        readonly sessionMethods: Schema.$Array<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>>;
         readonly sessionCookieName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     }>;
     readonly scopes: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>>;
-    readonly sessionMethod: Schema.optionalKey<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>>;
+    readonly sessionMethod: Schema.optionalKey<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>>;
     readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtc>;
 }>;
 export type AuthSessionState = typeof AuthSessionState.Type;

package/dist/upstream-t3code/packages/contracts/src/environmentHttp.d.ts

@@ -59,11 +59,49 @@ export declare class EnvironmentInternalError extends EnvironmentInternalError_b
 }
 export declare const EnvironmentHttpCommonError: Schema.Union<readonly [typeof EnvironmentRequestInvalidError, typeof EnvironmentAuthInvalidError, typeof EnvironmentScopeRequiredError, typeof EnvironmentOperationForbiddenError, typeof EnvironmentInternalError]>;
 export type EnvironmentHttpCommonError = typeof EnvironmentHttpCommonError.Type;
+declare const EnvironmentHttpBadRequestError_base: Schema.Class<EnvironmentHttpBadRequestError, Schema.TaggedStruct<"EnvironmentHttpBadRequestError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentHttpBadRequestError extends EnvironmentHttpBadRequestError_base {
+    [HttpServerRespondable.symbol](): import("effect/Effect").Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpBody").HttpBodyError, never>;
+}
+declare const EnvironmentHttpUnauthorizedError_base: Schema.Class<EnvironmentHttpUnauthorizedError, Schema.TaggedStruct<"EnvironmentHttpUnauthorizedError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentHttpUnauthorizedError extends EnvironmentHttpUnauthorizedError_base {
+    [HttpServerRespondable.symbol](): import("effect/Effect").Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpBody").HttpBodyError, never>;
+}
+declare const EnvironmentHttpForbiddenError_base: Schema.Class<EnvironmentHttpForbiddenError, Schema.TaggedStruct<"EnvironmentHttpForbiddenError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentHttpForbiddenError extends EnvironmentHttpForbiddenError_base {
+    [HttpServerRespondable.symbol](): import("effect/Effect").Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpBody").HttpBodyError, never>;
+}
+declare const EnvironmentHttpInternalServerError_base: Schema.Class<EnvironmentHttpInternalServerError, Schema.TaggedStruct<"EnvironmentHttpInternalServerError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentHttpInternalServerError extends EnvironmentHttpInternalServerError_base {
+    [HttpServerRespondable.symbol](): import("effect/Effect").Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpBody").HttpBodyError, never>;
+}
+declare const EnvironmentHttpConflictError_base: Schema.Class<EnvironmentHttpConflictError, Schema.TaggedStruct<"EnvironmentHttpConflictError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentHttpConflictError extends EnvironmentHttpConflictError_base {
+    [HttpServerRespondable.symbol](): import("effect/Effect").Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpBody").HttpBodyError, never>;
+}
+declare const EnvironmentCloudEndpointUnavailableError_base: Schema.Class<EnvironmentCloudEndpointUnavailableError, Schema.TaggedStruct<"EnvironmentCloudEndpointUnavailableError", {
+    readonly message: Schema.String;
+    readonly endpointRuntimeStatus: Schema.Unknown;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentCloudEndpointUnavailableError extends EnvironmentCloudEndpointUnavailableError_base {
+    [HttpServerRespondable.symbol](): import("effect/Effect").Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpBody").HttpBodyError, never>;
+}
 export interface EnvironmentSessionPrincipalShape {
     readonly sessionId: AuthSessionId;
     readonly subject: string;
     readonly method: ServerAuthSessionMethod;
     readonly scopes: ReadonlySet<AuthEnvironmentScope>;
+    readonly proofKeyThumbprint?: string;
     readonly expiresAt?: DateTime.DateTime;
 }
 declare const EnvironmentAuthenticatedPrincipal_base: Context.ServiceClass<EnvironmentAuthenticatedPrincipal, "@t3tools/contracts/environmentHttp/EnvironmentAuthenticatedPrincipal", EnvironmentSessionPrincipalShape>;
@@ -79,6 +117,23 @@ declare const EnvironmentAuthenticatedAuth_base: HttpApiMiddleware.ServiceClass<
 }, HttpApiMiddleware.HttpApiMiddleware<EnvironmentAuthenticatedPrincipal, readonly [typeof EnvironmentAuthInvalidError, typeof EnvironmentInternalError], never>>;
 export declare class EnvironmentAuthenticatedAuth extends EnvironmentAuthenticatedAuth_base {
 }
+export declare const EnvironmentCloudRelayConfigResult: Schema.Struct<{
+    readonly ok: Schema.Boolean;
+    readonly endpointRuntimeStatus: Schema.Unknown;
+}>;
+export type EnvironmentCloudRelayConfigResult = typeof EnvironmentCloudRelayConfigResult.Type;
+export declare const EnvironmentCloudLinkStateResult: Schema.Struct<{
+    readonly linked: Schema.Boolean;
+    readonly cloudUserId: Schema.NullOr<Schema.String>;
+    readonly relayUrl: Schema.NullOr<Schema.String>;
+    readonly relayIssuer: Schema.NullOr<Schema.String>;
+    readonly publishAgentActivity: Schema.Boolean;
+}>;
+export type EnvironmentCloudLinkStateResult = typeof EnvironmentCloudLinkStateResult.Type;
+export declare const EnvironmentCloudPreferencesRequest: Schema.Struct<{
+    readonly publishAgentActivity: Schema.Boolean;
+}>;
+export type EnvironmentCloudPreferencesRequest = typeof EnvironmentCloudPreferencesRequest.Type;
 export declare const AuthPairingLinkRevokeResult: Schema.Struct<{
     readonly revoked: Schema.Boolean;
 }>;
@@ -107,23 +162,24 @@ export declare class EnvironmentMetadataHttpApi extends EnvironmentMetadataHttpA
 }
 declare const EnvironmentAuthHttpApi_base: HttpApiGroup.HttpApiGroup<"auth", HttpApiEndpoint.HttpApiEndpoint<"session", "GET", "/api/auth/session", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly authenticated: Schema.Boolean;
     readonly auth: Schema.Struct<{
         readonly policy: Schema.Literals<readonly ["desktop-managed-local", "loopback-browser", "remote-reachable", "unsafe-no-auth"]>;
         readonly bootstrapMethods: Schema.$Array<Schema.Literals<readonly ["desktop-bootstrap", "one-time-token"]>>;
-        readonly sessionMethods: Schema.$Array<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>>;
+        readonly sessionMethods: Schema.$Array<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>>;
         readonly sessionCookieName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     }>;
     readonly scopes: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>>;
-    readonly sessionMethod: Schema.optionalKey<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>>;
+    readonly sessionMethod: Schema.optionalKey<Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>>;
     readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtc>;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentInternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"browserSession", "POST", "/api/auth/browser-session", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly credential: Schema.decodeTo<Schema.String, Schema.String, never, never>;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly authenticated: Schema.Literal<true>;
     readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-    readonly sessionMethod: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+    readonly sessionMethod: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
     readonly expiresAt: Schema.DateTimeUtc;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentAuthInvalidError | typeof EnvironmentInternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"token", "POST", "/oauth/token", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly grant_type: Schema.Literal<"urn:ietf:params:oauth:grant-type:token-exchange">;
@@ -134,14 +190,17 @@ declare const EnvironmentAuthHttpApi_base: HttpApiGroup.HttpApiGroup<"auth", Htt
     readonly client_label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
     readonly client_device_type: Schema.optionalKey<Schema.Literals<readonly ["desktop", "mobile", "tablet", "bot", "unknown"]>>;
     readonly client_os: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly dpop: Schema.optionalKey<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly access_token: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly issued_token_type: Schema.Literal<"urn:ietf:params:oauth:token-type:access_token">;
-    readonly token_type: Schema.Literal<"Bearer">;
+    readonly token_type: Schema.Literals<readonly ["Bearer", "DPoP"]>;
     readonly expires_in: Schema.Number;
     readonly scope: Schema.decodeTo<Schema.String, Schema.String, never, never>;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentRequestInvalidError | typeof EnvironmentAuthInvalidError | typeof EnvironmentInternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"webSocketTicket", "POST", "/api/auth/websocket-ticket", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly ticket: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly expiresAt: Schema.DateTimeUtc;
@@ -150,6 +209,7 @@ declare const EnvironmentAuthHttpApi_base: HttpApiGroup.HttpApiGroup<"auth", Htt
     readonly scopes: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>>;
 }>>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly id: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly credential: Schema.decodeTo<Schema.String, Schema.String, never, never>;
@@ -157,6 +217,7 @@ declare const EnvironmentAuthHttpApi_base: HttpApiGroup.HttpApiGroup<"auth", Htt
     readonly expiresAt: Schema.DateTimeUtc;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentRequestInvalidError | typeof EnvironmentScopeRequiredError | typeof EnvironmentInternalError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"pairingLinks", "GET", "/api/auth/pairing-links", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.$Array<Schema.Struct<{
     readonly id: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly credential: Schema.decodeTo<Schema.String, Schema.String, never, never>;
@@ -169,15 +230,17 @@ declare const EnvironmentAuthHttpApi_base: HttpApiGroup.HttpApiGroup<"auth", Htt
     readonly id: Schema.decodeTo<Schema.String, Schema.String, never, never>;
 }>>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly revoked: Schema.Boolean;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentInternalError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"clients", "GET", "/api/auth/clients", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.$Array<Schema.Struct<{
     readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
     readonly subject: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly scopes: Schema.$Array<Schema.Literals<readonly ["orchestration:read", "orchestration:operate", "terminal:operate", "review:write", "access:read", "access:write", "relay:read", "relay:write"]>>;
-    readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token"]>;
+    readonly method: Schema.Literals<readonly ["browser-session-cookie", "bearer-access-token", "dpop-access-token"]>;
     readonly client: Schema.Struct<{
         readonly label: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
         readonly ipAddress: Schema.optionalKey<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
@@ -195,10 +258,12 @@ declare const EnvironmentAuthHttpApi_base: HttpApiGroup.HttpApiGroup<"auth", Htt
     readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AuthSessionId">;
 }>>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly revoked: Schema.Boolean;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentOperationForbiddenError | typeof EnvironmentInternalError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"revokeOtherClients", "POST", "/api/auth/clients/revoke-others", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly revokedCount: Schema.Number;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentInternalError>, EnvironmentAuthenticatedAuth, never>, false>;
@@ -206,6 +271,7 @@ export declare class EnvironmentAuthHttpApi extends EnvironmentAuthHttpApi_base
 }
 declare const EnvironmentOrchestrationHttpApi_base: HttpApiGroup.HttpApiGroup<"orchestration", HttpApiEndpoint.HttpApiEndpoint<"snapshot", "GET", "/api/orchestration/snapshot", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly snapshotSequence: Schema.Int;
     readonly projects: Schema.$Array<Schema.Struct<{
@@ -591,12 +657,106 @@ declare const EnvironmentOrchestrationHttpApi_base: HttpApiGroup.HttpApiGroup<"o
     readonly createdAt: Schema.String;
 }>]>>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly sequence: Schema.Int;
 }>>, HttpApiEndpoint.Json<typeof EnvironmentRequestInvalidError | typeof EnvironmentScopeRequiredError | typeof EnvironmentInternalError>, EnvironmentAuthenticatedAuth, never>, false>;
 export declare class EnvironmentOrchestrationHttpApi extends EnvironmentOrchestrationHttpApi_base {
 }
-declare const EnvironmentHttpApi_base: HttpApi.HttpApi<"environment", typeof EnvironmentMetadataHttpApi | typeof EnvironmentAuthHttpApi | typeof EnvironmentOrchestrationHttpApi>;
+declare const EnvironmentCloudHttpApi_base: HttpApiGroup.HttpApiGroup<"cloud", HttpApiEndpoint.HttpApiEndpoint<"linkProof", "POST", "/api/cloud/link-proof", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly challenge: Schema.String;
+    readonly relayIssuer: Schema.String;
+    readonly endpoint: Schema.Struct<{
+        readonly httpBaseUrl: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly wsBaseUrl: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly providerKind: Schema.Literals<readonly ["manual", "cloudflare_tunnel", "t3_relay"]>;
+    }>;
+    readonly origin: Schema.Struct<{
+        readonly localHttpHost: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly localHttpPort: Schema.Int;
+    }>;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.decodeTo<Schema.String, Schema.String, never, never>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"relayConfig", "POST", "/api/cloud/relay-config", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly relayUrl: Schema.String;
+    readonly relayIssuer: Schema.optional<Schema.String>;
+    readonly cloudUserId: Schema.String;
+    readonly environmentCredential: Schema.String;
+    readonly cloudMintPublicKey: Schema.String;
+    readonly endpointRuntime: Schema.NullOr<Schema.Struct<{
+        readonly providerKind: Schema.Literals<readonly ["manual", "cloudflare_tunnel", "t3_relay"]>;
+        readonly connectorToken: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly tunnelId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly tunnelName: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>>;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ok: Schema.Boolean;
+    readonly endpointRuntimeStatus: Schema.Unknown;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError | typeof EnvironmentCloudEndpointUnavailableError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"linkState", "GET", "/api/cloud/link-state", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly linked: Schema.Boolean;
+    readonly cloudUserId: Schema.NullOr<Schema.String>;
+    readonly relayUrl: Schema.NullOr<Schema.String>;
+    readonly relayIssuer: Schema.NullOr<Schema.String>;
+    readonly publishAgentActivity: Schema.Boolean;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"unlink", "POST", "/api/cloud/unlink", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ok: Schema.Boolean;
+    readonly endpointRuntimeStatus: Schema.Unknown;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"preferences", "POST", "/api/cloud/preferences", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly publishAgentActivity: Schema.Boolean;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authorization: Schema.optionalKey<Schema.String>;
+    readonly dpop: Schema.optionalKey<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly linked: Schema.Boolean;
+    readonly cloudUserId: Schema.NullOr<Schema.String>;
+    readonly relayUrl: Schema.NullOr<Schema.String>;
+    readonly relayIssuer: Schema.NullOr<Schema.String>;
+    readonly publishAgentActivity: Schema.Boolean;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, EnvironmentAuthenticatedAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"health", "POST", "/api/t3-cloud/health", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly proof: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly environmentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EnvironmentId">;
+    readonly status: Schema.Literal<"online">;
+    readonly descriptor: Schema.Struct<{
+        readonly environmentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EnvironmentId">;
+        readonly label: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly platform: Schema.Struct<{
+            readonly os: Schema.Literals<readonly ["darwin", "linux", "windows", "unknown"]>;
+            readonly arch: Schema.Literals<readonly ["arm64", "x64", "other"]>;
+        }>;
+        readonly serverVersion: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly capabilities: Schema.Struct<{
+            readonly repositoryIdentity: Schema.withDecodingDefault<Schema.Boolean, never>;
+        }>;
+    }>;
+    readonly checkedAt: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+    readonly proof: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"mintCredential", "POST", "/api/cloud/mint-credential", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly proof: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly credential: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+    readonly expiresAt: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+    readonly proof: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"t3MintCredential", "POST", "/api/t3-cloud/mint-credential", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly proof: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly credential: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+    readonly expiresAt: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+    readonly proof: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+}>>, HttpApiEndpoint.Json<typeof EnvironmentScopeRequiredError | typeof EnvironmentHttpBadRequestError | typeof EnvironmentHttpUnauthorizedError | typeof EnvironmentHttpForbiddenError | typeof EnvironmentHttpInternalServerError | typeof EnvironmentHttpConflictError>, never, never>, false>;
+export declare class EnvironmentCloudHttpApi extends EnvironmentCloudHttpApi_base {
+}
+declare const EnvironmentHttpApi_base: HttpApi.HttpApi<"environment", typeof EnvironmentMetadataHttpApi | typeof EnvironmentAuthHttpApi | typeof EnvironmentOrchestrationHttpApi | typeof EnvironmentCloudHttpApi>;
 export declare class EnvironmentHttpApi extends EnvironmentHttpApi_base {
 }
 export {};

package/dist/upstream-t3code/packages/contracts/src/index.d.ts

@@ -2,6 +2,7 @@ export * from "./baseSchemas.ts";
 export * from "./auth.ts";
 export * from "./environment.ts";
 export * from "./environmentHttp.ts";
+export * from "./relayClient.ts";
 export * from "./desktopBootstrap.ts";
 export * from "./remoteAccess.ts";
 export * from "./ipc.ts";

package/dist/upstream-t3code/packages/contracts/src/ipc.d.ts

@@ -269,6 +269,9 @@ export declare const PersistedSavedEnvironmentRecordSchema: Schema.Struct<{
         readonly username: Schema.NullOr<Schema.String>;
         readonly port: Schema.NullOr<Schema.Number>;
     }>>;
+    readonly relayManaged: Schema.optionalKey<Schema.Struct<{
+        readonly relayUrl: Schema.String;
+    }>>;
 }>;
 export type PersistedSavedEnvironmentRecord = typeof PersistedSavedEnvironmentRecordSchema.Type;
 export type DesktopServerExposureMode = "local-only" | "network-accessible";
@@ -293,6 +296,21 @@ export interface PickFolderOptions {
 export declare const PickFolderOptionsSchema: Schema.Struct<{
     readonly initialPath: Schema.optionalKey<Schema.NullOr<Schema.String>>;
 }>;
+export declare const DesktopCloudAuthFetchInputSchema: Schema.Struct<{
+    readonly url: Schema.String;
+    readonly method: Schema.optionalKey<Schema.String>;
+    readonly headers: Schema.$Record<Schema.String, Schema.String>;
+    readonly body: Schema.optionalKey<Schema.String>;
+}>;
+export type DesktopCloudAuthFetchInput = typeof DesktopCloudAuthFetchInputSchema.Type;
+export declare const DesktopCloudAuthFetchResultSchema: Schema.Struct<{
+    readonly ok: Schema.Boolean;
+    readonly status: Schema.Number;
+    readonly statusText: Schema.String;
+    readonly headers: Schema.$Record<Schema.String, Schema.String>;
+    readonly body: Schema.String;
+}>;
+export type DesktopCloudAuthFetchResult = typeof DesktopCloudAuthFetchResultSchema.Type;
 export interface DesktopBridge {
     getAppBranding: () => DesktopAppBranding | null;
     getLocalEnvironmentBootstrap: () => DesktopEnvironmentBootstrap | null;
@@ -329,6 +347,12 @@ export interface DesktopBridge {
         y: number;
     }) => Promise<T | null>;
     openExternal: (url: string) => Promise<boolean>;
+    createCloudAuthRequest: () => Promise<string>;
+    getCloudAuthToken: () => Promise<string | null>;
+    setCloudAuthToken: (token: string) => Promise<boolean>;
+    clearCloudAuthToken: () => Promise<void>;
+    fetchCloudAuth: (input: DesktopCloudAuthFetchInput) => Promise<DesktopCloudAuthFetchResult>;
+    onCloudAuthCallback: (listener: (rawUrl: string) => void) => () => void;
     onMenuAction: (listener: (action: string) => void) => () => void;
     getUpdateState: () => Promise<DesktopUpdateState>;
     setUpdateChannel: (channel: DesktopUpdateChannel) => Promise<DesktopUpdateState>;

package/dist/upstream-t3code/packages/contracts/src/providerRuntime.d.ts

@@ -368,6 +368,13 @@ declare const FilesPersistedPayload: Schema.Struct<{
     }>>>;
 }>;
 export type FilesPersistedPayload = typeof FilesPersistedPayload.Type;
+declare const ToolDeniedPayload: Schema.Struct<{
+    readonly toolName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+    readonly toolUseId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    readonly reason: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    readonly agentId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+}>;
+export type ToolDeniedPayload = typeof ToolDeniedPayload.Type;
 declare const RuntimeWarningPayload: Schema.Struct<{
     readonly message: Schema.decodeTo<Schema.String, Schema.String, never, never>;
     readonly detail: Schema.optional<Schema.Unknown>;
@@ -1650,6 +1657,35 @@ declare const ProviderRuntimeFilesPersistedEvent: Schema.Struct<{
     }>>;
 }>;
 export type ProviderRuntimeFilesPersistedEvent = typeof ProviderRuntimeFilesPersistedEvent.Type;
+declare const ProviderRuntimeToolDeniedEvent: Schema.Struct<{
+    readonly type: Schema.Literal<"tool.denied">;
+    readonly payload: Schema.Struct<{
+        readonly toolName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly toolUseId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly reason: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly agentId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>;
+    readonly eventId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EventId">;
+    readonly provider: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderDriverKind">;
+    readonly providerInstanceId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderInstanceId">>;
+    readonly threadId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ThreadId">;
+    readonly createdAt: Schema.String;
+    readonly turnId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "TurnId">>;
+    readonly itemId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "RuntimeItemId">>;
+    readonly requestId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "RuntimeRequestId">>;
+    readonly providerRefs: Schema.optional<Schema.Struct<{
+        readonly providerTurnId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly providerItemId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderItemId">>;
+        readonly providerRequestId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>>;
+    readonly raw: Schema.optional<Schema.Struct<{
+        readonly source: Schema.Union<readonly [Schema.Literal<"codex.app-server.notification">, Schema.Literal<"codex.app-server.request">, Schema.Literal<"codex.eventmsg">, Schema.Literal<"claude.sdk.message">, Schema.Literal<"claude.sdk.permission">, Schema.Literal<"codex.sdk.thread-event">, Schema.Literal<"opencode.sdk.event">, Schema.Literal<"acp.jsonrpc">, Schema.TemplateLiteral<readonly ["acp.", Schema.String, ".extension"]>]>;
+        readonly method: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly messageType: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly payload: Schema.Unknown;
+    }>>;
+}>;
+export type ProviderRuntimeToolDeniedEvent = typeof ProviderRuntimeToolDeniedEvent.Type;
 declare const ProviderRuntimeWarningEvent: Schema.Struct<{
     readonly type: Schema.Literal<"runtime.warning">;
     readonly payload: Schema.Struct<{
@@ -2886,6 +2922,33 @@ export declare const ProviderRuntimeEventV2: Schema.Union<readonly [Schema.Struc
         readonly messageType: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
         readonly payload: Schema.Unknown;
     }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"tool.denied">;
+    readonly payload: Schema.Struct<{
+        readonly toolName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly toolUseId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly reason: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly agentId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>;
+    readonly eventId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EventId">;
+    readonly provider: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderDriverKind">;
+    readonly providerInstanceId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderInstanceId">>;
+    readonly threadId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ThreadId">;
+    readonly createdAt: Schema.String;
+    readonly turnId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "TurnId">>;
+    readonly itemId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "RuntimeItemId">>;
+    readonly requestId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "RuntimeRequestId">>;
+    readonly providerRefs: Schema.optional<Schema.Struct<{
+        readonly providerTurnId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly providerItemId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderItemId">>;
+        readonly providerRequestId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>>;
+    readonly raw: Schema.optional<Schema.Struct<{
+        readonly source: Schema.Union<readonly [Schema.Literal<"codex.app-server.notification">, Schema.Literal<"codex.app-server.request">, Schema.Literal<"codex.eventmsg">, Schema.Literal<"claude.sdk.message">, Schema.Literal<"claude.sdk.permission">, Schema.Literal<"codex.sdk.thread-event">, Schema.Literal<"opencode.sdk.event">, Schema.Literal<"acp.jsonrpc">, Schema.TemplateLiteral<readonly ["acp.", Schema.String, ".extension"]>]>;
+        readonly method: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly messageType: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly payload: Schema.Unknown;
+    }>>;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"runtime.warning">;
     readonly payload: Schema.Struct<{
@@ -4120,6 +4183,33 @@ export declare const ProviderRuntimeEvent: Schema.Union<readonly [Schema.Struct<
         readonly messageType: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
         readonly payload: Schema.Unknown;
     }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"tool.denied">;
+    readonly payload: Schema.Struct<{
+        readonly toolName: Schema.decodeTo<Schema.String, Schema.String, never, never>;
+        readonly toolUseId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly reason: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly agentId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>;
+    readonly eventId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EventId">;
+    readonly provider: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderDriverKind">;
+    readonly providerInstanceId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderInstanceId">>;
+    readonly threadId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ThreadId">;
+    readonly createdAt: Schema.String;
+    readonly turnId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "TurnId">>;
+    readonly itemId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "RuntimeItemId">>;
+    readonly requestId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "RuntimeRequestId">>;
+    readonly providerRefs: Schema.optional<Schema.Struct<{
+        readonly providerTurnId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly providerItemId: Schema.optional<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "ProviderItemId">>;
+        readonly providerRequestId: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+    }>>;
+    readonly raw: Schema.optional<Schema.Struct<{
+        readonly source: Schema.Union<readonly [Schema.Literal<"codex.app-server.notification">, Schema.Literal<"codex.app-server.request">, Schema.Literal<"codex.eventmsg">, Schema.Literal<"claude.sdk.message">, Schema.Literal<"claude.sdk.permission">, Schema.Literal<"codex.sdk.thread-event">, Schema.Literal<"opencode.sdk.event">, Schema.Literal<"acp.jsonrpc">, Schema.TemplateLiteral<readonly ["acp.", Schema.String, ".extension"]>]>;
+        readonly method: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly messageType: Schema.optional<Schema.decodeTo<Schema.String, Schema.String, never, never>>;
+        readonly payload: Schema.Unknown;
+    }>>;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"runtime.warning">;
     readonly payload: Schema.Struct<{