@alicloud/agentcore20260804 2.4.0 → 2.6.0

package/dist/client.d.ts

@@ -9,10 +9,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, endpoint: string): string;
     /**
-     * Writes messages or text to a memory store. By default, sync is set to true, which synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId that can be queried by using GetMemoryTask.
+     * Writes messages or text to a memory store. By default, sync is set to true, which means the operation synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId, which you can query by calling GetMemoryTask.
      *
      * @remarks
-     * Writes messages or text to a memory store. By default, sync is set to true, which synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId that can be queried by using GetMemoryTask.
+     * Writes messages or text to a memory store. By default, sync is set to true, which means the operation synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId, which you can query by calling GetMemoryTask.
      *
      * @param tmpReq - AddMemoriesRequest
      * @param headers - map
@@ -23,10 +23,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.AddMemoriesResponse>;
     /**
-     * Writes messages or text to a memory store. By default, sync is set to true, which synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId that can be queried by using GetMemoryTask.
+     * Writes messages or text to a memory store. By default, sync is set to true, which means the operation synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId, which you can query by calling GetMemoryTask.
      *
      * @remarks
-     * Writes messages or text to a memory store. By default, sync is set to true, which synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId that can be queried by using GetMemoryTask.
+     * Writes messages or text to a memory store. By default, sync is set to true, which means the operation synchronously waits for extraction and returns only memories (an empty array is allowed). If sync is set to false, the operation returns only a taskId, which you can query by calling GetMemoryTask.
      *
      * @param request - AddMemoriesRequest
      * @returns AddMemoriesResponse
@@ -201,13 +201,15 @@ export default class Client extends OpenApi {
      */
     createCredential(workspaceId: string, request: $_model.CreateCredentialRequest): Promise<$_model.CreateCredentialResponse>;
     /**
-     * Creates a custom agent in a specified workspace and submits a container image deployment configuration. The creation is an asynchronous process. You can call GetCustomAgent to query the deployment result.
+     * Creates a custom agent in a specified workspace. Container image and code package deployments are supported. The creation process is asynchronous. You can call GetCustomAgent to query the deployment result.
      *
      * @remarks
-     * Before you call this operation, prepare a writable workspace, a RAM role ARN, an ACR container image, and a runtime configuration. You must specify name, artifact, roleArn, and runtime. The runtime parameter must include both compute and sessionPolicy.
-     * Currently, only ACR container image deployment is supported. Use artifact.container and specify the service listening port in artifact.port. Omit artifact.code. The image must have the required access permissions and be accessible over the network allowed by the workspace.
-     * The creation is an asynchronous process. A successful response indicates that the request is accepted. Use the returned agentId to call GetCustomAgent and check latestVersionStatus, latestExecutionError, and status for the corresponding latestSpecVersion to confirm the deployment result. After the deployment is ready, you can call CreateServiceEndpoint to configure the access endpoint.
-     * The clientToken parameter does not currently provide idempotency guarantees. Do not rely on this parameter to prevent duplicate requests. The healthyThreshold parameter for health checks does not take effect. Omit this parameter.
+     * Before you call this operation, prepare a writable workspace, a RAM role ARN, a container image or code package, and runtime configurations. You must specify name, artifact, roleArn, and runtime. The runtime parameter must include both compute and sessionPolicy.
+     * In container mode, use artifact.container and specify artifact.port. The image must have the required access permissions and be accessible over the network allowed by the workspace.
+     * In code package pattern, specify artifact.port, and the sourceUri, languageRuntime, and entrypoint of artifact.code. Do not specify container at the same time. Dependencies must be packaged by the user. ZIP and TAR.GZ formats are supported. The compressed package size cannot exceed 500,000,000 bytes. You can call ListAgentCodeRuntimes to query the runtime environment identity. The sourceUri parameter supports oss:// addresses or HTTPS object addresses of standard OSS public domain names, including signed URLs. For local files, call GetAgentCodePackageUploadUrl to obtain an upload URL, upload the file directly, and then commit the returned sourceUri.
+     * When you submit a new code package source, the backend rechecks the read permissions, object, and size. The configuration is saved only after the transfer succeeds. If the transfer fails, the configuration is not saved. Saved fixed packages can be reused. Set the client timeout to 210 seconds for code package requests. Archive integrity and secure decompression are checked at startup. A successful acceptance does not mean that the agent is ready to run.
+     * The creation process is asynchronous. A successful response indicates that the request is accepted. You can use the returned agentId to call GetCustomAgent and check the latestVersionStatus, latestExecutionError, and status corresponding to latestSpecVersion to confirm the deployment result. After the deployment is ready, you can call CreateServiceEndpoint to configure the access endpoint.
+     * The clientToken parameter does not provide idempotency guarantees. Do not rely on this parameter to prevent duplicate requests. The healthyThreshold parameter for health checks does not take effect. Omit this parameter.
      *
      * @param tmpReq - CreateCustomAgentRequest
      * @param headers - map
@@ -218,13 +220,15 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.CreateCustomAgentResponse>;
     /**
-     * Creates a custom agent in a specified workspace and submits a container image deployment configuration. The creation is an asynchronous process. You can call GetCustomAgent to query the deployment result.
+     * Creates a custom agent in a specified workspace. Container image and code package deployments are supported. The creation process is asynchronous. You can call GetCustomAgent to query the deployment result.
      *
      * @remarks
-     * Before you call this operation, prepare a writable workspace, a RAM role ARN, an ACR container image, and a runtime configuration. You must specify name, artifact, roleArn, and runtime. The runtime parameter must include both compute and sessionPolicy.
-     * Currently, only ACR container image deployment is supported. Use artifact.container and specify the service listening port in artifact.port. Omit artifact.code. The image must have the required access permissions and be accessible over the network allowed by the workspace.
-     * The creation is an asynchronous process. A successful response indicates that the request is accepted. Use the returned agentId to call GetCustomAgent and check latestVersionStatus, latestExecutionError, and status for the corresponding latestSpecVersion to confirm the deployment result. After the deployment is ready, you can call CreateServiceEndpoint to configure the access endpoint.
-     * The clientToken parameter does not currently provide idempotency guarantees. Do not rely on this parameter to prevent duplicate requests. The healthyThreshold parameter for health checks does not take effect. Omit this parameter.
+     * Before you call this operation, prepare a writable workspace, a RAM role ARN, a container image or code package, and runtime configurations. You must specify name, artifact, roleArn, and runtime. The runtime parameter must include both compute and sessionPolicy.
+     * In container mode, use artifact.container and specify artifact.port. The image must have the required access permissions and be accessible over the network allowed by the workspace.
+     * In code package pattern, specify artifact.port, and the sourceUri, languageRuntime, and entrypoint of artifact.code. Do not specify container at the same time. Dependencies must be packaged by the user. ZIP and TAR.GZ formats are supported. The compressed package size cannot exceed 500,000,000 bytes. You can call ListAgentCodeRuntimes to query the runtime environment identity. The sourceUri parameter supports oss:// addresses or HTTPS object addresses of standard OSS public domain names, including signed URLs. For local files, call GetAgentCodePackageUploadUrl to obtain an upload URL, upload the file directly, and then commit the returned sourceUri.
+     * When you submit a new code package source, the backend rechecks the read permissions, object, and size. The configuration is saved only after the transfer succeeds. If the transfer fails, the configuration is not saved. Saved fixed packages can be reused. Set the client timeout to 210 seconds for code package requests. Archive integrity and secure decompression are checked at startup. A successful acceptance does not mean that the agent is ready to run.
+     * The creation process is asynchronous. A successful response indicates that the request is accepted. You can use the returned agentId to call GetCustomAgent and check the latestVersionStatus, latestExecutionError, and status corresponding to latestSpecVersion to confirm the deployment result. After the deployment is ready, you can call CreateServiceEndpoint to configure the access endpoint.
+     * The clientToken parameter does not provide idempotency guarantees. Do not rely on this parameter to prevent duplicate requests. The healthyThreshold parameter for health checks does not take effect. Omit this parameter.
      *
      * @param request - CreateCustomAgentRequest
      * @returns CreateCustomAgentResponse
@@ -279,7 +283,34 @@ export default class Client extends OpenApi {
      */
     createExternalAgentBootstrapToken(workspaceId: string, agentId: string, request: $_model.CreateExternalAgentBootstrapTokenRequest): Promise<$_model.CreateExternalAgentBootstrapTokenResponse>;
     /**
-     * Binds an external identity provider to a specified workspace to enable single sign-on and organization member synchronization for workspace users. Each workspace can be bound to a maximum of one external identity provider. This is an asynchronous operation. After the API call returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Binds an external identity provider to a specified workspace for single sign-on and organization member synchronization of workspace users. You can bind up to one external identity provider to each workspace. The binding is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * A workspace can be bound to only one external identity provider. The identityProviderType parameter supports DingTalk, Feishu, and CustomSSO. CustomSSO only initializes the shared user pool. Do not pass non-empty metadata, and do not pass true for loginEnabled or syncEnabled. By default, both switches are turned off. Protocols and SAML configurations are saved by calling UpdateIdentityProvider. SCIM is configured through a separate API. You do not need to save SAML first. After the request is accepted and CONFIGURED is returned, call GetIdentityProvider and wait for the user pool initialization to complete. READY only indicates that the resource is ready, not that SAML is configured. If the same CustomSSO binding is in the CONFIGURED or READY state, the existing binding can be returned. You cannot treat all states as repeatable creations.
+     * For DingTalk, the metadata parameter requires appKey, appSecret, and corpId. For Feishu, appId and appSecret are required. The vendor logon switch is enabled by default, and the synchronization switch is disabled by default. When synchronization is enabled, encryptKey and verificationToken are also required. The vendor syncOnBind and syncScope parameters retain the existing department-based synchronization definitions. Do not use these vendor pull parameters to replace SCIM configurations during CustomSSO initialization.
+     * ## Requests and examples
+     * POST /workspaces/{workspaceId}/identity-providers
+     * Call conventions: Call the API based on the region of the target workspace. Use an AccessKey pair or STS token that has permissions on the identity provider resources of the corresponding workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * POST /workspaces/ws-example/identity-providers
+     * {"identityProviderType": "CustomSSO"}
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "loginEnabled": false,
+     *     "syncEnabled": false,
+     *     "status": "CONFIGURED"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream service may return 503 IdentityProviderProvisioningUnavailable if it fails. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 409 IdentityProviderAlreadyBound: An external binding already exists. Query and reuse the correct binding first. Do not automatically unbind the entire binding. Asynchronous initialization failure does not equal HTTP request failure. You must continue to query the status.
      *
      * @param tmpReq - CreateIdentityProviderRequest
      * @param headers - map
@@ -290,12 +321,123 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.CreateIdentityProviderResponse>;
     /**
-     * Binds an external identity provider to a specified workspace to enable single sign-on and organization member synchronization for workspace users. Each workspace can be bound to a maximum of one external identity provider. This is an asynchronous operation. After the API call returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Binds an external identity provider to a specified workspace for single sign-on and organization member synchronization of workspace users. You can bind up to one external identity provider to each workspace. The binding is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * A workspace can be bound to only one external identity provider. The identityProviderType parameter supports DingTalk, Feishu, and CustomSSO. CustomSSO only initializes the shared user pool. Do not pass non-empty metadata, and do not pass true for loginEnabled or syncEnabled. By default, both switches are turned off. Protocols and SAML configurations are saved by calling UpdateIdentityProvider. SCIM is configured through a separate API. You do not need to save SAML first. After the request is accepted and CONFIGURED is returned, call GetIdentityProvider and wait for the user pool initialization to complete. READY only indicates that the resource is ready, not that SAML is configured. If the same CustomSSO binding is in the CONFIGURED or READY state, the existing binding can be returned. You cannot treat all states as repeatable creations.
+     * For DingTalk, the metadata parameter requires appKey, appSecret, and corpId. For Feishu, appId and appSecret are required. The vendor logon switch is enabled by default, and the synchronization switch is disabled by default. When synchronization is enabled, encryptKey and verificationToken are also required. The vendor syncOnBind and syncScope parameters retain the existing department-based synchronization definitions. Do not use these vendor pull parameters to replace SCIM configurations during CustomSSO initialization.
+     * ## Requests and examples
+     * POST /workspaces/{workspaceId}/identity-providers
+     * Call conventions: Call the API based on the region of the target workspace. Use an AccessKey pair or STS token that has permissions on the identity provider resources of the corresponding workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * POST /workspaces/ws-example/identity-providers
+     * {"identityProviderType": "CustomSSO"}
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "loginEnabled": false,
+     *     "syncEnabled": false,
+     *     "status": "CONFIGURED"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream service may return 503 IdentityProviderProvisioningUnavailable if it fails. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 409 IdentityProviderAlreadyBound: An external binding already exists. Query and reuse the correct binding first. Do not automatically unbind the entire binding. Asynchronous initialization failure does not equal HTTP request failure. You must continue to query the status.
      *
      * @param request - CreateIdentityProviderRequest
      * @returns CreateIdentityProviderResponse
      */
     createIdentityProvider(workspaceId: string, request: $_model.CreateIdentityProviderRequest): Promise<$_model.CreateIdentityProviderResponse>;
+    /**
+     * Initiates a manual synchronization of an identity provider.
+     *
+     * @remarks
+     * Initiates a one-time user synchronization based on the saved scope without saving the configuration or requiring syncEnabled=true. Prerequisites: the identity provider is in the READY or SYNC_FAILED state, a user pool exists, and no other pending identity provider operations are in progress. The returned taskId only indicates that the request is accepted. Call GetIdentityProviderSyncJob to poll the status until it reaches SUCCESS, FAILED, or CANCELED. If the task fails, check the failureReason. The workspace user quota still applies, and previously synchronized users are not automatically deleted if the scope is reduced.
+     * Authorization information: RAM action agentcore:CreateIdentityProviderSyncJob, access level Write, resource ARN: acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is required for authorization.
+     * Idempotency and retry: This operation does not provide a ClientToken parameter for conditional idempotency. Repeated submissions do not guarantee the same task is returned. If an operation is already in progress, an operation conflict is returned. Submitting again after the task ends creates a new synchronization task. If a submission times out, query the identity provider status first to avoid blindly resubmitting the request.
+     * Calling this API is free of charge, and operation records support ActionTrail auditing.
+     * Initial selective synchronization process: CreateIdentityProvider (syncOnBind=false, it is recommended to keep syncEnabled=false initially) → GetIdentityProvider and wait for READY → ListIdentityProviderDepartments to select departments → UpdateIdentityProvider to save syncScope and wait for READY → CreateIdentityProviderSyncJob → GetIdentityProviderSyncJob to query the terminal state. If incremental synchronization is required, configure callbacks and event subscriptions, and then update syncEnabled=true.
+     * Response example:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "data": {
+     *     "taskId": "12345678-1234-4234-8234-123456789abc",
+     *     "status": "PENDING"
+     *   }
+     * }
+     * ```
+     *
+     * @param request - CreateIdentityProviderSyncJobRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns CreateIdentityProviderSyncJobResponse
+     */
+    createIdentityProviderSyncJobWithOptions(workspaceId: string, identityProviderType: string, request: $_model.CreateIdentityProviderSyncJobRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.CreateIdentityProviderSyncJobResponse>;
+    /**
+     * Initiates a manual synchronization of an identity provider.
+     *
+     * @remarks
+     * Initiates a one-time user synchronization based on the saved scope without saving the configuration or requiring syncEnabled=true. Prerequisites: the identity provider is in the READY or SYNC_FAILED state, a user pool exists, and no other pending identity provider operations are in progress. The returned taskId only indicates that the request is accepted. Call GetIdentityProviderSyncJob to poll the status until it reaches SUCCESS, FAILED, or CANCELED. If the task fails, check the failureReason. The workspace user quota still applies, and previously synchronized users are not automatically deleted if the scope is reduced.
+     * Authorization information: RAM action agentcore:CreateIdentityProviderSyncJob, access level Write, resource ARN: acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is required for authorization.
+     * Idempotency and retry: This operation does not provide a ClientToken parameter for conditional idempotency. Repeated submissions do not guarantee the same task is returned. If an operation is already in progress, an operation conflict is returned. Submitting again after the task ends creates a new synchronization task. If a submission times out, query the identity provider status first to avoid blindly resubmitting the request.
+     * Calling this API is free of charge, and operation records support ActionTrail auditing.
+     * Initial selective synchronization process: CreateIdentityProvider (syncOnBind=false, it is recommended to keep syncEnabled=false initially) → GetIdentityProvider and wait for READY → ListIdentityProviderDepartments to select departments → UpdateIdentityProvider to save syncScope and wait for READY → CreateIdentityProviderSyncJob → GetIdentityProviderSyncJob to query the terminal state. If incremental synchronization is required, configure callbacks and event subscriptions, and then update syncEnabled=true.
+     * Response example:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "data": {
+     *     "taskId": "12345678-1234-4234-8234-123456789abc",
+     *     "status": "PENDING"
+     *   }
+     * }
+     * ```
+     *
+     * @param request - CreateIdentityProviderSyncJobRequest
+     * @returns CreateIdentityProviderSyncJobResponse
+     */
+    createIdentityProviderSyncJob(workspaceId: string, identityProviderType: string, request: $_model.CreateIdentityProviderSyncJobRequest): Promise<$_model.CreateIdentityProviderSyncJobResponse>;
+    /**
+     * Creates an image cache.
+     *
+     * @remarks
+     * Creates or reuses an image cache in the current workspace based on the image source and tag. Both public and private images uniformly reuse the workspace\\"s source image pull authorization and resource roles. The resource manager parses the tag during the transfer node and performs image replication based on the parsed summary. The digest is empty before parsing is complete. For regular tags, the saved summary is reused after parsing. For the latest tag, it is parsed again when registered after reaching the desired state, and duplicate registrations in progress reuse the node. The logical imageId remains stable. accessInternet and accessVpc only determine the source reading and transfer for the current request and do not modify the agent network. An HTTP 200 response returns an acceptance snapshot of PENDING, READY, or FAILED, which does not indicate that the creation is complete. ClientToken does not guarantee to deduplicate requests or recover the original result. If the result is unconfirmed, query the query cache status first before deciding whether to recommit.
+     *
+     * @param tmpReq - CreateImageCacheRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns CreateImageCacheResponse
+     */
+    createImageCacheWithOptions(tmpReq: $_model.CreateImageCacheRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.CreateImageCacheResponse>;
+    /**
+     * Creates an image cache.
+     *
+     * @remarks
+     * Creates or reuses an image cache in the current workspace based on the image source and tag. Both public and private images uniformly reuse the workspace\\"s source image pull authorization and resource roles. The resource manager parses the tag during the transfer node and performs image replication based on the parsed summary. The digest is empty before parsing is complete. For regular tags, the saved summary is reused after parsing. For the latest tag, it is parsed again when registered after reaching the desired state, and duplicate registrations in progress reuse the node. The logical imageId remains stable. accessInternet and accessVpc only determine the source reading and transfer for the current request and do not modify the agent network. An HTTP 200 response returns an acceptance snapshot of PENDING, READY, or FAILED, which does not indicate that the creation is complete. ClientToken does not guarantee to deduplicate requests or recover the original result. If the result is unconfirmed, query the query cache status first before deciding whether to recommit.
+     *
+     * @param request - CreateImageCacheRequest
+     * @returns CreateImageCacheResponse
+     */
+    createImageCache(request: $_model.CreateImageCacheRequest): Promise<$_model.CreateImageCacheResponse>;
     /**
      * Creates a managed agent in a specified workspace.
      *
@@ -657,7 +799,31 @@ export default class Client extends OpenApi {
      */
     deleteExternalAgent(workspaceId: string, agentId: string, request: $_model.DeleteExternalAgentRequest): Promise<$_model.DeleteExternalAgentResponse>;
     /**
-     * Unbinds the external identity provider from a specified workspace and cleans up users synchronized by that identity provider. The unbinding is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Disconnects the external identity provider from a specified workspace and cleans up the users synchronized by the identity provider. The disconnection is an asynchronous operation. After the API returns a response, you can call GetIdentityProvider to query the status and track the progress.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * This is a complete disconnection, not just disabling logon. Disconnecting CustomSSO cleans up the AC users imported from this identity source, remote shared user pools and related resources, logon publishing configurations, and bindings. Therefore, both SAML and SCIM are affected. It does not delete the enterprise applications created by users on external platforms such as Azure. The system first checks the references between users and Teams. If references exist, the disconnection is rejected.
+     * After the request is accepted, the system returns DISCONNECTING. You can call GetIdentityProvider to query the status. The cleanup is complete only when the binding does not exist (IdentityProviderNotFound). The binding should also no longer appear in the list. DISCONNECT_FAILED indicates that a partial cleanup may have occurred and the state cannot be restored to a brand new unconfigured state. You can retry based on the returned status. If the binding does not exist in the first place, the API returns a placeholder result indicating no binding without creating new resources. An ongoing disconnection task may return the current binding. Do not use this API as a substitute for setting loginEnabled=false, syncEnabled=false, or deleting a single token.
+     * ## Requests and examples
+     * DELETE /workspaces/{workspaceId}/identity-providers/{identityProviderType}
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS credential that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameter content of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * DELETE /workspaces/ws-example/identity-providers/CustomSSO
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "status": "DISCONNECTING"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to the upstream may return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 409 IdentityProvider.Disconnect.Conflict: Users of this identity source still belong to a Team. Remove the references first. 409 IdentityProviderOperationConflict: The current status does not allow disconnection. 404 IdentityProviderNotFound: An external binding exists but the type does not match. An asynchronous failure may result in a partial cleanup. You cannot claim completion based solely on the first response.
      *
      * @param request - DeleteIdentityProviderRequest
      * @param headers - map
@@ -668,12 +834,60 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.DeleteIdentityProviderResponse>;
     /**
-     * Unbinds the external identity provider from a specified workspace and cleans up users synchronized by that identity provider. The unbinding is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Disconnects the external identity provider from a specified workspace and cleans up the users synchronized by the identity provider. The disconnection is an asynchronous operation. After the API returns a response, you can call GetIdentityProvider to query the status and track the progress.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * This is a complete disconnection, not just disabling logon. Disconnecting CustomSSO cleans up the AC users imported from this identity source, remote shared user pools and related resources, logon publishing configurations, and bindings. Therefore, both SAML and SCIM are affected. It does not delete the enterprise applications created by users on external platforms such as Azure. The system first checks the references between users and Teams. If references exist, the disconnection is rejected.
+     * After the request is accepted, the system returns DISCONNECTING. You can call GetIdentityProvider to query the status. The cleanup is complete only when the binding does not exist (IdentityProviderNotFound). The binding should also no longer appear in the list. DISCONNECT_FAILED indicates that a partial cleanup may have occurred and the state cannot be restored to a brand new unconfigured state. You can retry based on the returned status. If the binding does not exist in the first place, the API returns a placeholder result indicating no binding without creating new resources. An ongoing disconnection task may return the current binding. Do not use this API as a substitute for setting loginEnabled=false, syncEnabled=false, or deleting a single token.
+     * ## Requests and examples
+     * DELETE /workspaces/{workspaceId}/identity-providers/{identityProviderType}
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS credential that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameter content of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * DELETE /workspaces/ws-example/identity-providers/CustomSSO
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "status": "DISCONNECTING"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to the upstream may return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 409 IdentityProvider.Disconnect.Conflict: Users of this identity source still belong to a Team. Remove the references first. 409 IdentityProviderOperationConflict: The current status does not allow disconnection. 404 IdentityProviderNotFound: An external binding exists but the type does not match. An asynchronous failure may result in a partial cleanup. You cannot claim completion based solely on the first response.
      *
      * @param request - DeleteIdentityProviderRequest
      * @returns DeleteIdentityProviderResponse
      */
     deleteIdentityProvider(workspaceId: string, identityProviderType: string, request: $_model.DeleteIdentityProviderRequest): Promise<$_model.DeleteIdentityProviderResponse>;
+    /**
+     * Deletes an image cache.
+     *
+     * @remarks
+     * Deletes the logical image cache of the current workspace. The deletion requires that no enabled agent configurations reference the cache and no active instances are using it. Concurrency is rechecked upon submission. Caches in the PENDING or FAILED state can still be deleted, and the backend handles the cleanup. An HTTP 200 response returns an imageId that matches the request. If deletionPending is true, the current workspace is still undergoing deletion, and a Get request returns DELETING until ImageCacheNotFound is explicitly returned. If false, the deletion is complete or the current workspace no longer exists. Usage by other workspaces does not block the deletion for the current workspace. The physical content is reclaimed only after all workspaces in the same region have removed their associations and no active instances are using it.
+     *
+     * @param request - DeleteImageCacheRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns DeleteImageCacheResponse
+     */
+    deleteImageCacheWithOptions(imageId: string, request: $_model.DeleteImageCacheRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.DeleteImageCacheResponse>;
+    /**
+     * Deletes an image cache.
+     *
+     * @remarks
+     * Deletes the logical image cache of the current workspace. The deletion requires that no enabled agent configurations reference the cache and no active instances are using it. Concurrency is rechecked upon submission. Caches in the PENDING or FAILED state can still be deleted, and the backend handles the cleanup. An HTTP 200 response returns an imageId that matches the request. If deletionPending is true, the current workspace is still undergoing deletion, and a Get request returns DELETING until ImageCacheNotFound is explicitly returned. If false, the deletion is complete or the current workspace no longer exists. Usage by other workspaces does not block the deletion for the current workspace. The physical content is reclaimed only after all workspaces in the same region have removed their associations and no active instances are using it.
+     *
+     * @param request - DeleteImageCacheRequest
+     * @returns DeleteImageCacheResponse
+     */
+    deleteImageCache(imageId: string, request: $_model.DeleteImageCacheRequest): Promise<$_model.DeleteImageCacheResponse>;
     /**
      * Deletes a specified managed agent.
      *
@@ -743,10 +957,10 @@ export default class Client extends OpenApi {
      */
     deleteMemory(workspaceId: string, memoryStoreName: string, memoryId: string, request: $_model.DeleteMemoryRequest): Promise<$_model.DeleteMemoryResponse>;
     /**
-     * Asynchronously deletes a MemoryStore and all its long-term memory.
+     * Asynchronously deletes a MemoryStore and all long-term memory within it.
      *
      * @remarks
-     * Asynchronously deletes a MemoryStore and all its long-term memory.
+     * Asynchronously deletes a MemoryStore and all long-term memory within it.
      *
      * @param request - DeleteMemoryStoreRequest
      * @param headers - map
@@ -757,10 +971,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.DeleteMemoryStoreResponse>;
     /**
-     * Asynchronously deletes a MemoryStore and all its long-term memory.
+     * Asynchronously deletes a MemoryStore and all long-term memory within it.
      *
      * @remarks
-     * Asynchronously deletes a MemoryStore and all its long-term memory.
+     * Asynchronously deletes a MemoryStore and all long-term memory within it.
      *
      * @param request - DeleteMemoryStoreRequest
      * @returns DeleteMemoryStoreResponse
@@ -1040,6 +1254,82 @@ export default class Client extends OpenApi {
      * @returns ForcePublishSkillVersionResponse
      */
     forcePublishSkillVersion(workspaceId: string, skillName: string, skillVersion: string, request: $_model.ForcePublishSkillVersionRequest): Promise<$_model.ForcePublishSkillVersionResponse>;
+    /**
+     * Retrieves the download URL for the saved code package of an agent.
+     *
+     * @remarks
+     * Generates a time-limited, read-only download URL for the code package referenced by the currently saved agent configuration. This applies to code packages uploaded locally or imported from Object Storage Service (OSS). The operation uses workspaceId and agentId for locating and does not accept arbitrary bucket, object key, or historical version parameters. The current configuration must reference an available, fixed code package, and does not require waiting for a running instance to be ready. An error is returned if the code package does not exist, has changed, or is unreadable. The link is valid for up to 10 minutes and does not exceed the underlying credential expiration time. Call the operation again after it expires. The resourceVersionId indicates the saved configuration version corresponding to this download. The sample download link is redacted. Use the downloadUrl in the response.
+     *
+     * @param request - GetAgentCodePackageDownloadUrlRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetAgentCodePackageDownloadUrlResponse
+     */
+    getAgentCodePackageDownloadUrlWithOptions(workspaceId: string, agentId: string, request: $_model.GetAgentCodePackageDownloadUrlRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetAgentCodePackageDownloadUrlResponse>;
+    /**
+     * Retrieves the download URL for the saved code package of an agent.
+     *
+     * @remarks
+     * Generates a time-limited, read-only download URL for the code package referenced by the currently saved agent configuration. This applies to code packages uploaded locally or imported from Object Storage Service (OSS). The operation uses workspaceId and agentId for locating and does not accept arbitrary bucket, object key, or historical version parameters. The current configuration must reference an available, fixed code package, and does not require waiting for a running instance to be ready. An error is returned if the code package does not exist, has changed, or is unreadable. The link is valid for up to 10 minutes and does not exceed the underlying credential expiration time. Call the operation again after it expires. The resourceVersionId indicates the saved configuration version corresponding to this download. The sample download link is redacted. Use the downloadUrl in the response.
+     *
+     * @param request - GetAgentCodePackageDownloadUrlRequest
+     * @returns GetAgentCodePackageDownloadUrlResponse
+     */
+    getAgentCodePackageDownloadUrl(workspaceId: string, agentId: string, request: $_model.GetAgentCodePackageDownloadUrlRequest): Promise<$_model.GetAgentCodePackageDownloadUrlResponse>;
+    /**
+     * Retrieves the OSS RAM authorization URL for the agent code package.
+     *
+     * @remarks
+     * Generates a RAM authorization URL for the resource role of the current workspace for a specified source bucket. The client cannot specify or override the role. After you open the authorizeUrl and confirm the authorization, call VerifyAgentCodePackageOssRamAuthorization to check the policy binding, and call ValidateAgentCodePackageFromOss to check specific objects.
+     * This authorization reuses the OSSObjectRestoreCustom template, which includes permissions to read, write, and delete objects, and is not a read-only authorization. Retrieving the URL itself does not complete the authorization, transfer the code package, or modify the default OSS binding of the workspace. Existing authorizations for the same role and bucket can be reused. The example URL is provided to demonstrate the format. Use the actual authorization URL returned by the API operation.
+     *
+     * @param request - GetAgentCodePackageOssRamAuthorizeUrlRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetAgentCodePackageOssRamAuthorizeUrlResponse
+     */
+    getAgentCodePackageOssRamAuthorizeUrlWithOptions(workspaceId: string, request: $_model.GetAgentCodePackageOssRamAuthorizeUrlRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetAgentCodePackageOssRamAuthorizeUrlResponse>;
+    /**
+     * Retrieves the OSS RAM authorization URL for the agent code package.
+     *
+     * @remarks
+     * Generates a RAM authorization URL for the resource role of the current workspace for a specified source bucket. The client cannot specify or override the role. After you open the authorizeUrl and confirm the authorization, call VerifyAgentCodePackageOssRamAuthorization to check the policy binding, and call ValidateAgentCodePackageFromOss to check specific objects.
+     * This authorization reuses the OSSObjectRestoreCustom template, which includes permissions to read, write, and delete objects, and is not a read-only authorization. Retrieving the URL itself does not complete the authorization, transfer the code package, or modify the default OSS binding of the workspace. Existing authorizations for the same role and bucket can be reused. The example URL is provided to demonstrate the format. Use the actual authorization URL returned by the API operation.
+     *
+     * @param request - GetAgentCodePackageOssRamAuthorizeUrlRequest
+     * @returns GetAgentCodePackageOssRamAuthorizeUrlResponse
+     */
+    getAgentCodePackageOssRamAuthorizeUrl(workspaceId: string, request: $_model.GetAgentCodePackageOssRamAuthorizeUrlRequest): Promise<$_model.GetAgentCodePackageOssRamAuthorizeUrlResponse>;
+    /**
+     * Retrieves the upload URL for an agent code package.
+     *
+     * @remarks
+     * Retrieves a time-limited upload URL for a code package without uploading the file content. The fileName must be a ZIP or TAR.GZ filename without directories. The format must match the file extension. The fileSize is in bytes, with valid values ranging from 1 to 500,000,000.
+     * Use the uploadMethod, uploadUrl, and headers from the response to upload the file directly. After the upload is complete, pass the sourceUri to the artifact.code.sourceUri parameter of CreateCustomAgent or UpdateCustomAgent. The actual object and size are verified and a fixed copy is saved during creation or update. The upload URL is valid for up to 10 minutes and does not exceed the expiration time of the underlying temporary credentials. Retrieve a new URL after it expires. The example URL is desensitized and cannot be used for actual uploads. Use the original URL and request headers from this response.
+     *
+     * @param tmpReq - GetAgentCodePackageUploadUrlRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetAgentCodePackageUploadUrlResponse
+     */
+    getAgentCodePackageUploadUrlWithOptions(workspaceId: string, tmpReq: $_model.GetAgentCodePackageUploadUrlRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetAgentCodePackageUploadUrlResponse>;
+    /**
+     * Retrieves the upload URL for an agent code package.
+     *
+     * @remarks
+     * Retrieves a time-limited upload URL for a code package without uploading the file content. The fileName must be a ZIP or TAR.GZ filename without directories. The format must match the file extension. The fileSize is in bytes, with valid values ranging from 1 to 500,000,000.
+     * Use the uploadMethod, uploadUrl, and headers from the response to upload the file directly. After the upload is complete, pass the sourceUri to the artifact.code.sourceUri parameter of CreateCustomAgent or UpdateCustomAgent. The actual object and size are verified and a fixed copy is saved during creation or update. The upload URL is valid for up to 10 minutes and does not exceed the expiration time of the underlying temporary credentials. Retrieve a new URL after it expires. The example URL is desensitized and cannot be used for actual uploads. Use the original URL and request headers from this response.
+     *
+     * @param request - GetAgentCodePackageUploadUrlRequest
+     * @returns GetAgentCodePackageUploadUrlResponse
+     */
+    getAgentCodePackageUploadUrl(workspaceId: string, request: $_model.GetAgentCodePackageUploadUrlRequest): Promise<$_model.GetAgentCodePackageUploadUrlResponse>;
     /**
      * Queries the details of a specified agent IM channel.
      *
@@ -1193,12 +1483,12 @@ export default class Client extends OpenApi {
      */
     getCredential(workspaceId: string, credentialId: string, request: $_model.GetCredentialRequest): Promise<$_model.GetCredentialResponse>;
     /**
-     * Queries the details of a custom agent in a specified workspace, including the deployment configuration, the execute status of the latest configuration version, and the running instance status statistics.
+     * Queries the details of a custom agent in a specified workspace, including deployment configurations, the execute status of the latest configuration version, and the running instance status statistics.
      *
      * @remarks
      * After creating or updating a custom agent, you can poll this operation to query the execution result of the latest configuration version. latestVersionStatus corresponds to latestSpecVersion. latestExecutionError indicates the cause of the pending or failed status for this version. If retryable is true, you can query again later.
-     * The returned configuration is the latest submitted configuration and may not have taken effect. Check latestVersionStatus, the overall agent status, and the running instance statistics in sandboxPhaseCounts to confirm the deployment and running status.
-     * If you query a custom agent that does not exist, has been deleted, or does not belong to the specified workspace, a resource not found error is returned.
+     * The returned configuration is the latest submitted configuration and may not have taken effect. Verify the deployment and running status by checking latestVersionStatus, the overall agent status, and the running instance statistics sandboxPhaseCounts.
+     * If the queried custom agent does not exist, has been deleted, or does not belong to the specified workspace, a resource not found error is returned.
      *
      * @param request - GetCustomAgentRequest
      * @param headers - map
@@ -1209,12 +1499,12 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.GetCustomAgentResponse>;
     /**
-     * Queries the details of a custom agent in a specified workspace, including the deployment configuration, the execute status of the latest configuration version, and the running instance status statistics.
+     * Queries the details of a custom agent in a specified workspace, including deployment configurations, the execute status of the latest configuration version, and the running instance status statistics.
      *
      * @remarks
      * After creating or updating a custom agent, you can poll this operation to query the execution result of the latest configuration version. latestVersionStatus corresponds to latestSpecVersion. latestExecutionError indicates the cause of the pending or failed status for this version. If retryable is true, you can query again later.
-     * The returned configuration is the latest submitted configuration and may not have taken effect. Check latestVersionStatus, the overall agent status, and the running instance statistics in sandboxPhaseCounts to confirm the deployment and running status.
-     * If you query a custom agent that does not exist, has been deleted, or does not belong to the specified workspace, a resource not found error is returned.
+     * The returned configuration is the latest submitted configuration and may not have taken effect. Verify the deployment and running status by checking latestVersionStatus, the overall agent status, and the running instance statistics sandboxPhaseCounts.
+     * If the queried custom agent does not exist, has been deleted, or does not belong to the specified workspace, a resource not found error is returned.
      *
      * @param request - GetCustomAgentRequest
      * @returns GetCustomAgentResponse
@@ -1269,7 +1559,33 @@ export default class Client extends OpenApi {
      */
     getExternalAgentBootstrapOptions(workspaceId: string, agentId: string, request: $_model.GetExternalAgentBootstrapOptionsRequest): Promise<$_model.GetExternalAgentBootstrapOptionsResponse>;
     /**
-     * Queries the binding details of the external identity provider for a specified workspace, including the binding status, application configurations, and callback URLs to be configured on the identity provider side. Application secret configurations are not returned.
+     * Queries the binding details of an external identity provider for a specified workspace, including the binding status, application configurations, and the callback URL to be configured on the identity provider side. Application secret configurations are not returned.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * Reads existing bindings by type. For CustomSSO, the API returns the saved protocol, standardized SAML, expected loginEnabled, syncEnabled, and shared binding status. If SAML is not configured, the saml and configuration fields may not be returned. If SAML is configured, the API additionally queries AgentIdentity, and the configuration field represents the actual SSO/JIT configuration. The saml field serves as the data source for the edit form. The status switches in the configuration field are Enabled and Disabled. If the upstream query fails, an error is returned. This failure must not be treated as an unconfigured state.
+     * Only this API reads back the actual SAML configuration. The list and write APIs do not guarantee that the configuration field is returned. A READY user pool does not indicate that SAML is configured. The UPDATING and UPDATE_FAILED statuses describe logon configuration tasks, not SCIM tasks. The vendor callback URL for CustomSSO is empty. Use GetIdentityProviderSCIM.operationStatus to query SCIM operation results.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/identity-providers/{identityProviderType}
+     * Calling convention: Call this API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, rather than the extra body wrapper of the backend direct-connection API. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not imply that the HTTP request uses a persistent connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/identity-providers/CustomSSO
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "status": "READY",
+     *     "loginEnabled": false,
+     *     "syncEnabled": false
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: A 400 InvalidParameter error indicates that the parameters or current configuration prerequisites are not met. A 404 IdentityProviderNotFound error indicates that no binding of the specified type exists. Synchronous calls to the upstream service may return a 503 IdentityProviderProvisioningUnavailable error if they fail. Retain the request ID for troubleshooting and do not interpret read failures as an unconfigured state. Authentication errors and workspace-not-found errors follow common error handling procedures.
+     * 404 IdentityProviderNotFound: No binding exists, or the specified type is inconsistent with the current binding. If SAML is already configured, an upstream read failure does not degrade to a successful empty configuration.
      *
      * @param request - GetIdentityProviderRequest
      * @param headers - map
@@ -1280,12 +1596,212 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.GetIdentityProviderResponse>;
     /**
-     * Queries the binding details of the external identity provider for a specified workspace, including the binding status, application configurations, and callback URLs to be configured on the identity provider side. Application secret configurations are not returned.
+     * Queries the binding details of an external identity provider for a specified workspace, including the binding status, application configurations, and the callback URL to be configured on the identity provider side. Application secret configurations are not returned.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * Reads existing bindings by type. For CustomSSO, the API returns the saved protocol, standardized SAML, expected loginEnabled, syncEnabled, and shared binding status. If SAML is not configured, the saml and configuration fields may not be returned. If SAML is configured, the API additionally queries AgentIdentity, and the configuration field represents the actual SSO/JIT configuration. The saml field serves as the data source for the edit form. The status switches in the configuration field are Enabled and Disabled. If the upstream query fails, an error is returned. This failure must not be treated as an unconfigured state.
+     * Only this API reads back the actual SAML configuration. The list and write APIs do not guarantee that the configuration field is returned. A READY user pool does not indicate that SAML is configured. The UPDATING and UPDATE_FAILED statuses describe logon configuration tasks, not SCIM tasks. The vendor callback URL for CustomSSO is empty. Use GetIdentityProviderSCIM.operationStatus to query SCIM operation results.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/identity-providers/{identityProviderType}
+     * Calling convention: Call this API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, rather than the extra body wrapper of the backend direct-connection API. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not imply that the HTTP request uses a persistent connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/identity-providers/CustomSSO
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "status": "READY",
+     *     "loginEnabled": false,
+     *     "syncEnabled": false
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: A 400 InvalidParameter error indicates that the parameters or current configuration prerequisites are not met. A 404 IdentityProviderNotFound error indicates that no binding of the specified type exists. Synchronous calls to the upstream service may return a 503 IdentityProviderProvisioningUnavailable error if they fail. Retain the request ID for troubleshooting and do not interpret read failures as an unconfigured state. Authentication errors and workspace-not-found errors follow common error handling procedures.
+     * 404 IdentityProviderNotFound: No binding exists, or the specified type is inconsistent with the current binding. If SAML is already configured, an upstream read failure does not degrade to a successful empty configuration.
      *
      * @param request - GetIdentityProviderRequest
      * @returns GetIdentityProviderResponse
      */
     getIdentityProvider(workspaceId: string, identityProviderType: string, request: $_model.GetIdentityProviderRequest): Promise<$_model.GetIdentityProviderResponse>;
+    /**
+     * Queries an identity provider synchronization task.
+     *
+     * @remarks
+     * Queries the status, current step, number of processed users, and failure cause of a manual synchronization task by using the local taskId of AgentCore. The taskId must be obtained from CreateIdentityProviderSyncJob in the same workspace and identity provider. It is not the synchronizationJobId of AgentIdentity. Poll the task until the status is SUCCESS, FAILED, or CANCELED. The PENDING, RUNNING, and PAUSED statuses do not indicate completion. The syncedUserCount includes updated existing users and does not equal the number of newly added users or the progress percentage.
+     * Authorization information: The RAM operation is agentcore:GetIdentityProviderSyncJob, the access level is Read, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is a required authorization resource.
+     * Idempotence and retry: This operation is read-only and can be repeatedly queried.
+     * Calling this API operation is free of charge, and operation records support ActionTrail auditing.
+     * Response example:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "data": {
+     *     "taskId": "12345678-1234-4234-8234-123456789abc",
+     *     "status": "SUCCESS",
+     *     "currentStep": "SYNC",
+     *     "synchronizationJobId": "syncjob_0123456789abcdef0123456789abcdef",
+     *     "syncedUserCount": 12
+     *   }
+     * }
+     * ```
+     *
+     * @param request - GetIdentityProviderSyncJobRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetIdentityProviderSyncJobResponse
+     */
+    getIdentityProviderSyncJobWithOptions(workspaceId: string, identityProviderType: string, taskId: string, request: $_model.GetIdentityProviderSyncJobRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetIdentityProviderSyncJobResponse>;
+    /**
+     * Queries an identity provider synchronization task.
+     *
+     * @remarks
+     * Queries the status, current step, number of processed users, and failure cause of a manual synchronization task by using the local taskId of AgentCore. The taskId must be obtained from CreateIdentityProviderSyncJob in the same workspace and identity provider. It is not the synchronizationJobId of AgentIdentity. Poll the task until the status is SUCCESS, FAILED, or CANCELED. The PENDING, RUNNING, and PAUSED statuses do not indicate completion. The syncedUserCount includes updated existing users and does not equal the number of newly added users or the progress percentage.
+     * Authorization information: The RAM operation is agentcore:GetIdentityProviderSyncJob, the access level is Read, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is a required authorization resource.
+     * Idempotence and retry: This operation is read-only and can be repeatedly queried.
+     * Calling this API operation is free of charge, and operation records support ActionTrail auditing.
+     * Response example:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "data": {
+     *     "taskId": "12345678-1234-4234-8234-123456789abc",
+     *     "status": "SUCCESS",
+     *     "currentStep": "SYNC",
+     *     "synchronizationJobId": "syncjob_0123456789abcdef0123456789abcdef",
+     *     "syncedUserCount": 12
+     *   }
+     * }
+     * ```
+     *
+     * @param request - GetIdentityProviderSyncJobRequest
+     * @returns GetIdentityProviderSyncJobResponse
+     */
+    getIdentityProviderSyncJob(workspaceId: string, identityProviderType: string, taskId: string, request: $_model.GetIdentityProviderSyncJobRequest): Promise<$_model.GetIdentityProviderSyncJobResponse>;
+    /**
+     * Queries the synchronization scope of an identity provider.
+     *
+     * @remarks
+     * Queries the saved synchronization scope, the validity of selected departments, and the estimated user count downstream of the identity provider. This operation is not used for real-time estimation of unsaved selections. AllAuthorized indicates the address book scope authorized for the application, which is not equivalent to the entire enterprise organization. An empty selectedDepartments array does not prove that the organization has no sub-departments. The estimation can be used only when estimateStatus is Ready and a count is returned. A missing count does not indicate 0.
+     * Authorization information: RAM operation agentcore:GetIdentityProviderSyncScope, access level Read, resource ARN: acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is a required authorization resource.
+     * Idempotence and retry: This operation is read-only and can be queried repeatedly.
+     * Calling this API operation is free of charge. Operation records support ActionTrail auditing.
+     * Sample response:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "data": {
+     *     "syncScope": {
+     *       "mode": "SelectedDepartments",
+     *       "departmentIds": [
+     *         "10001"
+     *       ]
+     *     },
+     *     "selectedDepartments": [
+     *       {
+     *         "id": "10001",
+     *         "name": "R&D Department",
+     *         "exists": true
+     *       }
+     *     ],
+     *     "estimateStatus": "Ready",
+     *     "expandedDepartmentCount": 2,
+     *     "estimatedUserCount": 12
+     *   }
+     * }
+     * ```
+     *
+     * @param request - GetIdentityProviderSyncScopeRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetIdentityProviderSyncScopeResponse
+     */
+    getIdentityProviderSyncScopeWithOptions(workspaceId: string, identityProviderType: string, request: $_model.GetIdentityProviderSyncScopeRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetIdentityProviderSyncScopeResponse>;
+    /**
+     * Queries the synchronization scope of an identity provider.
+     *
+     * @remarks
+     * Queries the saved synchronization scope, the validity of selected departments, and the estimated user count downstream of the identity provider. This operation is not used for real-time estimation of unsaved selections. AllAuthorized indicates the address book scope authorized for the application, which is not equivalent to the entire enterprise organization. An empty selectedDepartments array does not prove that the organization has no sub-departments. The estimation can be used only when estimateStatus is Ready and a count is returned. A missing count does not indicate 0.
+     * Authorization information: RAM operation agentcore:GetIdentityProviderSyncScope, access level Read, resource ARN: acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is a required authorization resource.
+     * Idempotence and retry: This operation is read-only and can be queried repeatedly.
+     * Calling this API operation is free of charge. Operation records support ActionTrail auditing.
+     * Sample response:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "data": {
+     *     "syncScope": {
+     *       "mode": "SelectedDepartments",
+     *       "departmentIds": [
+     *         "10001"
+     *       ]
+     *     },
+     *     "selectedDepartments": [
+     *       {
+     *         "id": "10001",
+     *         "name": "R&D Department",
+     *         "exists": true
+     *       }
+     *     ],
+     *     "estimateStatus": "Ready",
+     *     "expandedDepartmentCount": 2,
+     *     "estimatedUserCount": 12
+     *   }
+     * }
+     * ```
+     *
+     * @param request - GetIdentityProviderSyncScopeRequest
+     * @returns GetIdentityProviderSyncScopeResponse
+     */
+    getIdentityProviderSyncScope(workspaceId: string, identityProviderType: string, request: $_model.GetIdentityProviderSyncScopeRequest): Promise<$_model.GetIdentityProviderSyncScopeResponse>;
+    /**
+     * Queries the details of an image cache.
+     *
+     * @remarks
+     * Queries the details of the logical image cache in the current workspace. Returns the complete source, current digest, actual size, creation time, status, and secure error messages. AgentCount counts configuration references with the switch enabled. CanDelete verifies both configuration references and instance usage. If the switch is disabled, the count is 0, but deletion is still prohibited if old instances are not released. If the resource does not belong to the current workspace, resources with the same content from other workspaces are not returned.
+     *
+     * @param request - GetImageCacheRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetImageCacheResponse
+     */
+    getImageCacheWithOptions(imageId: string, request: $_model.GetImageCacheRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetImageCacheResponse>;
+    /**
+     * Queries the details of an image cache.
+     *
+     * @remarks
+     * Queries the details of the logical image cache in the current workspace. Returns the complete source, current digest, actual size, creation time, status, and secure error messages. AgentCount counts configuration references with the switch enabled. CanDelete verifies both configuration references and instance usage. If the switch is disabled, the count is 0, but deletion is still prohibited if old instances are not released. If the resource does not belong to the current workspace, resources with the same content from other workspaces are not returned.
+     *
+     * @param request - GetImageCacheRequest
+     * @returns GetImageCacheResponse
+     */
+    getImageCache(imageId: string, request: $_model.GetImageCacheRequest): Promise<$_model.GetImageCacheResponse>;
     /**
      * Queries the details of a specified managed agent.
      *
@@ -1649,10 +2165,10 @@ export default class Client extends OpenApi {
      */
     getWorkspace(workspaceId: string, request: $_model.GetWorkspaceRequest): Promise<$_model.GetWorkspaceResponse>;
     /**
-     * Queries the RAM authorization URL for ACR in a workspace.
+     * Queries the ACR RAM authorization URL of a workspace.
      *
      * @remarks
-     * ACR and user OSS mounts share the workspace role. If no existing role is found, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is retained and only new permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. The acrInstanceId, namespace, and repository parameters are required. The region and account are derived from the workspace context. Returns the role resolved by the backend and the authorization URL for the target repository. This operation does not create ACR or agent execution versions, nor does it deliver runtime configurations. After authorization is complete, you can verify it and then create or update the agent without calling a separate Ensure operation.
+     * ACR and user OSS mounts share the workspace role. If no existing role is found, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is reused and permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. The acrInstanceId, namespace, and repository parameters are required. The region and account are derived from the workspace context. Returns the role resolved by the backend and the authorization URL for the target repository. This operation does not create ACR or agent execution versions, nor does it deliver runtime configurations. After authorization is complete, you can call Verify before creating or updating an agent, without the need to call an independent Ensure operation.
      *
      * @param request - GetWorkspaceAcrRamAuthorizeUrlRequest
      * @param headers - map
@@ -1663,10 +2179,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.GetWorkspaceAcrRamAuthorizeUrlResponse>;
     /**
-     * Queries the RAM authorization URL for ACR in a workspace.
+     * Queries the ACR RAM authorization URL of a workspace.
      *
      * @remarks
-     * ACR and user OSS mounts share the workspace role. If no existing role is found, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is retained and only new permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. The acrInstanceId, namespace, and repository parameters are required. The region and account are derived from the workspace context. Returns the role resolved by the backend and the authorization URL for the target repository. This operation does not create ACR or agent execution versions, nor does it deliver runtime configurations. After authorization is complete, you can verify it and then create or update the agent without calling a separate Ensure operation.
+     * ACR and user OSS mounts share the workspace role. If no existing role is found, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is reused and permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. The acrInstanceId, namespace, and repository parameters are required. The region and account are derived from the workspace context. Returns the role resolved by the backend and the authorization URL for the target repository. This operation does not create ACR or agent execution versions, nor does it deliver runtime configurations. After authorization is complete, you can call Verify before creating or updating an agent, without the need to call an independent Ensure operation.
      *
      * @param request - GetWorkspaceAcrRamAuthorizeUrlRequest
      * @returns GetWorkspaceAcrRamAuthorizeUrlResponse
@@ -1768,6 +2284,32 @@ export default class Client extends OpenApi {
      * @returns InstallWorkspacePluginResponse
      */
     installWorkspacePlugin(workspaceId: string, pluginName: string, request: $_model.InstallWorkspacePluginRequest): Promise<$_model.InstallWorkspacePluginResponse>;
+    /**
+     * Queries the runtime environments supported for code deployment.
+     *
+     * @remarks
+     * Queries the directories in the current workspace that can be used to create code package agents or switch runtime environments. Runtime environments are dynamically provided based on the current version configuration, and internal image addresses are not returned.
+     * If maxResults is omitted or set to 0, the default value is 10. If the value is greater than 100, it is processed as 100. Omit nextToken in the first request. For subsequent requests, use the token returned in the previous response as is, and keep the workspace unchanged. If a directory change invalidates the token, query from the first page again. An empty nextToken indicates that there are no more pages. Existing agents continue to use the saved images for restarts, scaling, and regular updates.
+     *
+     * @param request - ListAgentCodeRuntimesRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns ListAgentCodeRuntimesResponse
+     */
+    listAgentCodeRuntimesWithOptions(workspaceId: string, request: $_model.ListAgentCodeRuntimesRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.ListAgentCodeRuntimesResponse>;
+    /**
+     * Queries the runtime environments supported for code deployment.
+     *
+     * @remarks
+     * Queries the directories in the current workspace that can be used to create code package agents or switch runtime environments. Runtime environments are dynamically provided based on the current version configuration, and internal image addresses are not returned.
+     * If maxResults is omitted or set to 0, the default value is 10. If the value is greater than 100, it is processed as 100. Omit nextToken in the first request. For subsequent requests, use the token returned in the previous response as is, and keep the workspace unchanged. If a directory change invalidates the token, query from the first page again. An empty nextToken indicates that there are no more pages. Existing agents continue to use the saved images for restarts, scaling, and regular updates.
+     *
+     * @param request - ListAgentCodeRuntimesRequest
+     * @returns ListAgentCodeRuntimesResponse
+     */
+    listAgentCodeRuntimes(workspaceId: string, request: $_model.ListAgentCodeRuntimesRequest): Promise<$_model.ListAgentCodeRuntimesResponse>;
     /**
      * Queries the list of IM channels for a specified agent.
      *
@@ -1909,12 +2451,12 @@ export default class Client extends OpenApi {
      */
     listCredentials(workspaceId: string, request: $_model.ListCredentialsRequest): Promise<$_model.ListCredentialsResponse>;
     /**
-     * Queries the summaries of custom agents in a specified workspace by using paging. For the complete configuration and the execution results of the latest version, call GetCustomAgent.
+     * Performs a paged query for paging through the custom agent summary in a specified workspace. For the complete configuration and the latest execute results, call GetCustomAgent.
      *
      * @remarks
-     * The default value of maxResults is 20, and the maximum value is 100. If this parameter is omitted or set to 0, the default value is used.
-     * Omit nextToken in the first request. In subsequent requests, pass the nextToken value returned in the previous response as is, and keep the same workspace. The nextToken is an opaque token. Do not parse or construct it. If the token in the response is empty, it indicates that no more pages are available.
-     * This operation returns the summaries of the current page and does not return the complete deployment configuration or the execution errors of the latest version. To obtain this information, call GetCustomAgent by using the agentId in items.
+     * The default value of maxResults is 20 and the maximum value is 100. If this parameter is omitted or set to 0, the default value is used.
+     * Omit nextToken in the first request. For subsequent requests, pass the nextToken returned in the previous response as is and keep the same workspace. The nextToken is an opaque token. Do not parse or construct it. An empty token in the response indicates that there are no more pages.
+     * This operation returns the summaries of the current page and does not return the complete deployment configurations or the execution errors of the latest version. To obtain this information, call GetCustomAgent by using the agentId in items.
      *
      * @param request - ListCustomAgentsRequest
      * @param headers - map
@@ -1925,12 +2467,12 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.ListCustomAgentsResponse>;
     /**
-     * Queries the summaries of custom agents in a specified workspace by using paging. For the complete configuration and the execution results of the latest version, call GetCustomAgent.
+     * Performs a paged query for paging through the custom agent summary in a specified workspace. For the complete configuration and the latest execute results, call GetCustomAgent.
      *
      * @remarks
-     * The default value of maxResults is 20, and the maximum value is 100. If this parameter is omitted or set to 0, the default value is used.
-     * Omit nextToken in the first request. In subsequent requests, pass the nextToken value returned in the previous response as is, and keep the same workspace. The nextToken is an opaque token. Do not parse or construct it. If the token in the response is empty, it indicates that no more pages are available.
-     * This operation returns the summaries of the current page and does not return the complete deployment configuration or the execution errors of the latest version. To obtain this information, call GetCustomAgent by using the agentId in items.
+     * The default value of maxResults is 20 and the maximum value is 100. If this parameter is omitted or set to 0, the default value is used.
+     * Omit nextToken in the first request. For subsequent requests, pass the nextToken returned in the previous response as is and keep the same workspace. The nextToken is an opaque token. Do not parse or construct it. An empty token in the response indicates that there are no more pages.
+     * This operation returns the summaries of the current page and does not return the complete deployment configurations or the execution errors of the latest version. To obtain this information, call GetCustomAgent by using the agentId in items.
      *
      * @param request - ListCustomAgentsRequest
      * @returns ListCustomAgentsResponse
@@ -1960,9 +2502,63 @@ export default class Client extends OpenApi {
      * @returns ListExternalAgentsResponse
      */
     listExternalAgents(workspaceId: string, request: $_model.ListExternalAgentsRequest): Promise<$_model.ListExternalAgentsResponse>;
+    /**
+     * Queries the departments of an identity provider by page.
+     *
+     * @remarks
+     * Queries DingTalk or Feishu departments by hierarchy and page. Prerequisites include a bound identity provider, a user pool, valid application credentials, and address book read authorization. If you do not specify parentDepartmentId, the root hierarchy is queried. When expanding a node, specify the ID of the node to query its direct child departments. The hasChildren field indicates whether the node can be expanded and does not mean that child nodes are returned. The nextToken field is used only to query the next page of child departments under the current parent department. This query only reads the directory. It does not save the synchronization scope or import users. If a new department is added to a DingTalk or Feishu organization, re-query the corresponding parent department because the previous list does not reflect the latest directory.\\n\\nAuthorization information: The RAM action is agentcore:ListIdentityProviderDepartments, the access level is List, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is required for authorization.\\n\\nIdempotency and retry: This operation is read-only and can be called repeatedly.\\n\\nCalling this API is free of charge. Operation records support ActionTrail auditing.\\n\\nResponse example:\\n```json\\n{\\n  "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",\\n  "message": "success",\\n  "httpStatusCode": 200,\\n  "code": "SUCCESS",\\n  "success": true,\\n  "maxResults": 50,\\n  "nextToken": "",\\n  "items": [\\n    {\\n      "id": "10001",\\n      "name": "R&D Department",\\n      "parentId": "1",\\n      "memberCount": 12,\\n      "hasChildren": true\\n    }\\n  ]\\n}\\n```
+     *
+     * @param request - ListIdentityProviderDepartmentsRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns ListIdentityProviderDepartmentsResponse
+     */
+    listIdentityProviderDepartmentsWithOptions(workspaceId: string, identityProviderType: string, request: $_model.ListIdentityProviderDepartmentsRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.ListIdentityProviderDepartmentsResponse>;
+    /**
+     * Queries the departments of an identity provider by page.
+     *
+     * @remarks
+     * Queries DingTalk or Feishu departments by hierarchy and page. Prerequisites include a bound identity provider, a user pool, valid application credentials, and address book read authorization. If you do not specify parentDepartmentId, the root hierarchy is queried. When expanding a node, specify the ID of the node to query its direct child departments. The hasChildren field indicates whether the node can be expanded and does not mean that child nodes are returned. The nextToken field is used only to query the next page of child departments under the current parent department. This query only reads the directory. It does not save the synchronization scope or import users. If a new department is added to a DingTalk or Feishu organization, re-query the corresponding parent department because the previous list does not reflect the latest directory.\\n\\nAuthorization information: The RAM action is agentcore:ListIdentityProviderDepartments, the access level is List, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is required for authorization.\\n\\nIdempotency and retry: This operation is read-only and can be called repeatedly.\\n\\nCalling this API is free of charge. Operation records support ActionTrail auditing.\\n\\nResponse example:\\n```json\\n{\\n  "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",\\n  "message": "success",\\n  "httpStatusCode": 200,\\n  "code": "SUCCESS",\\n  "success": true,\\n  "maxResults": 50,\\n  "nextToken": "",\\n  "items": [\\n    {\\n      "id": "10001",\\n      "name": "R&D Department",\\n      "parentId": "1",\\n      "memberCount": 12,\\n      "hasChildren": true\\n    }\\n  ]\\n}\\n```
+     *
+     * @param request - ListIdentityProviderDepartmentsRequest
+     * @returns ListIdentityProviderDepartmentsResponse
+     */
+    listIdentityProviderDepartments(workspaceId: string, identityProviderType: string, request: $_model.ListIdentityProviderDepartmentsRequest): Promise<$_model.ListIdentityProviderDepartmentsResponse>;
     /**
      * Queries the external identity providers bound to a specified workspace. Each workspace can be bound to at most one external identity provider, so the response returns at most one record. Application secret configurations are not returned.
      *
+     * @remarks
+     * ## Features and prerequisites
+     * Returns the local binding summary without querying the actual SAML or SCIM configurations of AgentIdentity. If no binding exists, items is an empty array. A workspace currently supports only one external binding. The default value of maxResults is 10, and the valid range is 1 to 100. Currently, nextToken must be omitted or left empty. A non-empty value returns InvalidParameter, and fictitious multi-page results are not supported.
+     * The status of CustomSSO indicates the task status of shared resources and logon configurations. You must check protocol and saml to determine whether SAML is configured. To query SCIM configurations, independently call GetIdentityProviderSCIM. The list operation does not issue tokens and does not return the vendor appSecret, encryptKey, or verificationToken.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/identity-providers
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or Security Token Service (STS) token that has the required permissions on the identity source resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/identity-providers?maxResults=10
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "items": [
+     *     {
+     *       "workspaceId": "ws-example",
+     *       "identityProviderType": "CustomSSO",
+     *       "status": "READY",
+     *       "loginEnabled": false,
+     *       "syncEnabled": false
+     *     }
+     *   ],
+     *   "maxResults": 10,
+     *   "totalCount": 1
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
+     * 400 InvalidParameter: maxResults is out of bounds, or nextToken is not empty, which is currently not supported. If a query fails, an error is displayed instead of resetting the status to unconfigured.
+     *
      * @param request - ListIdentityProvidersRequest
      * @param headers - map
      * @param runtime - runtime options for this request RuntimeOptions
@@ -1974,10 +2570,64 @@ export default class Client extends OpenApi {
     /**
      * Queries the external identity providers bound to a specified workspace. Each workspace can be bound to at most one external identity provider, so the response returns at most one record. Application secret configurations are not returned.
      *
+     * @remarks
+     * ## Features and prerequisites
+     * Returns the local binding summary without querying the actual SAML or SCIM configurations of AgentIdentity. If no binding exists, items is an empty array. A workspace currently supports only one external binding. The default value of maxResults is 10, and the valid range is 1 to 100. Currently, nextToken must be omitted or left empty. A non-empty value returns InvalidParameter, and fictitious multi-page results are not supported.
+     * The status of CustomSSO indicates the task status of shared resources and logon configurations. You must check protocol and saml to determine whether SAML is configured. To query SCIM configurations, independently call GetIdentityProviderSCIM. The list operation does not issue tokens and does not return the vendor appSecret, encryptKey, or verificationToken.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/identity-providers
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or Security Token Service (STS) token that has the required permissions on the identity source resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/identity-providers?maxResults=10
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "items": [
+     *     {
+     *       "workspaceId": "ws-example",
+     *       "identityProviderType": "CustomSSO",
+     *       "status": "READY",
+     *       "loginEnabled": false,
+     *       "syncEnabled": false
+     *     }
+     *   ],
+     *   "maxResults": 10,
+     *   "totalCount": 1
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
+     * 400 InvalidParameter: maxResults is out of bounds, or nextToken is not empty, which is currently not supported. If a query fails, an error is displayed instead of resetting the status to unconfigured.
+     *
      * @param request - ListIdentityProvidersRequest
      * @returns ListIdentityProvidersResponse
      */
     listIdentityProviders(workspaceId: string, request: $_model.ListIdentityProvidersRequest): Promise<$_model.ListIdentityProvidersResponse>;
+    /**
+     * Queries image caches.
+     *
+     * @remarks
+     * Queries the logical image caches within the current account, region, and workspace. WorkspaceId is required, and caches are not visible across workspaces. All conditions filter the full set using the AND operator before pagination is calculated. Results are sorted in descending order of logical resource creation time and ascending order of ImageId. The cursor is bound to the account, region, workspace, all filters, and the sort order. Returns the complete cache objects, the AgentCount based on the configuration switch, and the actual deletion eligibility. Query failures do not return a disguised empty list, and the nextToken on the last page is an empty string.
+     *
+     * @param request - ListImageCachesRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns ListImageCachesResponse
+     */
+    listImageCachesWithOptions(request: $_model.ListImageCachesRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.ListImageCachesResponse>;
+    /**
+     * Queries image caches.
+     *
+     * @remarks
+     * Queries the logical image caches within the current account, region, and workspace. WorkspaceId is required, and caches are not visible across workspaces. All conditions filter the full set using the AND operator before pagination is calculated. Results are sorted in descending order of logical resource creation time and ascending order of ImageId. The cursor is bound to the account, region, workspace, all filters, and the sort order. Returns the complete cache objects, the AgentCount based on the configuration switch, and the actual deletion eligibility. Query failures do not return a disguised empty list, and the nextToken on the last page is an empty string.
+     *
+     * @param request - ListImageCachesRequest
+     * @returns ListImageCachesResponse
+     */
+    listImageCaches(request: $_model.ListImageCachesRequest): Promise<$_model.ListImageCachesResponse>;
     /**
      * Queries the list of managed agents in a specified workspace.
      *
@@ -2079,10 +2729,10 @@ export default class Client extends OpenApi {
      */
     listMcps(workspaceId: string, request: $_model.ListMcpsRequest): Promise<$_model.ListMcpsResponse>;
     /**
-     * Performs a paged query on long-term memory. Paging is supported, and you can filter the results independently by user ID, agent ID, and session ID.
+     * Performs a paged query on long-term memory records. The results can be filtered independently by user ID, agent ID, and session ID. Paging is supported.
      *
      * @remarks
-     * Performs a paged query on long-term memory. Paging is supported, and you can filter the results independently by user ID, agent ID, and session ID.
+     * Performs a paged query on long-term memory records. The results can be filtered independently by user ID, agent ID, and session ID. Paging is supported.
      *
      * @param request - ListMemoriesRequest
      * @param headers - map
@@ -2093,20 +2743,20 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.ListMemoriesResponse>;
     /**
-     * Performs a paged query on long-term memory. Paging is supported, and you can filter the results independently by user ID, agent ID, and session ID.
+     * Performs a paged query on long-term memory records. The results can be filtered independently by user ID, agent ID, and session ID. Paging is supported.
      *
      * @remarks
-     * Performs a paged query on long-term memory. Paging is supported, and you can filter the results independently by user ID, agent ID, and session ID.
+     * Performs a paged query on long-term memory records. The results can be filtered independently by user ID, agent ID, and session ID. Paging is supported.
      *
      * @param request - ListMemoriesRequest
      * @returns ListMemoriesResponse
      */
     listMemories(workspaceId: string, memoryStoreName: string, request: $_model.ListMemoriesRequest): Promise<$_model.ListMemoriesResponse>;
     /**
-     * Performs a paged query for raw messages by exact scope with paging. SessionId is required, and at least one of UserId and AgentId must be provided.
+     * Performs a paging query for raw messages by exact scope. SessionId is required, and at least one of UserId and AgentId must be provided.
      *
      * @remarks
-     * Performs a paged query for raw messages by exact scope with paging. SessionId is required, and at least one of UserId and AgentId must be provided.
+     * Performs a paging query for raw messages by exact scope. SessionId is required, and at least one of UserId and AgentId must be provided.
      *
      * @param request - ListMemorySessionMessagesRequest
      * @param headers - map
@@ -2117,20 +2767,20 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.ListMemorySessionMessagesResponse>;
     /**
-     * Performs a paged query for raw messages by exact scope with paging. SessionId is required, and at least one of UserId and AgentId must be provided.
+     * Performs a paging query for raw messages by exact scope. SessionId is required, and at least one of UserId and AgentId must be provided.
      *
      * @remarks
-     * Performs a paged query for raw messages by exact scope with paging. SessionId is required, and at least one of UserId and AgentId must be provided.
+     * Performs a paging query for raw messages by exact scope. SessionId is required, and at least one of UserId and AgentId must be provided.
      *
      * @param request - ListMemorySessionMessagesRequest
      * @returns ListMemorySessionMessagesResponse
      */
     listMemorySessionMessages(workspaceId: string, memoryStoreName: string, request: $_model.ListMemorySessionMessagesRequest): Promise<$_model.ListMemorySessionMessagesResponse>;
     /**
-     * Performs a paging query for sessions in a MemoryStore, and allows independent filtering by user ID and agent ID.
+     * Performs a paging query for sessions in a MemoryStore. You can filter the sessions independently by user ID and agent ID.
      *
      * @remarks
-     * Performs a paging query for sessions in a MemoryStore, and allows independent filtering by user ID and agent ID.
+     * Performs a paging query for sessions in a MemoryStore. You can filter the sessions independently by user ID and agent ID.
      *
      * @param request - ListMemorySessionsRequest
      * @param headers - map
@@ -2141,20 +2791,20 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.ListMemorySessionsResponse>;
     /**
-     * Performs a paging query for sessions in a MemoryStore, and allows independent filtering by user ID and agent ID.
+     * Performs a paging query for sessions in a MemoryStore. You can filter the sessions independently by user ID and agent ID.
      *
      * @remarks
-     * Performs a paging query for sessions in a MemoryStore, and allows independent filtering by user ID and agent ID.
+     * Performs a paging query for sessions in a MemoryStore. You can filter the sessions independently by user ID and agent ID.
      *
      * @param request - ListMemorySessionsRequest
      * @returns ListMemorySessionsResponse
      */
     listMemorySessions(workspaceId: string, memoryStoreName: string, request: $_model.ListMemorySessionsRequest): Promise<$_model.ListMemorySessionsResponse>;
     /**
-     * Queries MemoryStores in a specified workspace by using paging.
+     * Performs a paged query for MemoryStores in a specified workspace with paging.
      *
      * @remarks
-     * Queries MemoryStores in a specified workspace by using paging.
+     * Performs a paged query for MemoryStores in a specified workspace with paging.
      *
      * @param request - ListMemoryStoresRequest
      * @param headers - map
@@ -2165,10 +2815,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.ListMemoryStoresResponse>;
     /**
-     * Queries MemoryStores in a specified workspace by using paging.
+     * Performs a paged query for MemoryStores in a specified workspace with paging.
      *
      * @remarks
-     * Queries MemoryStores in a specified workspace by using paging.
+     * Performs a paged query for MemoryStores in a specified workspace with paging.
      *
      * @param request - ListMemoryStoresRequest
      * @returns ListMemoryStoresResponse
@@ -2577,10 +3227,34 @@ export default class Client extends OpenApi {
      */
     resetUserPassword(workspaceId: string, request: $_model.ResetUserPasswordRequest): Promise<$_model.ResetUserPasswordResponse>;
     /**
-     * Retrieves long-term memory from a MemoryStore based on semantics queries.
+     * Retries the image cache.
      *
      * @remarks
-     * Retrieves long-term memory from a MemoryStore based on semantics queries.
+     * Retries the image cache for the original ImageId in the current workspace. WorkspaceId is required. The business request body is not required and can be omitted or provided as an empty object. The source authorization and transfer network reuse the trusted context of the original registration. If a digest exists, the retry uses the original digest. If no digest exists, the original tag is resolved again. A new request for a FAILED status can start a new production round. PENDING and READY statuses are reused. DELETING status is rejected, and deleted resources are not recreated. PUBLIC and PRIVATE statuses reuse the pull authorization of the original workspace. Returns a complete acceptance snapshot and retains the original ImageId and CreatedAt. ClientToken does not guarantee request deduplication. If the result is not confirmed, query the real-time status first before deciding whether to resubmit.
+     *
+     * @param tmpReq - RetryImageCacheRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns RetryImageCacheResponse
+     */
+    retryImageCacheWithOptions(imageId: string, tmpReq: $_model.RetryImageCacheRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.RetryImageCacheResponse>;
+    /**
+     * Retries the image cache.
+     *
+     * @remarks
+     * Retries the image cache for the original ImageId in the current workspace. WorkspaceId is required. The business request body is not required and can be omitted or provided as an empty object. The source authorization and transfer network reuse the trusted context of the original registration. If a digest exists, the retry uses the original digest. If no digest exists, the original tag is resolved again. A new request for a FAILED status can start a new production round. PENDING and READY statuses are reused. DELETING status is rejected, and deleted resources are not recreated. PUBLIC and PRIVATE statuses reuse the pull authorization of the original workspace. Returns a complete acceptance snapshot and retains the original ImageId and CreatedAt. ClientToken does not guarantee request deduplication. If the result is not confirmed, query the real-time status first before deciding whether to resubmit.
+     *
+     * @param request - RetryImageCacheRequest
+     * @returns RetryImageCacheResponse
+     */
+    retryImageCache(imageId: string, request: $_model.RetryImageCacheRequest): Promise<$_model.RetryImageCacheResponse>;
+    /**
+     * Retrieves long-term memory from a MemoryStore based on semantics.
+     *
+     * @remarks
+     * Retrieves long-term memory from a MemoryStore based on semantics.
      *
      * @param tmpReq - SearchMemoriesRequest
      * @param headers - map
@@ -2591,10 +3265,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.SearchMemoriesResponse>;
     /**
-     * Retrieves long-term memory from a MemoryStore based on semantics queries.
+     * Retrieves long-term memory from a MemoryStore based on semantics.
      *
      * @remarks
-     * Retrieves long-term memory from a MemoryStore based on semantics queries.
+     * Retrieves long-term memory from a MemoryStore based on semantics.
      *
      * @param request - SearchMemoriesRequest
      * @returns SearchMemoriesResponse
@@ -2779,9 +3453,11 @@ export default class Client extends OpenApi {
      *
      * @remarks
      * Provide at least one top-level field to update. Omitted top-level fields retain their original configurations. When providing a configuration object, specify its required subfields and include any optional configurations that you want to retain. Arrays are replaced as a whole. Pass an empty array [] to clear a list. The agenticFsMounts field does not accept null. Pass null for the description field to clear the description, and pass null for the healthCheck field to remove the health check.
-     * When updating an image, you must specify artifact.port and the type, instanceId, namespace, repo, and tag fields of artifact.container. To retain a custom startup command, also provide the entrypoint field. Currently, only Alibaba Cloud Container Registry (ACR) container image deployment is supported. Omit the artifact.code field.
-     * When providing the runtime field, both compute and sessionPolicy must be present. If you omit hpa or some of its fields, unspecified elastic configurations use default values. To retain the original elastic configurations, you must provide them together. When providing the network field, omitted access items are treated as allowed, but actual access is still restricted by the workspace network configurations. To retain the original restrictions, provide both accessInternet and accessVpc. When providing healthCheck, you must specify the port field, and other unspecified items use default values. When providing logging.sls, you must specify both project and logstore.
-     * The update is an asynchronous process. A successful response indicates that the request is accepted. You can call the GetCustomAgent operation to query latestSpecVersion, latestVersionStatus, and latestExecutionError, and check the status field to confirm the update result.
+     * When updating an image, you must specify artifact.port and the type, instanceId, namespace, repo, and tag fields of artifact.container. To retain a custom startup command, also provide the entrypoint field.
+     * In code package pattern, specify artifact.port and the sourceUri, languageRuntime, and entrypoint fields of artifact.code. Do not specify the container field at the same time. Dependencies must be packaged by the user. ZIP and TAR.GZ formats are supported, and the compressed package size cannot exceed 500,000,000 bytes. Query the runtime environment identity by calling the ListAgentCodeRuntimes operation. The sourceUri field supports oss:// addresses or HTTPS object addresses of standard OSS public domain names, including signed URLs. For local files, first call the GetAgentCodePackageUploadUrl operation to obtain an upload URL, upload the file directly, and then commit the returned sourceUri.
+     * When submitting a new code package source, the backend rechecks read permissions, objects, and sizes. The configuration is saved only after the transfer succeeds. If the transfer fails, the current configuration is not saved. Saved fixed packages can be reused. Set the client timeout to 210 seconds for code package requests. Archive integrity and secure decompression are checked at startup. A successful acceptance does not indicate that the agent is ready to run.
+     * When providing the runtime field, the compute and sessionPolicy fields must be provided at the same time. If the hpa field or its subfields are omitted, unspecified elastic configurations use default values. To retain the original elastic configurations, provide them together. When providing the network field, omitted access items are treated as allowed, but actual access is still restricted by the workspace network configurations. To retain the original restrictions, provide both accessInternet and accessVpc. When providing the healthCheck field, the port field is required, and other unspecified items use default values. When providing the logging.sls field, both project and logstore must be specified.
+     * The update is an asynchronous process. A successful response indicates that the request is accepted. Call the GetCustomAgent operation to query latestSpecVersion, latestVersionStatus, and latestExecutionError, and check the status field to confirm the update result.
      * The clientToken field currently does not provide idempotency guarantees. Do not rely on this parameter to prevent duplicate requests. The healthyThreshold field for health checks currently does not take effect. Omit this field.
      *
      * @param tmpReq - UpdateCustomAgentRequest
@@ -2797,9 +3473,11 @@ export default class Client extends OpenApi {
      *
      * @remarks
      * Provide at least one top-level field to update. Omitted top-level fields retain their original configurations. When providing a configuration object, specify its required subfields and include any optional configurations that you want to retain. Arrays are replaced as a whole. Pass an empty array [] to clear a list. The agenticFsMounts field does not accept null. Pass null for the description field to clear the description, and pass null for the healthCheck field to remove the health check.
-     * When updating an image, you must specify artifact.port and the type, instanceId, namespace, repo, and tag fields of artifact.container. To retain a custom startup command, also provide the entrypoint field. Currently, only Alibaba Cloud Container Registry (ACR) container image deployment is supported. Omit the artifact.code field.
-     * When providing the runtime field, both compute and sessionPolicy must be present. If you omit hpa or some of its fields, unspecified elastic configurations use default values. To retain the original elastic configurations, you must provide them together. When providing the network field, omitted access items are treated as allowed, but actual access is still restricted by the workspace network configurations. To retain the original restrictions, provide both accessInternet and accessVpc. When providing healthCheck, you must specify the port field, and other unspecified items use default values. When providing logging.sls, you must specify both project and logstore.
-     * The update is an asynchronous process. A successful response indicates that the request is accepted. You can call the GetCustomAgent operation to query latestSpecVersion, latestVersionStatus, and latestExecutionError, and check the status field to confirm the update result.
+     * When updating an image, you must specify artifact.port and the type, instanceId, namespace, repo, and tag fields of artifact.container. To retain a custom startup command, also provide the entrypoint field.
+     * In code package pattern, specify artifact.port and the sourceUri, languageRuntime, and entrypoint fields of artifact.code. Do not specify the container field at the same time. Dependencies must be packaged by the user. ZIP and TAR.GZ formats are supported, and the compressed package size cannot exceed 500,000,000 bytes. Query the runtime environment identity by calling the ListAgentCodeRuntimes operation. The sourceUri field supports oss:// addresses or HTTPS object addresses of standard OSS public domain names, including signed URLs. For local files, first call the GetAgentCodePackageUploadUrl operation to obtain an upload URL, upload the file directly, and then commit the returned sourceUri.
+     * When submitting a new code package source, the backend rechecks read permissions, objects, and sizes. The configuration is saved only after the transfer succeeds. If the transfer fails, the current configuration is not saved. Saved fixed packages can be reused. Set the client timeout to 210 seconds for code package requests. Archive integrity and secure decompression are checked at startup. A successful acceptance does not indicate that the agent is ready to run.
+     * When providing the runtime field, the compute and sessionPolicy fields must be provided at the same time. If the hpa field or its subfields are omitted, unspecified elastic configurations use default values. To retain the original elastic configurations, provide them together. When providing the network field, omitted access items are treated as allowed, but actual access is still restricted by the workspace network configurations. To retain the original restrictions, provide both accessInternet and accessVpc. When providing the healthCheck field, the port field is required, and other unspecified items use default values. When providing the logging.sls field, both project and logstore must be specified.
+     * The update is an asynchronous process. A successful response indicates that the request is accepted. Call the GetCustomAgent operation to query latestSpecVersion, latestVersionStatus, and latestExecutionError, and check the status field to confirm the update result.
      * The clientToken field currently does not provide idempotency guarantees. Do not rely on this parameter to prevent duplicate requests. The healthyThreshold field for health checks currently does not take effect. Omit this field.
      *
      * @param request - UpdateCustomAgentRequest
@@ -2831,7 +3509,49 @@ export default class Client extends OpenApi {
      */
     updateExternalAgent(workspaceId: string, agentId: string, request: $_model.UpdateExternalAgentRequest): Promise<$_model.UpdateExternalAgentResponse>;
     /**
-     * Updates the login toggle, member synchronization toggle, or application configuration of a specified external identity provider in a workspace. Unspecified properties remain unchanged. The update is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track progress.
+     * Updates the logon switch, member synchronization switch, or application configuration of a specified external identity provider for a workspace. Unspecified properties remain unchanged. The update is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * CustomSSO uses protocol=SAML and saml to save logon configurations. It does not accept legacy metadata or syncEnabled. To toggle the SCIM switch, you must call UpdateIdentityProviderSCIM. OIDC is not supported. You can either import XML or manually enter fields. If you import XML, metadataXml must be a single IdP EntityDescriptor XML text of up to 1 MiB. URLs or file paths are not accepted, and DTDs or external entities are prohibited. If you manually enter fields, you must provide entityId, loginUrl, bindingType, and a non-empty x509Certificates array at the same time. The entityId must be non-empty and up to 2,048 characters in length, and cannot be replaced after configuration. The loginUrl must be an absolute HTTPS URL without user credentials or fragments. The bindingType must be HTTP-Redirect or HTTP-POST. Signing certificates must be valid X.509 certificates, and up to 10 certificates are supported.
+     * Saving the configuration does not automatically enable logon. A valid SAML configuration must exist before you enable logon. Setting loginEnabled=false only disables logon and does not clear SAML or SCIM configurations. You can independently pass Boolean values for jitProvisionEnabled and jitUpdateEnabled. If omitted, the existing values are retained. If omitted for the first time, the default value is false. Updating only the JIT switches also requires a valid SAML configuration. If the request is unchanged, the current binding may be returned directly without generating a new task. A successful update returns UPDATING. You can call GetIdentityProvider and wait for READY or UPDATE_FAILED. If the update fails, you can resubmit the request. An HTTP success response does not indicate that the upstream configuration has taken effect.
+     * DingTalk and Feishu continue to use vendor metadata and logon or synchronization switches. They do not accept protocol or saml. Updating vendor metadata supports partial updates. You only need to submit the fields to be modified. Unsubmitted fields and saved credentials remain unchanged. The server merges the new and old values and then validates the complete configuration. Explicitly submitted fields cannot be null, empty strings, or blank strings. For example, you can submit only appSecret to update the secret. The existing vendor semantics of syncScope are retained. Saving the scope does not automatically trigger full synchronization.
+     * ## Request and examples
+     * PUT /workspaces/{workspaceId}/identity-providers/{identityProviderType}
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * PUT /workspaces/ws-example/identity-providers/CustomSSO
+     * {
+     *   "protocol": "SAML",
+     *   "saml": {
+     *     "entityId": "https://idp.example.com/entity",
+     *     "loginUrl": "https://idp.example.com/sso",
+     *     "bindingType": "HTTP-Redirect",
+     *     "x509Certificates": [
+     *       "<Valid PEM X.509 certificate text>"
+     *     ],
+     *     "jitProvisionEnabled": false,
+     *     "jitUpdateEnabled": false
+     *   }
+     * }
+     * Toggle logon only: {"loginEnabled": true}
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "protocol": "SAML",
+     *     "loginEnabled": false,
+     *     "syncEnabled": false,
+     *     "status": "UPDATING"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream may return 503 IdentityProviderProvisioningUnavailable if they fail. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
+     * 400 InvalidParameter: XML and manual entry are mixed, manual entry items are missing, certificates are invalid, the protocol is not supported, entityId is changed, logon is enabled without configuration, or CustomSSO submits metadata or syncEnabled. 409 IdentityProviderOperationConflict: The current binding does not allow updates. CustomSSO supports resubmitting configurations from UPDATE_FAILED.
      *
      * @param tmpReq - UpdateIdentityProviderRequest
      * @param headers - map
@@ -2842,7 +3562,49 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.UpdateIdentityProviderResponse>;
     /**
-     * Updates the login toggle, member synchronization toggle, or application configuration of a specified external identity provider in a workspace. Unspecified properties remain unchanged. The update is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track progress.
+     * Updates the logon switch, member synchronization switch, or application configuration of a specified external identity provider for a workspace. Unspecified properties remain unchanged. The update is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * CustomSSO uses protocol=SAML and saml to save logon configurations. It does not accept legacy metadata or syncEnabled. To toggle the SCIM switch, you must call UpdateIdentityProviderSCIM. OIDC is not supported. You can either import XML or manually enter fields. If you import XML, metadataXml must be a single IdP EntityDescriptor XML text of up to 1 MiB. URLs or file paths are not accepted, and DTDs or external entities are prohibited. If you manually enter fields, you must provide entityId, loginUrl, bindingType, and a non-empty x509Certificates array at the same time. The entityId must be non-empty and up to 2,048 characters in length, and cannot be replaced after configuration. The loginUrl must be an absolute HTTPS URL without user credentials or fragments. The bindingType must be HTTP-Redirect or HTTP-POST. Signing certificates must be valid X.509 certificates, and up to 10 certificates are supported.
+     * Saving the configuration does not automatically enable logon. A valid SAML configuration must exist before you enable logon. Setting loginEnabled=false only disables logon and does not clear SAML or SCIM configurations. You can independently pass Boolean values for jitProvisionEnabled and jitUpdateEnabled. If omitted, the existing values are retained. If omitted for the first time, the default value is false. Updating only the JIT switches also requires a valid SAML configuration. If the request is unchanged, the current binding may be returned directly without generating a new task. A successful update returns UPDATING. You can call GetIdentityProvider and wait for READY or UPDATE_FAILED. If the update fails, you can resubmit the request. An HTTP success response does not indicate that the upstream configuration has taken effect.
+     * DingTalk and Feishu continue to use vendor metadata and logon or synchronization switches. They do not accept protocol or saml. Updating vendor metadata supports partial updates. You only need to submit the fields to be modified. Unsubmitted fields and saved credentials remain unchanged. The server merges the new and old values and then validates the complete configuration. Explicitly submitted fields cannot be null, empty strings, or blank strings. For example, you can submit only appSecret to update the secret. The existing vendor semantics of syncScope are retained. Saving the scope does not automatically trigger full synchronization.
+     * ## Request and examples
+     * PUT /workspaces/{workspaceId}/identity-providers/{identityProviderType}
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * PUT /workspaces/ws-example/identity-providers/CustomSSO
+     * {
+     *   "protocol": "SAML",
+     *   "saml": {
+     *     "entityId": "https://idp.example.com/entity",
+     *     "loginUrl": "https://idp.example.com/sso",
+     *     "bindingType": "HTTP-Redirect",
+     *     "x509Certificates": [
+     *       "<Valid PEM X.509 certificate text>"
+     *     ],
+     *     "jitProvisionEnabled": false,
+     *     "jitUpdateEnabled": false
+     *   }
+     * }
+     * Toggle logon only: {"loginEnabled": true}
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "workspaceId": "ws-example",
+     *     "identityProviderType": "CustomSSO",
+     *     "protocol": "SAML",
+     *     "loginEnabled": false,
+     *     "syncEnabled": false,
+     *     "status": "UPDATING"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream may return 503 IdentityProviderProvisioningUnavailable if they fail. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
+     * 400 InvalidParameter: XML and manual entry are mixed, manual entry items are missing, certificates are invalid, the protocol is not supported, entityId is changed, logon is enabled without configuration, or CustomSSO submits metadata or syncEnabled. 409 IdentityProviderOperationConflict: The current binding does not allow updates. CustomSSO supports resubmitting configurations from UPDATE_FAILED.
      *
      * @param request - UpdateIdentityProviderRequest
      * @returns UpdateIdentityProviderResponse
@@ -2917,10 +3679,10 @@ export default class Client extends OpenApi {
      */
     updateMcpTemplateConfig(workspaceId: string, mcpServerId: string, request: $_model.UpdateMcpTemplateConfigRequest): Promise<$_model.UpdateMcpTemplateConfigResponse>;
     /**
-     * Updates the long-term memory text or metadata based on the memory ID.
+     * Updates the text or metadata of a long-term memory based on the memory ID.
      *
      * @remarks
-     * Updates the long-term memory text or metadata based on the memory ID.
+     * Updates the text or metadata of a long-term memory based on the memory ID.
      *
      * @param tmpReq - UpdateMemoryRequest
      * @param headers - map
@@ -2931,10 +3693,10 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.UpdateMemoryResponse>;
     /**
-     * Updates the long-term memory text or metadata based on the memory ID.
+     * Updates the text or metadata of a long-term memory based on the memory ID.
      *
      * @remarks
-     * Updates the long-term memory text or metadata based on the memory ID.
+     * Updates the text or metadata of a long-term memory based on the memory ID.
      *
      * @param request - UpdateMemoryRequest
      * @returns UpdateMemoryResponse
@@ -3200,6 +3962,56 @@ export default class Client extends OpenApi {
      * @returns UploadSkillViaOssResponse
      */
     uploadSkillViaOss(workspaceId: string, request: $_model.UploadSkillViaOssRequest): Promise<$_model.UploadSkillViaOssResponse>;
+    /**
+     * Validates the OSS code package source for an agent.
+     *
+     * @remarks
+     * Uses the current workspace role to check whether the customer\\"s OSS object exists and is readable, and checks the file name extension and compressed size. Returns the sourceUri, file name, size, and format read in this request. The bucket and object key are passed separately, and HTTPS download URLs are not accepted.
+     * The validation uses object metadata and read probing. It does not perform full downloads, transfers, or decompression, nor does it generate a SHA-256 hash. Passing the validation does not mean that the archive content is complete or can be started. When you submit a CreateCustomAgent or UpdateCustomAgent request, the system re-validates and transfers the package. You do not need to invoke this operation in advance as a prerequisite for submission.
+     *
+     * @param tmpReq - ValidateAgentCodePackageFromOssRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns ValidateAgentCodePackageFromOssResponse
+     */
+    validateAgentCodePackageFromOssWithOptions(workspaceId: string, tmpReq: $_model.ValidateAgentCodePackageFromOssRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.ValidateAgentCodePackageFromOssResponse>;
+    /**
+     * Validates the OSS code package source for an agent.
+     *
+     * @remarks
+     * Uses the current workspace role to check whether the customer\\"s OSS object exists and is readable, and checks the file name extension and compressed size. Returns the sourceUri, file name, size, and format read in this request. The bucket and object key are passed separately, and HTTPS download URLs are not accepted.
+     * The validation uses object metadata and read probing. It does not perform full downloads, transfers, or decompression, nor does it generate a SHA-256 hash. Passing the validation does not mean that the archive content is complete or can be started. When you submit a CreateCustomAgent or UpdateCustomAgent request, the system re-validates and transfers the package. You do not need to invoke this operation in advance as a prerequisite for submission.
+     *
+     * @param request - ValidateAgentCodePackageFromOssRequest
+     * @returns ValidateAgentCodePackageFromOssResponse
+     */
+    validateAgentCodePackageFromOss(workspaceId: string, request: $_model.ValidateAgentCodePackageFromOssRequest): Promise<$_model.ValidateAgentCodePackageFromOssResponse>;
+    /**
+     * 检查智能体代码包 OSS RAM 授权状态
+     *
+     * @remarks
+     * 检查当前 Workspace 角色是否绑定所选源 Bucket 对应的自定义 RAM 策略，复用已有挂载授权。仅返回策略绑定状态，不验证代码包存在或可读、不修改默认桶。授权状态不能替代 ValidateAgentCodePackageFromOss 的实际对象读取校验。
+     *
+     * @param request - VerifyAgentCodePackageOssRamAuthorizationRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns VerifyAgentCodePackageOssRamAuthorizationResponse
+     */
+    verifyAgentCodePackageOssRamAuthorizationWithOptions(workspaceId: string, request: $_model.VerifyAgentCodePackageOssRamAuthorizationRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.VerifyAgentCodePackageOssRamAuthorizationResponse>;
+    /**
+     * 检查智能体代码包 OSS RAM 授权状态
+     *
+     * @remarks
+     * 检查当前 Workspace 角色是否绑定所选源 Bucket 对应的自定义 RAM 策略，复用已有挂载授权。仅返回策略绑定状态，不验证代码包存在或可读、不修改默认桶。授权状态不能替代 ValidateAgentCodePackageFromOss 的实际对象读取校验。
+     *
+     * @param request - VerifyAgentCodePackageOssRamAuthorizationRequest
+     * @returns VerifyAgentCodePackageOssRamAuthorizationResponse
+     */
+    verifyAgentCodePackageOssRamAuthorization(workspaceId: string, request: $_model.VerifyAgentCodePackageOssRamAuthorizationRequest): Promise<$_model.VerifyAgentCodePackageOssRamAuthorizationResponse>;
     /**
      * Validates whether one or more Qoder Service Account Keys are available at a specified site. This operation does not save keys or modify the Connector status.
      *
@@ -3228,7 +4040,7 @@ export default class Client extends OpenApi {
      * Verifies the ACR RAM authorization for a workspace.
      *
      * @remarks
-     * ACR and user OSS mounts share the workspace role. If no existing role is available, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is retained and only new permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. This operation performs a read-only check to verify whether the custom policies corresponding to the target instance, namespace, and repository are attached to the shared role, and checks the workspace prerequisites. It does not create execution versions or trigger configuration delivery. AUTHORIZED only indicates that the custom policy for the target name is attached, without parsing the policy content or simulating the final permissions. ELIGIBLE does not indicate that RuntimeManager capacity or template admission is complete, nor does it require ACR configurations to be delivered. Creating or updating an agent re-verifies permissions and processes ACR dependencies on the backend. Configuration waiting, failures, and retries are reported through agent details.
+     * ACR and user OSS mounts share the workspace role. If no existing role is found, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is retained and only new permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. This operation performs a read-only check to verify whether the custom policies corresponding to the target instance, namespace, and repository are attached to the shared role, and checks the workspace prerequisites. It does not create execution versions or trigger configuration delivery. AUTHORIZED only indicates that the custom policy for the target name is attached, without parsing the policy content or simulating the final permissions. ELIGIBLE does not mean that RuntimeManager capacity or template admission is complete, nor does it require ACR configuration to be delivered. Creating or updating an agent re-verifies permissions and processes ACR dependencies on the backend. Configuration waiting, failures, and retries are reported through agent details.
      *
      * @param request - VerifyWorkspaceAcrRamAuthorizationRequest
      * @param headers - map
@@ -3242,7 +4054,7 @@ export default class Client extends OpenApi {
      * Verifies the ACR RAM authorization for a workspace.
      *
      * @remarks
-     * ACR and user OSS mounts share the workspace role. If no existing role is available, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is retained and only new permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. This operation performs a read-only check to verify whether the custom policies corresponding to the target instance, namespace, and repository are attached to the shared role, and checks the workspace prerequisites. It does not create execution versions or trigger configuration delivery. AUTHORIZED only indicates that the custom policy for the target name is attached, without parsing the policy content or simulating the final permissions. ELIGIBLE does not indicate that RuntimeManager capacity or template admission is complete, nor does it require ACR configurations to be delivered. Creating or updating an agent re-verifies permissions and processes ACR dependencies on the backend. Configuration waiting, failures, and retries are reported through agent details.
+     * ACR and user OSS mounts share the workspace role. If no existing role is found, AliyunAgentCoreWorkspace-{workspaceId} is used. If a valid legacy OSS mount role exists, it is retained and only new permissions are appended without overwriting existing OSS policies. Fixed historical shared roles continue to be reused and are not recreated or renamed due to new naming templates. This operation performs a read-only check to verify whether the custom policies corresponding to the target instance, namespace, and repository are attached to the shared role, and checks the workspace prerequisites. It does not create execution versions or trigger configuration delivery. AUTHORIZED only indicates that the custom policy for the target name is attached, without parsing the policy content or simulating the final permissions. ELIGIBLE does not mean that RuntimeManager capacity or template admission is complete, nor does it require ACR configuration to be delivered. Creating or updating an agent re-verifies permissions and processes ACR dependencies on the backend. Configuration waiting, failures, and retries are reported through agent details.
      *
      * @param request - VerifyWorkspaceAcrRamAuthorizationRequest
      * @returns VerifyWorkspaceAcrRamAuthorizationResponse