@archastro/sdk 0.21.0 → 0.22.0

package/dist/types/common.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { AutomationParticipantSlot, AutomationPrefills } from "./automations.js";
+import type { ComputerRepository } from "./computers.js";
 import type { Config } from "./config.js";
 import type { ImageSource } from "./image.js";
 import type { User } from "./users.js";
@@ -70,10 +71,18 @@ export declare const aclRemoveTargetSchema: z.ZodObject<{
 export interface Acl {
     /** Patch mode: grants to add or merge into the existing list. Cannot be combined with `grants`. */
     add?: AclGrant[] | undefined;
+    /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+    add_denies?: AclGrant[] | undefined;
+    /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+    denies?: AclGrant[] | undefined;
     /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
     grants?: AclGrant[] | undefined;
+    /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+    preserve_denies?: boolean | undefined;
     /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
     remove?: AclRemoveTarget[] | undefined;
+    /** Patch mode: principals whose denies should be removed. */
+    remove_denies?: AclRemoveTarget[] | undefined;
 }
 /** Runtime validator for {@link Acl}. */
 export declare const aclSchema: z.ZodObject<{
@@ -94,6 +103,40 @@ export declare const aclSchema: z.ZodObject<{
         principal_type: string;
         principal?: string | undefined;
     }>, "many">>;
+    /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+    add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+        principal: z.ZodOptional<z.ZodString>;
+        /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+        principal_type: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }, {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }>, "many">>;
+    /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+    denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+        principal: z.ZodOptional<z.ZodString>;
+        /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+        principal_type: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }, {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }>, "many">>;
     /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
     grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
         /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -111,6 +154,8 @@ export declare const aclSchema: z.ZodObject<{
         principal_type: string;
         principal?: string | undefined;
     }>, "many">>;
+    /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+    preserve_denies: z.ZodOptional<z.ZodBoolean>;
     /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
     remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
         /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -124,36 +169,79 @@ export declare const aclSchema: z.ZodObject<{
         principal_type: string;
         principal?: string | undefined;
     }>, "many">>;
+    /** Patch mode: principals whose denies should be removed. */
+    remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+        principal: z.ZodOptional<z.ZodString>;
+        /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+        principal_type: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        principal_type: string;
+        principal?: string | undefined;
+    }, {
+        principal_type: string;
+        principal?: string | undefined;
+    }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     add?: {
         actions: string[];
         principal_type: string;
         principal?: string | undefined;
     }[] | undefined;
+    add_denies?: {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }[] | undefined;
+    denies?: {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }[] | undefined;
     grants?: {
         actions: string[];
         principal_type: string;
         principal?: string | undefined;
     }[] | undefined;
+    preserve_denies?: boolean | undefined;
     remove?: {
         principal_type: string;
         principal?: string | undefined;
     }[] | undefined;
+    remove_denies?: {
+        principal_type: string;
+        principal?: string | undefined;
+    }[] | undefined;
 }, {
     add?: {
         actions: string[];
         principal_type: string;
         principal?: string | undefined;
     }[] | undefined;
+    add_denies?: {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }[] | undefined;
+    denies?: {
+        actions: string[];
+        principal_type: string;
+        principal?: string | undefined;
+    }[] | undefined;
     grants?: {
         actions: string[];
         principal_type: string;
         principal?: string | undefined;
     }[] | undefined;
+    preserve_denies?: boolean | undefined;
     remove?: {
         principal_type: string;
         principal?: string | undefined;
     }[] | undefined;
+    remove_denies?: {
+        principal_type: string;
+        principal?: string | undefined;
+    }[] | undefined;
 }>;
 /** A single event record in an activity feed, capturing what happened, who caused it, and which resources were involved. */
 export interface ActivityFeedEntry {
@@ -165,15 +253,30 @@ export interface ActivityFeedEntry {
                 principal?: string | undefined;
                 principal_type: string;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal?: string | undefined;
+                principal_type: string;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal?: string | undefined;
+                principal_type: string;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal?: string | undefined;
                 principal_type: string;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal?: string | undefined;
                 principal_type: string;
             }[] | undefined;
+            remove_denies?: {
+                principal?: string | undefined;
+                principal_type: string;
+            }[] | undefined;
         } | null | undefined;
         app?: string | undefined;
         created_at?: string | undefined;
@@ -414,6 +517,32 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                actions: z.ZodArray<z.ZodString, "many">;
+                principal: z.ZodOptional<z.ZodString>;
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                actions: z.ZodArray<z.ZodString, "many">;
+                principal: z.ZodOptional<z.ZodString>;
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 actions: z.ZodArray<z.ZodString, "many">;
                 principal: z.ZodOptional<z.ZodString>;
@@ -427,6 +556,7 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 principal: z.ZodOptional<z.ZodString>;
                 principal_type: z.ZodString;
@@ -437,36 +567,76 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                principal: z.ZodOptional<z.ZodString>;
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>>;
         app: z.ZodOptional<z.ZodString>;
         created_at: z.ZodOptional<z.ZodString>;
@@ -1482,15 +1652,30 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -1660,15 +1845,30 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -1964,15 +2164,30 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -2183,15 +2398,30 @@ export declare const activityFeedEntrySchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -2390,6 +2620,32 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }>, "many">>;
+                add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    actions: z.ZodArray<z.ZodString, "many">;
+                    principal: z.ZodOptional<z.ZodString>;
+                    principal_type: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }, {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }>, "many">>;
+                denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    actions: z.ZodArray<z.ZodString, "many">;
+                    principal: z.ZodOptional<z.ZodString>;
+                    principal_type: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }, {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }>, "many">>;
                 grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     actions: z.ZodArray<z.ZodString, "many">;
                     principal: z.ZodOptional<z.ZodString>;
@@ -2403,6 +2659,7 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }>, "many">>;
+                preserve_denies: z.ZodOptional<z.ZodBoolean>;
                 remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     principal: z.ZodOptional<z.ZodString>;
                     principal_type: z.ZodString;
@@ -2413,36 +2670,76 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }>, "many">>;
+                remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    principal: z.ZodOptional<z.ZodString>;
+                    principal_type: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }, {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }>, "many">>;
             }, "strip", z.ZodTypeAny, {
                 add?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             }, {
                 add?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             }>>>;
             app: z.ZodOptional<z.ZodString>;
             created_at: z.ZodOptional<z.ZodString>;
@@ -3458,15 +3755,30 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             } | null | undefined;
             default_model?: string | null | undefined;
             identity?: string | null | undefined;
@@ -3636,15 +3948,30 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             } | null | undefined;
             default_model?: string | null | undefined;
             identity?: string | null | undefined;
@@ -3940,18 +4267,33 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
-                grants?: {
+                add_denies?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
-                remove?: {
+                denies?: {
+                    actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
-            } | null | undefined;
-            default_model?: string | null | undefined;
-            identity?: string | null | undefined;
+                grants?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                preserve_denies?: boolean | undefined;
+                remove?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+            } | null | undefined;
+            default_model?: string | null | undefined;
+            identity?: string | null | undefined;
             last_applied_template_config?: string | null | undefined;
             originator?: string | null | undefined;
             phone_number?: string | null | undefined;
@@ -4159,15 +4501,30 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             } | null | undefined;
             default_model?: string | null | undefined;
             identity?: string | null | undefined;
@@ -4382,15 +4739,30 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             } | null | undefined;
             default_model?: string | null | undefined;
             identity?: string | null | undefined;
@@ -4606,15 +4978,30 @@ export declare const activityFeedEntryListResponseSchema: z.ZodObject<{
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                add_denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
+                denies?: {
+                    actions: string[];
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
                 grants?: {
                     actions: string[];
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                preserve_denies?: boolean | undefined;
                 remove?: {
                     principal_type: string;
                     principal?: string | undefined;
                 }[] | undefined;
+                remove_denies?: {
+                    principal_type: string;
+                    principal?: string | undefined;
+                }[] | undefined;
             } | null | undefined;
             default_model?: string | null | undefined;
             identity?: string | null | undefined;
@@ -4980,31 +5367,136 @@ export declare const originSchema: z.ZodObject<{
     session_id?: string | null | undefined;
     thread_id?: string | null | undefined;
 }>;
-/** Question request payload. */
+/** Public review fields for one proposed self-update change. */
+export interface SelfUpdateChange {
+    action?: string | undefined;
+    class?: string | undefined;
+    path?: string | undefined;
+    tier?: string | undefined;
+}
+/** Runtime validator for {@link SelfUpdateChange}. */
+export declare const selfUpdateChangeSchema: z.ZodObject<{
+    action: z.ZodOptional<z.ZodString>;
+    class: z.ZodOptional<z.ZodString>;
+    path: z.ZodOptional<z.ZodString>;
+    tier: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path?: string | undefined;
+    action?: string | undefined;
+    class?: string | undefined;
+    tier?: string | undefined;
+}, {
+    path?: string | undefined;
+    action?: string | undefined;
+    class?: string | undefined;
+    tier?: string | undefined;
+}>;
+/** Kind-safe request payload. */
 export interface Payload {
-    question: string;
+    changes?: SelfUpdateChange[] | undefined;
+    from_version?: string | undefined;
+    instructions_md?: string | undefined;
+    key?: string | undefined;
+    overwrite?: boolean | undefined;
+    prompt?: string | undefined;
+    proposal_id?: string | undefined;
+    question?: string | undefined;
+    rationale?: string | undefined;
+    to_version?: string | undefined;
+    validate_script?: string | undefined;
 }
 /** Runtime validator for {@link Payload}. */
 export declare const payloadSchema: z.ZodObject<{
-    question: z.ZodString;
+    changes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        action: z.ZodOptional<z.ZodString>;
+        class: z.ZodOptional<z.ZodString>;
+        path: z.ZodOptional<z.ZodString>;
+        tier: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string | undefined;
+        action?: string | undefined;
+        class?: string | undefined;
+        tier?: string | undefined;
+    }, {
+        path?: string | undefined;
+        action?: string | undefined;
+        class?: string | undefined;
+        tier?: string | undefined;
+    }>, "many">>;
+    from_version: z.ZodOptional<z.ZodString>;
+    instructions_md: z.ZodOptional<z.ZodString>;
+    key: z.ZodOptional<z.ZodString>;
+    overwrite: z.ZodOptional<z.ZodBoolean>;
+    prompt: z.ZodOptional<z.ZodString>;
+    proposal_id: z.ZodOptional<z.ZodString>;
+    question: z.ZodOptional<z.ZodString>;
+    rationale: z.ZodOptional<z.ZodString>;
+    to_version: z.ZodOptional<z.ZodString>;
+    validate_script: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    question: string;
+    key?: string | undefined;
+    changes?: {
+        path?: string | undefined;
+        action?: string | undefined;
+        class?: string | undefined;
+        tier?: string | undefined;
+    }[] | undefined;
+    from_version?: string | undefined;
+    instructions_md?: string | undefined;
+    overwrite?: boolean | undefined;
+    prompt?: string | undefined;
+    proposal_id?: string | undefined;
+    question?: string | undefined;
+    rationale?: string | undefined;
+    to_version?: string | undefined;
+    validate_script?: string | undefined;
 }, {
-    question: string;
+    key?: string | undefined;
+    changes?: {
+        path?: string | undefined;
+        action?: string | undefined;
+        class?: string | undefined;
+        tier?: string | undefined;
+    }[] | undefined;
+    from_version?: string | undefined;
+    instructions_md?: string | undefined;
+    overwrite?: boolean | undefined;
+    prompt?: string | undefined;
+    proposal_id?: string | undefined;
+    question?: string | undefined;
+    rationale?: string | undefined;
+    to_version?: string | undefined;
+    validate_script?: string | undefined;
 }>;
 /** Answer or rejection reason; null before resolution. */
 export interface Resolution {
     answer?: string | undefined;
+    key?: string | undefined;
     reason?: string | undefined;
+    set?: boolean | undefined;
+    status?: string | undefined;
+    to_version?: string | undefined;
 }
 /** Runtime validator for {@link Resolution}. */
 export declare const resolutionSchema: z.ZodObject<{
     answer: z.ZodOptional<z.ZodString>;
+    key: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
+    set: z.ZodOptional<z.ZodBoolean>;
+    status: z.ZodOptional<z.ZodString>;
+    to_version: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    key?: string | undefined;
+    status?: string | undefined;
+    set?: boolean | undefined;
+    to_version?: string | undefined;
     answer?: string | undefined;
     reason?: string | undefined;
 }, {
+    key?: string | undefined;
+    status?: string | undefined;
+    set?: boolean | undefined;
+    to_version?: string | undefined;
     answer?: string | undefined;
     reason?: string | undefined;
 }>;
@@ -6127,6 +6619,40 @@ export declare const messageSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+        add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+        /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+        denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
         /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
         grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -6144,6 +6670,8 @@ export declare const messageSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+        preserve_denies: z.ZodOptional<z.ZodBoolean>;
         /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
         remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -6157,36 +6685,79 @@ export declare const messageSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: principals whose denies should be removed. */
+        remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }>>>;
     /** Resolved actor descriptors for the message sender, combining identity and display metadata. Always contains exactly one entry. */
     actors: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -6707,15 +7278,30 @@ export declare const messageSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | null | undefined;
     attachments?: {
         type: string;
@@ -6847,15 +7433,30 @@ export declare const messageSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | null | undefined;
     attachments?: {
         type: string;
@@ -7576,6 +8177,8 @@ export interface CurrentUser {
     app?: string | null | undefined;
     /** Display name of the token-scoped app. */
     app_name?: string | null | undefined;
+    /** Stable public URL of the profile picture. Unlike `profile_picture.url` it does not expire, so clients can store it; it stops resolving when the picture is replaced. `null` when the user has no profile picture. */
+    avatar_url?: string | null | undefined;
     /** Present only when the request supplies one or more `entitlement[]` values. */
     effective_access?: EffectiveAccess | undefined;
     /** Email address of the user. */
@@ -7619,6 +8222,8 @@ export declare const currentUserSchema: z.ZodObject<{
     app: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     /** Display name of the token-scoped app. */
     app_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    /** Stable public URL of the profile picture. Unlike `profile_picture.url` it does not expire, so clients can store it; it stops resolving when the picture is replaced. `null` when the user has no profile picture. */
+    avatar_url: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     /** Present only when the request supplies one or more `entitlement[]` values. */
     effective_access: z.ZodOptional<z.ZodObject<{
         /** Administration authority and requested-entitlement-relevant trials for the personal and current-organization principals. */
@@ -7826,6 +8431,7 @@ export declare const currentUserSchema: z.ZodObject<{
     org_role?: string | null | undefined;
     org_slug?: string | null | undefined;
     sandbox_name?: string | null | undefined;
+    avatar_url?: string | null | undefined;
     effective_access?: {
         billing: {
             principal_type: "user" | "org";
@@ -7876,6 +8482,7 @@ export declare const currentUserSchema: z.ZodObject<{
     org_role?: string | null | undefined;
     org_slug?: string | null | undefined;
     sandbox_name?: string | null | undefined;
+    avatar_url?: string | null | undefined;
     effective_access?: {
         billing: {
             principal_type: "user" | "org";
@@ -7953,6 +8560,40 @@ export declare const customObjectSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+        add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+        /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+        denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
         /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
         grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -7970,6 +8611,8 @@ export declare const customObjectSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+        preserve_denies: z.ZodOptional<z.ZodBoolean>;
         /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
         remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -7983,36 +8626,79 @@ export declare const customObjectSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: principals whose denies should be removed. */
+        remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }>>;
     /** ID of the agent that owns this object (`agt_...`). `null` for other ownership types. */
     agent: z.ZodOptional<z.ZodString>;
@@ -8055,15 +8741,30 @@ export declare const customObjectSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | undefined;
     version?: number | undefined;
     expires_at?: string | null | undefined;
@@ -8085,15 +8786,30 @@ export declare const customObjectSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | undefined;
     version?: number | undefined;
     expires_at?: string | null | undefined;
@@ -8179,8 +8895,8 @@ export declare const customObjectListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
-            /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
-            grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
                 actions: z.ZodArray<z.ZodString, "many">;
                 /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
@@ -8196,49 +8912,128 @@ export declare const customObjectListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
-            /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
-            remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
                 principal: z.ZodOptional<z.ZodString>;
-                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
                 principal_type: z.ZodString;
             }, "strip", z.ZodTypeAny, {
+                actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }, {
-                principal_type: string;
-                principal?: string | undefined;
-            }>, "many">>;
-        }, "strip", z.ZodTypeAny, {
-            add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
-            }[] | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
+            grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
+            /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
+            remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            add?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>;
         /** ID of the agent that owns this object (`agt_...`). `null` for other ownership types. */
         agent: z.ZodOptional<z.ZodString>;
@@ -8281,15 +9076,30 @@ export declare const customObjectListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         version?: number | undefined;
         expires_at?: string | null | undefined;
@@ -8311,15 +9121,30 @@ export declare const customObjectListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         version?: number | undefined;
         expires_at?: string | null | undefined;
@@ -8355,15 +9180,30 @@ export declare const customObjectListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         version?: number | undefined;
         expires_at?: string | null | undefined;
@@ -8393,15 +9233,30 @@ export declare const customObjectListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         version?: number | undefined;
         expires_at?: string | null | undefined;
@@ -10211,6 +11066,40 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -10228,6 +11117,8 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -10241,36 +11132,79 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>>;
         /** Resolved actor descriptors for the message sender, combining identity and display metadata. Always contains exactly one entry. */
         actors: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -10791,15 +11725,30 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         attachments?: {
             type: string;
@@ -10931,15 +11880,30 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         attachments?: {
             type: string;
@@ -11075,15 +12039,30 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         attachments?: {
             type: string;
@@ -11221,15 +12200,30 @@ export declare const paginatedRepliesSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         attachments?: {
             type: string;
@@ -14901,8 +15895,8 @@ export declare const agentSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
-        /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
-        grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+        add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
             actions: z.ZodArray<z.ZodString, "many">;
             /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
@@ -14918,38 +15912,112 @@ export declare const agentSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
-        /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
-        remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+        /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+        denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
             principal: z.ZodOptional<z.ZodString>;
-            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
             principal_type: z.ZodString;
         }, "strip", z.ZodTypeAny, {
+            actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }, {
+            actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        add?: {
+        /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
+        grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
-        }[] | undefined;
-        grants?: {
+        }, {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
-        }[] | undefined;
-        remove?: {
-            principal_type: string;
-            principal?: string | undefined;
-        }[] | undefined;
-    }, {
-        add?: {
-            actions: string[];
-            principal_type: string;
+        }>, "many">>;
+        /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+        preserve_denies: z.ZodOptional<z.ZodBoolean>;
+        /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
+        remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+        /** Patch mode: principals whose denies should be removed. */
+        remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        add?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        grants?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        preserve_denies?: boolean | undefined;
+        remove?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+    }, {
+        add?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
         grants?: {
@@ -14957,10 +16025,15 @@ export declare const agentSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }>>>;
     /** ID of the application that owns this agent (`dap_...`). */
     app: z.ZodOptional<z.ZodString>;
@@ -16095,15 +17168,30 @@ export declare const agentSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | null | undefined;
     default_model?: string | null | undefined;
     identity?: string | null | undefined;
@@ -16273,15 +17361,30 @@ export declare const agentSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | null | undefined;
     default_model?: string | null | undefined;
     identity?: string | null | undefined;
@@ -16437,6 +17540,8 @@ export interface AgentComputer {
     agent?: string | null | undefined;
     /** ID of the app this computer belongs to (`dap_...`). */
     app?: string | undefined;
+    /** Bootstrap results, including each repository's status, commit and error. */
+    bootstrap?: Record<string, unknown> | undefined;
     /** Provider-specific configuration key-value pairs for the computer. Structure depends on the underlying compute provider. */
     config?: Record<string, unknown> | undefined;
     /** When the computer was created (ISO 8601). */
@@ -16455,13 +17560,15 @@ export interface AgentComputer {
     metadata?: Record<string, unknown> | undefined;
     /** Human-readable display name for the computer. `null` if not set. */
     name?: string | undefined;
-    /** Compute backend powering this computer: `"sprites"` (Fly Sprites), `"vercel"` (Vercel Sandbox) or `"e2b"` (E2B). */
+    /** Compute backend powering this computer: `"sprites"` (Fly Sprites), `"vercel"` (Vercel Sandbox), `"e2b"` (E2B) or `"devbox"` (an ArchAstro devbox owned by the computer's user). */
     provider?: string | undefined;
     /** Cloud region where the computer is hosted, e.g. `"us-east-1"`. `null` if not yet assigned or when the provider has no region concept (e.g. `"vercel"`, `"e2b"`). */
     region?: string | null | undefined;
+    /** Ordered GitHub checkouts with repository and nullable ref; the first checkout is primary. */
+    repositories?: ComputerRepository[] | undefined;
     /** URL of the live screenshot sprite used to render a real-time preview of the computer's screen. `null` when no sprite is available. */
     sprite_url?: string | null | undefined;
-    /** Current lifecycle state of the computer. Common values include `"provisioning"`, `"ready"`, `"error"`, and `"terminated"`. */
+    /** Current lifecycle state of the computer. Common values include `"provisioning"`, `"ready"`, `"paused"` (resumes on use), `"error"`, and `"destroyed"`. */
     status?: string | null | undefined;
     /** Thread this computer belongs to, or null for a non-thread computer. */
     thread_id?: string | null | undefined;
@@ -16474,6 +17581,8 @@ export declare const agentComputerSchema: z.ZodObject<{
     agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     /** ID of the app this computer belongs to (`dap_...`). */
     app: z.ZodOptional<z.ZodString>;
+    /** Bootstrap results, including each repository's status, commit and error. */
+    bootstrap: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
     /** Provider-specific configuration key-value pairs for the computer. Structure depends on the underlying compute provider. */
     config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
     /** When the computer was created (ISO 8601). */
@@ -16492,13 +17601,24 @@ export declare const agentComputerSchema: z.ZodObject<{
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
     /** Human-readable display name for the computer. `null` if not set. */
     name: z.ZodOptional<z.ZodString>;
-    /** Compute backend powering this computer: `"sprites"` (Fly Sprites), `"vercel"` (Vercel Sandbox) or `"e2b"` (E2B). */
+    /** Compute backend powering this computer: `"sprites"` (Fly Sprites), `"vercel"` (Vercel Sandbox), `"e2b"` (E2B) or `"devbox"` (an ArchAstro devbox owned by the computer's user). */
     provider: z.ZodOptional<z.ZodString>;
     /** Cloud region where the computer is hosted, e.g. `"us-east-1"`. `null` if not yet assigned or when the provider has no region concept (e.g. `"vercel"`, `"e2b"`). */
     region: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    /** Ordered GitHub checkouts with repository and nullable ref; the first checkout is primary. */
+    repositories: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        ref: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        repository: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        repository: string;
+        ref?: string | null | undefined;
+    }, {
+        repository: string;
+        ref?: string | null | undefined;
+    }>, "many">>;
     /** URL of the live screenshot sprite used to render a real-time preview of the computer's screen. `null` when no sprite is available. */
     sprite_url: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    /** Current lifecycle state of the computer. Common values include `"provisioning"`, `"ready"`, `"error"`, and `"terminated"`. */
+    /** Current lifecycle state of the computer. Common values include `"provisioning"`, `"ready"`, `"paused"` (resumes on use), `"error"`, and `"destroyed"`. */
     status: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     /** Thread this computer belongs to, or null for a non-thread computer. */
     thread_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -16518,9 +17638,14 @@ export declare const agentComputerSchema: z.ZodObject<{
     thread_id?: string | null | undefined;
     config?: Record<string, {} | null> | undefined;
     provider?: string | undefined;
+    bootstrap?: Record<string, {} | null> | undefined;
     error_message?: string | null | undefined;
     last_active_at?: string | null | undefined;
     region?: string | null | undefined;
+    repositories?: {
+        repository: string;
+        ref?: string | null | undefined;
+    }[] | undefined;
     sprite_url?: string | null | undefined;
 }, {
     id: string;
@@ -16536,9 +17661,14 @@ export declare const agentComputerSchema: z.ZodObject<{
     thread_id?: string | null | undefined;
     config?: Record<string, {} | null> | undefined;
     provider?: string | undefined;
+    bootstrap?: Record<string, {} | null> | undefined;
     error_message?: string | null | undefined;
     last_active_at?: string | null | undefined;
     region?: string | null | undefined;
+    repositories?: {
+        repository: string;
+        ref?: string | null | undefined;
+    }[] | undefined;
     sprite_url?: string | null | undefined;
 }>;
 /** A list of agent computers returned by a list query. */
@@ -16554,6 +17684,8 @@ export declare const agentComputerListResponseSchema: z.ZodObject<{
         agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         /** ID of the app this computer belongs to (`dap_...`). */
         app: z.ZodOptional<z.ZodString>;
+        /** Bootstrap results, including each repository's status, commit and error. */
+        bootstrap: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
         /** Provider-specific configuration key-value pairs for the computer. Structure depends on the underlying compute provider. */
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
         /** When the computer was created (ISO 8601). */
@@ -16572,13 +17704,24 @@ export declare const agentComputerListResponseSchema: z.ZodObject<{
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
         /** Human-readable display name for the computer. `null` if not set. */
         name: z.ZodOptional<z.ZodString>;
-        /** Compute backend powering this computer: `"sprites"` (Fly Sprites), `"vercel"` (Vercel Sandbox) or `"e2b"` (E2B). */
+        /** Compute backend powering this computer: `"sprites"` (Fly Sprites), `"vercel"` (Vercel Sandbox), `"e2b"` (E2B) or `"devbox"` (an ArchAstro devbox owned by the computer's user). */
         provider: z.ZodOptional<z.ZodString>;
         /** Cloud region where the computer is hosted, e.g. `"us-east-1"`. `null` if not yet assigned or when the provider has no region concept (e.g. `"vercel"`, `"e2b"`). */
         region: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        /** Ordered GitHub checkouts with repository and nullable ref; the first checkout is primary. */
+        repositories: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            ref: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            repository: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            repository: string;
+            ref?: string | null | undefined;
+        }, {
+            repository: string;
+            ref?: string | null | undefined;
+        }>, "many">>;
         /** URL of the live screenshot sprite used to render a real-time preview of the computer's screen. `null` when no sprite is available. */
         sprite_url: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        /** Current lifecycle state of the computer. Common values include `"provisioning"`, `"ready"`, `"error"`, and `"terminated"`. */
+        /** Current lifecycle state of the computer. Common values include `"provisioning"`, `"ready"`, `"paused"` (resumes on use), `"error"`, and `"destroyed"`. */
         status: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         /** Thread this computer belongs to, or null for a non-thread computer. */
         thread_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -16598,9 +17741,14 @@ export declare const agentComputerListResponseSchema: z.ZodObject<{
         thread_id?: string | null | undefined;
         config?: Record<string, {} | null> | undefined;
         provider?: string | undefined;
+        bootstrap?: Record<string, {} | null> | undefined;
         error_message?: string | null | undefined;
         last_active_at?: string | null | undefined;
         region?: string | null | undefined;
+        repositories?: {
+            repository: string;
+            ref?: string | null | undefined;
+        }[] | undefined;
         sprite_url?: string | null | undefined;
     }, {
         id: string;
@@ -16616,9 +17764,14 @@ export declare const agentComputerListResponseSchema: z.ZodObject<{
         thread_id?: string | null | undefined;
         config?: Record<string, {} | null> | undefined;
         provider?: string | undefined;
+        bootstrap?: Record<string, {} | null> | undefined;
         error_message?: string | null | undefined;
         last_active_at?: string | null | undefined;
         region?: string | null | undefined;
+        repositories?: {
+            repository: string;
+            ref?: string | null | undefined;
+        }[] | undefined;
         sprite_url?: string | null | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -16636,9 +17789,14 @@ export declare const agentComputerListResponseSchema: z.ZodObject<{
         thread_id?: string | null | undefined;
         config?: Record<string, {} | null> | undefined;
         provider?: string | undefined;
+        bootstrap?: Record<string, {} | null> | undefined;
         error_message?: string | null | undefined;
         last_active_at?: string | null | undefined;
         region?: string | null | undefined;
+        repositories?: {
+            repository: string;
+            ref?: string | null | undefined;
+        }[] | undefined;
         sprite_url?: string | null | undefined;
     }[];
 }, {
@@ -16656,9 +17814,14 @@ export declare const agentComputerListResponseSchema: z.ZodObject<{
         thread_id?: string | null | undefined;
         config?: Record<string, {} | null> | undefined;
         provider?: string | undefined;
+        bootstrap?: Record<string, {} | null> | undefined;
         error_message?: string | null | undefined;
         last_active_at?: string | null | undefined;
         region?: string | null | undefined;
+        repositories?: {
+            repository: string;
+            ref?: string | null | undefined;
+        }[] | undefined;
         sprite_url?: string | null | undefined;
     }[];
 }>;
@@ -16722,6 +17885,40 @@ export declare const agentCreateResponseSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+        add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+        /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+        denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
         /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
         grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -16739,6 +17936,8 @@ export declare const agentCreateResponseSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+        preserve_denies: z.ZodOptional<z.ZodBoolean>;
         /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
         remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -16752,36 +17951,79 @@ export declare const agentCreateResponseSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: principals whose denies should be removed. */
+        remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }>>>;
     /** ID of the app this agent belongs to (`dap_...`). */
     app: z.ZodOptional<z.ZodString>;
@@ -16855,15 +18097,30 @@ export declare const agentCreateResponseSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | null | undefined;
     default_model?: string | null | undefined;
     identity?: string | null | undefined;
@@ -16894,15 +18151,30 @@ export declare const agentCreateResponseSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | null | undefined;
     default_model?: string | null | undefined;
     identity?: string | null | undefined;
@@ -17257,6 +18529,40 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -17274,6 +18580,8 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -17287,36 +18595,79 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>>;
         /** ID of the application that owns this agent (`dap_...`). */
         app: z.ZodOptional<z.ZodString>;
@@ -18451,15 +19802,30 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -18629,15 +19995,30 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -18898,15 +20279,30 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -19105,15 +20501,30 @@ export declare const agentHealthSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -19331,6 +20742,40 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -19348,6 +20793,8 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -19361,36 +20808,79 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>>;
         /** ID of the application that owns this agent (`dap_...`). */
         app: z.ZodOptional<z.ZodString>;
@@ -20525,15 +22015,30 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -20703,15 +22208,30 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -20895,15 +22415,30 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -21081,15 +22616,30 @@ export declare const agentListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -21278,7 +22828,7 @@ export interface AgentRequest {
     kind?: string | undefined;
     /** Origin references. */
     origin?: Origin | undefined;
-    /** Question request payload. */
+    /** Kind-safe request payload. */
     payload?: Payload | undefined;
     /** Answer or rejection reason; null before resolution. */
     resolution?: Resolution | null | undefined;
@@ -21334,22 +22884,89 @@ export declare const agentRequestSchema: z.ZodObject<{
         session_id?: string | null | undefined;
         thread_id?: string | null | undefined;
     }>>;
-    /** Question request payload. */
+    /** Kind-safe request payload. */
     payload: z.ZodOptional<z.ZodObject<{
-        question: z.ZodString;
+        changes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            action: z.ZodOptional<z.ZodString>;
+            class: z.ZodOptional<z.ZodString>;
+            path: z.ZodOptional<z.ZodString>;
+            tier: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            path?: string | undefined;
+            action?: string | undefined;
+            class?: string | undefined;
+            tier?: string | undefined;
+        }, {
+            path?: string | undefined;
+            action?: string | undefined;
+            class?: string | undefined;
+            tier?: string | undefined;
+        }>, "many">>;
+        from_version: z.ZodOptional<z.ZodString>;
+        instructions_md: z.ZodOptional<z.ZodString>;
+        key: z.ZodOptional<z.ZodString>;
+        overwrite: z.ZodOptional<z.ZodBoolean>;
+        prompt: z.ZodOptional<z.ZodString>;
+        proposal_id: z.ZodOptional<z.ZodString>;
+        question: z.ZodOptional<z.ZodString>;
+        rationale: z.ZodOptional<z.ZodString>;
+        to_version: z.ZodOptional<z.ZodString>;
+        validate_script: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        question: string;
+        key?: string | undefined;
+        changes?: {
+            path?: string | undefined;
+            action?: string | undefined;
+            class?: string | undefined;
+            tier?: string | undefined;
+        }[] | undefined;
+        from_version?: string | undefined;
+        instructions_md?: string | undefined;
+        overwrite?: boolean | undefined;
+        prompt?: string | undefined;
+        proposal_id?: string | undefined;
+        question?: string | undefined;
+        rationale?: string | undefined;
+        to_version?: string | undefined;
+        validate_script?: string | undefined;
     }, {
-        question: string;
+        key?: string | undefined;
+        changes?: {
+            path?: string | undefined;
+            action?: string | undefined;
+            class?: string | undefined;
+            tier?: string | undefined;
+        }[] | undefined;
+        from_version?: string | undefined;
+        instructions_md?: string | undefined;
+        overwrite?: boolean | undefined;
+        prompt?: string | undefined;
+        proposal_id?: string | undefined;
+        question?: string | undefined;
+        rationale?: string | undefined;
+        to_version?: string | undefined;
+        validate_script?: string | undefined;
     }>>;
     /** Answer or rejection reason; null before resolution. */
     resolution: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         answer: z.ZodOptional<z.ZodString>;
+        key: z.ZodOptional<z.ZodString>;
         reason: z.ZodOptional<z.ZodString>;
+        set: z.ZodOptional<z.ZodBoolean>;
+        status: z.ZodOptional<z.ZodString>;
+        to_version: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        key?: string | undefined;
+        status?: string | undefined;
+        set?: boolean | undefined;
+        to_version?: string | undefined;
         answer?: string | undefined;
         reason?: string | undefined;
     }, {
+        key?: string | undefined;
+        status?: string | undefined;
+        set?: boolean | undefined;
+        to_version?: string | undefined;
         answer?: string | undefined;
         reason?: string | undefined;
     }>>>;
@@ -21379,7 +22996,22 @@ export declare const agentRequestSchema: z.ZodObject<{
     } | undefined;
     status?: string | undefined;
     payload?: {
-        question: string;
+        key?: string | undefined;
+        changes?: {
+            path?: string | undefined;
+            action?: string | undefined;
+            class?: string | undefined;
+            tier?: string | undefined;
+        }[] | undefined;
+        from_version?: string | undefined;
+        instructions_md?: string | undefined;
+        overwrite?: boolean | undefined;
+        prompt?: string | undefined;
+        proposal_id?: string | undefined;
+        question?: string | undefined;
+        rationale?: string | undefined;
+        to_version?: string | undefined;
+        validate_script?: string | undefined;
     } | undefined;
     expires_at?: string | undefined;
     approvers?: {
@@ -21392,6 +23024,10 @@ export declare const agentRequestSchema: z.ZodObject<{
         thread_id?: string | null | undefined;
     } | undefined;
     resolution?: {
+        key?: string | undefined;
+        status?: string | undefined;
+        set?: boolean | undefined;
+        to_version?: string | undefined;
         answer?: string | undefined;
         reason?: string | undefined;
     } | null | undefined;
@@ -21410,7 +23046,22 @@ export declare const agentRequestSchema: z.ZodObject<{
     } | undefined;
     status?: string | undefined;
     payload?: {
-        question: string;
+        key?: string | undefined;
+        changes?: {
+            path?: string | undefined;
+            action?: string | undefined;
+            class?: string | undefined;
+            tier?: string | undefined;
+        }[] | undefined;
+        from_version?: string | undefined;
+        instructions_md?: string | undefined;
+        overwrite?: boolean | undefined;
+        prompt?: string | undefined;
+        proposal_id?: string | undefined;
+        question?: string | undefined;
+        rationale?: string | undefined;
+        to_version?: string | undefined;
+        validate_script?: string | undefined;
     } | undefined;
     expires_at?: string | undefined;
     approvers?: {
@@ -21423,6 +23074,10 @@ export declare const agentRequestSchema: z.ZodObject<{
         thread_id?: string | null | undefined;
     } | undefined;
     resolution?: {
+        key?: string | undefined;
+        status?: string | undefined;
+        set?: boolean | undefined;
+        to_version?: string | undefined;
         answer?: string | undefined;
         reason?: string | undefined;
     } | null | undefined;
@@ -21485,22 +23140,89 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
             session_id?: string | null | undefined;
             thread_id?: string | null | undefined;
         }>>;
-        /** Question request payload. */
+        /** Kind-safe request payload. */
         payload: z.ZodOptional<z.ZodObject<{
-            question: z.ZodString;
+            changes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                action: z.ZodOptional<z.ZodString>;
+                class: z.ZodOptional<z.ZodString>;
+                path: z.ZodOptional<z.ZodString>;
+                tier: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }, {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }>, "many">>;
+            from_version: z.ZodOptional<z.ZodString>;
+            instructions_md: z.ZodOptional<z.ZodString>;
+            key: z.ZodOptional<z.ZodString>;
+            overwrite: z.ZodOptional<z.ZodBoolean>;
+            prompt: z.ZodOptional<z.ZodString>;
+            proposal_id: z.ZodOptional<z.ZodString>;
+            question: z.ZodOptional<z.ZodString>;
+            rationale: z.ZodOptional<z.ZodString>;
+            to_version: z.ZodOptional<z.ZodString>;
+            validate_script: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            question: string;
+            key?: string | undefined;
+            changes?: {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }[] | undefined;
+            from_version?: string | undefined;
+            instructions_md?: string | undefined;
+            overwrite?: boolean | undefined;
+            prompt?: string | undefined;
+            proposal_id?: string | undefined;
+            question?: string | undefined;
+            rationale?: string | undefined;
+            to_version?: string | undefined;
+            validate_script?: string | undefined;
         }, {
-            question: string;
+            key?: string | undefined;
+            changes?: {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }[] | undefined;
+            from_version?: string | undefined;
+            instructions_md?: string | undefined;
+            overwrite?: boolean | undefined;
+            prompt?: string | undefined;
+            proposal_id?: string | undefined;
+            question?: string | undefined;
+            rationale?: string | undefined;
+            to_version?: string | undefined;
+            validate_script?: string | undefined;
         }>>;
         /** Answer or rejection reason; null before resolution. */
         resolution: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             answer: z.ZodOptional<z.ZodString>;
+            key: z.ZodOptional<z.ZodString>;
             reason: z.ZodOptional<z.ZodString>;
+            set: z.ZodOptional<z.ZodBoolean>;
+            status: z.ZodOptional<z.ZodString>;
+            to_version: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
+            key?: string | undefined;
+            status?: string | undefined;
+            set?: boolean | undefined;
+            to_version?: string | undefined;
             answer?: string | undefined;
             reason?: string | undefined;
         }, {
+            key?: string | undefined;
+            status?: string | undefined;
+            set?: boolean | undefined;
+            to_version?: string | undefined;
             answer?: string | undefined;
             reason?: string | undefined;
         }>>>;
@@ -21530,7 +23252,22 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
         } | undefined;
         status?: string | undefined;
         payload?: {
-            question: string;
+            key?: string | undefined;
+            changes?: {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }[] | undefined;
+            from_version?: string | undefined;
+            instructions_md?: string | undefined;
+            overwrite?: boolean | undefined;
+            prompt?: string | undefined;
+            proposal_id?: string | undefined;
+            question?: string | undefined;
+            rationale?: string | undefined;
+            to_version?: string | undefined;
+            validate_script?: string | undefined;
         } | undefined;
         expires_at?: string | undefined;
         approvers?: {
@@ -21543,6 +23280,10 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
             thread_id?: string | null | undefined;
         } | undefined;
         resolution?: {
+            key?: string | undefined;
+            status?: string | undefined;
+            set?: boolean | undefined;
+            to_version?: string | undefined;
             answer?: string | undefined;
             reason?: string | undefined;
         } | null | undefined;
@@ -21561,7 +23302,22 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
         } | undefined;
         status?: string | undefined;
         payload?: {
-            question: string;
+            key?: string | undefined;
+            changes?: {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }[] | undefined;
+            from_version?: string | undefined;
+            instructions_md?: string | undefined;
+            overwrite?: boolean | undefined;
+            prompt?: string | undefined;
+            proposal_id?: string | undefined;
+            question?: string | undefined;
+            rationale?: string | undefined;
+            to_version?: string | undefined;
+            validate_script?: string | undefined;
         } | undefined;
         expires_at?: string | undefined;
         approvers?: {
@@ -21574,6 +23330,10 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
             thread_id?: string | null | undefined;
         } | undefined;
         resolution?: {
+            key?: string | undefined;
+            status?: string | undefined;
+            set?: boolean | undefined;
+            to_version?: string | undefined;
             answer?: string | undefined;
             reason?: string | undefined;
         } | null | undefined;
@@ -21596,7 +23356,22 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
         } | undefined;
         status?: string | undefined;
         payload?: {
-            question: string;
+            key?: string | undefined;
+            changes?: {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }[] | undefined;
+            from_version?: string | undefined;
+            instructions_md?: string | undefined;
+            overwrite?: boolean | undefined;
+            prompt?: string | undefined;
+            proposal_id?: string | undefined;
+            question?: string | undefined;
+            rationale?: string | undefined;
+            to_version?: string | undefined;
+            validate_script?: string | undefined;
         } | undefined;
         expires_at?: string | undefined;
         approvers?: {
@@ -21609,6 +23384,10 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
             thread_id?: string | null | undefined;
         } | undefined;
         resolution?: {
+            key?: string | undefined;
+            status?: string | undefined;
+            set?: boolean | undefined;
+            to_version?: string | undefined;
             answer?: string | undefined;
             reason?: string | undefined;
         } | null | undefined;
@@ -21630,7 +23409,22 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
         } | undefined;
         status?: string | undefined;
         payload?: {
-            question: string;
+            key?: string | undefined;
+            changes?: {
+                path?: string | undefined;
+                action?: string | undefined;
+                class?: string | undefined;
+                tier?: string | undefined;
+            }[] | undefined;
+            from_version?: string | undefined;
+            instructions_md?: string | undefined;
+            overwrite?: boolean | undefined;
+            prompt?: string | undefined;
+            proposal_id?: string | undefined;
+            question?: string | undefined;
+            rationale?: string | undefined;
+            to_version?: string | undefined;
+            validate_script?: string | undefined;
         } | undefined;
         expires_at?: string | undefined;
         approvers?: {
@@ -21643,6 +23437,10 @@ export declare const agentRequestListResponseSchema: z.ZodObject<{
             thread_id?: string | null | undefined;
         } | undefined;
         resolution?: {
+            key?: string | undefined;
+            status?: string | undefined;
+            set?: boolean | undefined;
+            to_version?: string | undefined;
             answer?: string | undefined;
             reason?: string | undefined;
         } | null | undefined;
@@ -21727,6 +23525,40 @@ export declare const agentRoutineSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+        add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+        /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+        denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
         /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
         grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -21744,6 +23576,8 @@ export declare const agentRoutineSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+        preserve_denies: z.ZodOptional<z.ZodBoolean>;
         /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
         remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -21757,36 +23591,79 @@ export declare const agentRoutineSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: principals whose denies should be removed. */
+        remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }>>;
     /** ID of the agent that owns this routine (`agi_...`). */
     agent: z.ZodOptional<z.ZodString>;
@@ -21897,17 +23774,32 @@ export declare const agentRoutineSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
-        grants?: {
+        add_denies?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
-        remove?: {
+        denies?: {
+            actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
-    } | undefined;
-    last_applied_template_config?: string | undefined;
+        grants?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        preserve_denies?: boolean | undefined;
+        remove?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+    } | undefined;
+    last_applied_template_config?: string | undefined;
     config?: string | undefined;
     event_config?: Record<string, {} | null> | undefined;
     event_type?: string | undefined;
@@ -21948,15 +23840,30 @@ export declare const agentRoutineSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | undefined;
     last_applied_template_config?: string | undefined;
     config?: string | undefined;
@@ -22010,6 +23917,40 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -22027,6 +23968,8 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -22040,36 +23983,79 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>;
         /** ID of the agent that owns this routine (`agi_...`). */
         agent: z.ZodOptional<z.ZodString>;
@@ -22180,15 +24166,30 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         last_applied_template_config?: string | undefined;
         config?: string | undefined;
@@ -22231,15 +24232,30 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         last_applied_template_config?: string | undefined;
         config?: string | undefined;
@@ -22284,15 +24300,30 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         last_applied_template_config?: string | undefined;
         config?: string | undefined;
@@ -22337,15 +24368,30 @@ export declare const agentRoutineListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         last_applied_template_config?: string | undefined;
         config?: string | undefined;
@@ -22480,6 +24526,40 @@ export declare const agentRoutineRunSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+        add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
+        /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+        denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+            actions: z.ZodArray<z.ZodString, "many">;
+            /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
         /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
         grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -22497,6 +24577,8 @@ export declare const agentRoutineRunSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+        preserve_denies: z.ZodOptional<z.ZodBoolean>;
         /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
         remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
             /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -22510,36 +24592,79 @@ export declare const agentRoutineRunSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }>, "many">>;
+        /** Patch mode: principals whose denies should be removed. */
+        remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+            principal: z.ZodOptional<z.ZodString>;
+            /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+            principal_type: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            principal_type: string;
+            principal?: string | undefined;
+        }, {
+            principal_type: string;
+            principal?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }, {
         add?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     }>>;
     /** ID of the agent that owns the parent routine (`agi_...`). */
     agent: z.ZodOptional<z.ZodString>;
@@ -22637,15 +24762,30 @@ export declare const agentRoutineRunSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | undefined;
     duration_ms?: number | undefined;
     delivery?: {
@@ -22682,15 +24822,30 @@ export declare const agentRoutineRunSchema: z.ZodObject<{
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        add_denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
+        denies?: {
+            actions: string[];
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
         grants?: {
             actions: string[];
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        preserve_denies?: boolean | undefined;
         remove?: {
             principal_type: string;
             principal?: string | undefined;
         }[] | undefined;
+        remove_denies?: {
+            principal_type: string;
+            principal?: string | undefined;
+        }[] | undefined;
     } | undefined;
     duration_ms?: number | undefined;
     delivery?: {
@@ -22746,6 +24901,40 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -22763,6 +24952,8 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -22776,36 +24967,79 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>;
         /** ID of the agent that owns the parent routine (`agi_...`). */
         agent: z.ZodOptional<z.ZodString>;
@@ -22903,15 +25137,30 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         duration_ms?: number | undefined;
         delivery?: {
@@ -22948,15 +25197,30 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         duration_ms?: number | undefined;
         delivery?: {
@@ -22995,15 +25259,30 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         duration_ms?: number | undefined;
         delivery?: {
@@ -23044,15 +25323,30 @@ export declare const agentRoutineRunListResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | undefined;
         duration_ms?: number | undefined;
         delivery?: {
@@ -24005,7 +26299,7 @@ export interface AgentUpgradeChange {
     parent_template_config: UpgradeTemplateSummary;
     /** Resource-type-specific identity details. Tools: `tool_type`, `builtin_tool_key`, `name_prefix`, `handler_type`, `instruction`. Routines: `handler_type`, `preset_name`, `event_type`, `schedule`, `trigger_context`. Skills: `instruction`. Computers: `region`. Knowledge: `mode`, `knowledge_key`, `extraction_output_ref`. Only populated keys are present; `null` when nothing is known. */
     resource?: Record<string, unknown> | undefined;
-    /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, or `"knowledge"`. */
+    /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, `"endpoint"`, or `"knowledge"`. */
     resource_type: string;
     /** Summary of the specific child template config (`cfg_...`) that defines this resource. `null` when no source template is resolvable. */
     source_template_config?: UpgradeTemplateSummary | undefined;
@@ -24090,7 +26384,7 @@ export declare const agentUpgradeChangeSchema: z.ZodObject<{
     }>;
     /** Resource-type-specific identity details. Tools: `tool_type`, `builtin_tool_key`, `name_prefix`, `handler_type`, `instruction`. Routines: `handler_type`, `preset_name`, `event_type`, `schedule`, `trigger_context`. Skills: `instruction`. Computers: `region`. Knowledge: `mode`, `knowledge_key`, `extraction_output_ref`. Only populated keys are present; `null` when nothing is known. */
     resource: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
-    /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, or `"knowledge"`. */
+    /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, `"endpoint"`, or `"knowledge"`. */
     resource_type: z.ZodString;
     /** Summary of the specific child template config (`cfg_...`) that defines this resource. `null` when no source template is resolvable. */
     source_template_config: z.ZodOptional<z.ZodObject<{
@@ -24337,7 +26631,7 @@ export declare const agentUpgradeResultSchema: z.ZodObject<{
         }>;
         /** Resource-type-specific identity details. Tools: `tool_type`, `builtin_tool_key`, `name_prefix`, `handler_type`, `instruction`. Routines: `handler_type`, `preset_name`, `event_type`, `schedule`, `trigger_context`. Skills: `instruction`. Computers: `region`. Knowledge: `mode`, `knowledge_key`, `extraction_output_ref`. Only populated keys are present; `null` when nothing is known. */
         resource: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
-        /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, or `"knowledge"`. */
+        /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, `"endpoint"`, or `"knowledge"`. */
         resource_type: z.ZodString;
         /** Summary of the specific child template config (`cfg_...`) that defines this resource. `null` when no source template is resolvable. */
         source_template_config: z.ZodOptional<z.ZodObject<{
@@ -24487,12 +26781,6 @@ export declare const agentUpgradeResultSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     status: string;
     mode: string;
-    summary: {
-        adds: number;
-        noops: number;
-        removes: number;
-        updates: number;
-    };
     changes: {
         action: string;
         parent_template_config: {
@@ -24531,17 +26819,17 @@ export declare const agentUpgradeResultSchema: z.ZodObject<{
             display_name?: string | null | undefined;
         } | undefined;
     }[];
-    dry_run: boolean;
-    review_fingerprint?: string | undefined;
-}, {
-    status: string;
-    mode: string;
     summary: {
         adds: number;
         noops: number;
         removes: number;
         updates: number;
     };
+    dry_run: boolean;
+    review_fingerprint?: string | undefined;
+}, {
+    status: string;
+    mode: string;
     changes: {
         action: string;
         parent_template_config: {
@@ -24580,6 +26868,12 @@ export declare const agentUpgradeResultSchema: z.ZodObject<{
             display_name?: string | null | undefined;
         } | undefined;
     }[];
+    summary: {
+        adds: number;
+        noops: number;
+        removes: number;
+        updates: number;
+    };
     dry_run: boolean;
     review_fingerprint?: string | undefined;
 }>;
@@ -24617,6 +26911,40 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: denies to add or merge, replacing any grant for the same principal. */
+            add_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
+            /** Replace mode: the complete deny list. Supplying grants or denies replaces both lists. Requires schema deny support. */
+            denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
+                actions: z.ZodArray<z.ZodString, "many">;
+                /** The identifier of the principal. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`; omit entirely when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal receiving the grant. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
             /** Replace mode: the complete new list of grants that replaces all existing entries. Send an empty array (`[]`) to clear all grants. Cannot be combined with `add` or `remove`. */
             grants: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** Array of action strings the principal is permitted to perform, e.g. `["read", "write"]`. Must contain at least one entry. */
@@ -24634,6 +26962,8 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Retain current server denies atomically in replacement or patch mode; current denies win. */
+            preserve_denies: z.ZodOptional<z.ZodBoolean>;
             /** Patch mode: principals whose grants should be removed from the existing list. Cannot be combined with `grants`. */
             remove: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
@@ -24647,36 +26977,79 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }>, "many">>;
+            /** Patch mode: principals whose denies should be removed. */
+            remove_denies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                /** The identifier of the principal to remove. A string ID for `"user"`, `"team"`, `"org"`, and `"agent"` types; one of `"admin"`, `"member"`, or `"viewer"` for `"org_role"`. Omit when `principal_type` is `"everyone"`. */
+                principal: z.ZodOptional<z.ZodString>;
+                /** The kind of principal to remove. One of `"user"`, `"team"`, `"org"`, `"org_role"`, `"agent"`, or `"everyone"`. */
+                principal_type: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                principal_type: string;
+                principal?: string | undefined;
+            }, {
+                principal_type: string;
+                principal?: string | undefined;
+            }>, "many">>;
         }, "strip", z.ZodTypeAny, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }, {
             add?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         }>>>;
         /** ID of the application that owns this agent (`dap_...`). */
         app: z.ZodOptional<z.ZodString>;
@@ -25811,15 +28184,30 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -25989,15 +28377,30 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -26644,7 +29047,7 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
             }>;
             /** Resource-type-specific identity details. Tools: `tool_type`, `builtin_tool_key`, `name_prefix`, `handler_type`, `instruction`. Routines: `handler_type`, `preset_name`, `event_type`, `schedule`, `trigger_context`. Skills: `instruction`. Computers: `region`. Knowledge: `mode`, `knowledge_key`, `extraction_output_ref`. Only populated keys are present; `null` when nothing is known. */
             resource: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<{} | null, z.ZodTypeDef, {} | null>>>;
-            /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, or `"knowledge"`. */
+            /** Type of the resource being changed. One of `"agent"`, `"tool"`, `"routine"`, `"skill"`, `"computer"`, `"endpoint"`, or `"knowledge"`. */
             resource_type: z.ZodString;
             /** Summary of the specific child template config (`cfg_...`) that defines this resource. `null` when no source template is resolvable. */
             source_template_config: z.ZodOptional<z.ZodObject<{
@@ -26794,12 +29197,6 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         status: string;
         mode: string;
-        summary: {
-            adds: number;
-            noops: number;
-            removes: number;
-            updates: number;
-        };
         changes: {
             action: string;
             parent_template_config: {
@@ -26838,17 +29235,17 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 display_name?: string | null | undefined;
             } | undefined;
         }[];
-        dry_run: boolean;
-        review_fingerprint?: string | undefined;
-    }, {
-        status: string;
-        mode: string;
         summary: {
             adds: number;
             noops: number;
             removes: number;
             updates: number;
         };
+        dry_run: boolean;
+        review_fingerprint?: string | undefined;
+    }, {
+        status: string;
+        mode: string;
         changes: {
             action: string;
             parent_template_config: {
@@ -26887,6 +29284,12 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 display_name?: string | null | undefined;
             } | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            removes: number;
+            updates: number;
+        };
         dry_run: boolean;
         review_fingerprint?: string | undefined;
     }>;
@@ -26969,12 +29372,6 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
     upgrade_result: {
         status: string;
         mode: string;
-        summary: {
-            adds: number;
-            noops: number;
-            removes: number;
-            updates: number;
-        };
         changes: {
             action: string;
             parent_template_config: {
@@ -27013,6 +29410,12 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 display_name?: string | null | undefined;
             } | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            removes: number;
+            updates: number;
+        };
         dry_run: boolean;
         review_fingerprint?: string | undefined;
     };
@@ -27037,15 +29440,30 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -27274,12 +29692,6 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
     upgrade_result: {
         status: string;
         mode: string;
-        summary: {
-            adds: number;
-            noops: number;
-            removes: number;
-            updates: number;
-        };
         changes: {
             action: string;
             parent_template_config: {
@@ -27318,6 +29730,12 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 display_name?: string | null | undefined;
             } | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            removes: number;
+            updates: number;
+        };
         dry_run: boolean;
         review_fingerprint?: string | undefined;
     };
@@ -27342,15 +29760,30 @@ export declare const agentUpgradeResponseSchema: z.ZodObject<{
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            add_denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
+            denies?: {
+                actions: string[];
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
             grants?: {
                 actions: string[];
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            preserve_denies?: boolean | undefined;
             remove?: {
                 principal_type: string;
                 principal?: string | undefined;
             }[] | undefined;
+            remove_denies?: {
+                principal_type: string;
+                principal?: string | undefined;
+            }[] | undefined;
         } | null | undefined;
         default_model?: string | null | undefined;
         identity?: string | null | undefined;
@@ -29939,14 +32372,6 @@ export declare const solutionUpgradeResultSchema: z.ZodObject<{
     version_change: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     status: string;
-    summary: {
-        adds: number;
-        noops: number;
-        updates: number;
-        deletes: number;
-        orphans: number;
-        referenced_orphans: number;
-    };
     changes: {
         key: string;
         action: string;
@@ -29965,6 +32390,14 @@ export declare const solutionUpgradeResultSchema: z.ZodObject<{
             lookup_key?: string | undefined;
         }[] | undefined;
     }[];
+    summary: {
+        adds: number;
+        noops: number;
+        updates: number;
+        deletes: number;
+        orphans: number;
+        referenced_orphans: number;
+    };
     dry_run: boolean;
     version_change: string;
     message?: string | undefined;
@@ -29974,14 +32407,6 @@ export declare const solutionUpgradeResultSchema: z.ZodObject<{
     incoming_solution_version?: string | undefined;
 }, {
     status: string;
-    summary: {
-        adds: number;
-        noops: number;
-        updates: number;
-        deletes: number;
-        orphans: number;
-        referenced_orphans: number;
-    };
     changes: {
         key: string;
         action: string;
@@ -30000,6 +32425,14 @@ export declare const solutionUpgradeResultSchema: z.ZodObject<{
             lookup_key?: string | undefined;
         }[] | undefined;
     }[];
+    summary: {
+        adds: number;
+        noops: number;
+        updates: number;
+        deletes: number;
+        orphans: number;
+        referenced_orphans: number;
+    };
     dry_run: boolean;
     version_change: string;
     message?: string | undefined;
@@ -30563,14 +32996,6 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
         version_change: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         status: string;
-        summary: {
-            adds: number;
-            noops: number;
-            updates: number;
-            deletes: number;
-            orphans: number;
-            referenced_orphans: number;
-        };
         changes: {
             key: string;
             action: string;
@@ -30589,6 +33014,14 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
                 lookup_key?: string | undefined;
             }[] | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            updates: number;
+            deletes: number;
+            orphans: number;
+            referenced_orphans: number;
+        };
         dry_run: boolean;
         version_change: string;
         message?: string | undefined;
@@ -30598,14 +33031,6 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
         incoming_solution_version?: string | undefined;
     }, {
         status: string;
-        summary: {
-            adds: number;
-            noops: number;
-            updates: number;
-            deletes: number;
-            orphans: number;
-            referenced_orphans: number;
-        };
         changes: {
             key: string;
             action: string;
@@ -30624,6 +33049,14 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
                 lookup_key?: string | undefined;
             }[] | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            updates: number;
+            deletes: number;
+            orphans: number;
+            referenced_orphans: number;
+        };
         dry_run: boolean;
         version_change: string;
         message?: string | undefined;
@@ -30703,14 +33136,6 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
     };
     upgrade_result: {
         status: string;
-        summary: {
-            adds: number;
-            noops: number;
-            updates: number;
-            deletes: number;
-            orphans: number;
-            referenced_orphans: number;
-        };
         changes: {
             key: string;
             action: string;
@@ -30729,6 +33154,14 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
                 lookup_key?: string | undefined;
             }[] | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            updates: number;
+            deletes: number;
+            orphans: number;
+            referenced_orphans: number;
+        };
         dry_run: boolean;
         version_change: string;
         message?: string | undefined;
@@ -30816,14 +33249,6 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
     };
     upgrade_result: {
         status: string;
-        summary: {
-            adds: number;
-            noops: number;
-            updates: number;
-            deletes: number;
-            orphans: number;
-            referenced_orphans: number;
-        };
         changes: {
             key: string;
             action: string;
@@ -30842,6 +33267,14 @@ export declare const solutionUpgradeResponseSchema: z.ZodObject<{
                 lookup_key?: string | undefined;
             }[] | undefined;
         }[];
+        summary: {
+            adds: number;
+            noops: number;
+            updates: number;
+            deletes: number;
+            orphans: number;
+            referenced_orphans: number;
+        };
         dry_run: boolean;
         version_change: string;
         message?: string | undefined;