@deepraxis/cli 0.1.0-dev.98b03cc → 0.1.0-dev.a3beed2

package/dist/praxis.js

@@ -10,7 +10,7 @@ var operations = [
   {
     resource: "agent.agents",
     method: "list",
-    summary: "",
+    summary: "List agents",
     description: "List the agents of the workspace behind your API key, newest first, in pages of at most 100 (default 20). Use it to find an agent id before creating a session; to read one agent use agents.retrieve, to see its history use agents.versions.list. Archived agents are hidden unless include_archived is true. Filter kind=personal for durable-computer agents or kind=service for per-session environments. Pass next_page from the response as page to read the next page; a null next_page means the end.",
     http: "GET",
     path: "/agent/v1/agents",
@@ -67,8 +67,8 @@ var operations = [
   {
     resource: "agent.agents",
     method: "create",
-    summary: "",
-    description: 'Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. Unlike Anthropic Managed Agents, nonempty skills attachments and custom tool entries return 400; the native skill tool is separate from the skills field. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.',
+    summary: "Create agent",
+    description: 'Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; the native skill tool is separate from the skills field. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.',
     http: "POST",
     path: "/agent/v1/agents",
     streaming: "no",
@@ -101,7 +101,7 @@ var operations = [
           type: "array",
           itemType: "object",
           required: false,
-          description: "MCP servers this agent connects to. Maximum 20. Names must be unique\nwithin the array. Every server must be referenced by an `mcp_toolset` in\n`tools`; unreferenced servers are rejected. See the\n[MCP connector guide](https://platform.claude.com/docs/en/managed-agents/mcp-connector)."
+          description: "Praxis extension: HTTP, SSE or trusted stdio MCP servers paired with mcp_toolset entries and saved with the agent version."
         },
         {
           name: "metadata",
@@ -136,6 +136,27 @@ var operations = [
           description: `Tool configurations available to the agent. Maximum of 128 tools
 across all toolsets allowed.`
         },
+        {
+          name: "databases",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings."
+        },
+        {
+          name: "vector_stores",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings."
+        },
+        {
+          name: "files",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings."
+        },
         {
           name: "kind",
           type: "string",
@@ -183,6 +204,17 @@ across all toolsets allowed.`
           type: "object",
           required: false,
           description: "Praxis extension: switchable model ids on /agent/v1 only. The default model must be included. When omitted, only the default model is selectable."
+        },
+        {
+          name: "preset",
+          type: "string",
+          enum: [
+            "minimal",
+            "data-editor",
+            "full"
+          ],
+          required: false,
+          description: "Optional tool preset. minimal enables read, glob, grep and ask_user_question; data-editor also enables write and edit; full uses the default toolset with always_allow. Explicit tools override matching preset entries. codemode requires bash and is absent from data-editor."
         }
       ]
     }
@@ -190,7 +222,7 @@ across all toolsets allowed.`
   {
     resource: "agent.agents",
     method: "retrieve",
-    summary: "",
+    summary: "Get agent",
     description: "Read one agent by id, at its latest version or, with version, at a specific earlier version. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so it can be sent back unchanged to agents.update. Use agents.versions.list to enumerate versions.",
     http: "GET",
     path: "/agent/v1/agents/{agent_id}",
@@ -214,8 +246,8 @@ across all toolsets allowed.`
   {
     resource: "agent.agents",
     method: "update",
-    summary: "",
-    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version; existing sessions keep the version they were created with. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. Unlike Anthropic Managed Agents, nonempty skills attachments and custom tools return 400; use the native skill tool for available runtime skills.",
+    summary: "Update agent",
+    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version; existing sessions keep the version they were created with. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; use the native skill tool for available runtime skills.",
     http: "POST",
     path: "/agent/v1/agents/{agent_id}",
     streaming: "no",
@@ -241,7 +273,7 @@ across all toolsets allowed.`
           type: "array",
           itemType: "object",
           required: false,
-          description: "MCP servers. Full replacement. Omit to preserve; send empty array or\n`null` to clear. Names must be unique. Maximum 20. Every server must be\nreferenced by an `mcp_toolset` in the agent's resulting `tools`; unreferenced\nservers are rejected. See the\n[MCP connector guide](https://platform.claude.com/docs/en/managed-agents/mcp-connector)."
+          description: "Praxis extension: HTTP, SSE or trusted stdio MCP servers paired with mcp_toolset entries and saved with the agent version."
         },
         {
           name: "metadata",
@@ -301,6 +333,27 @@ Obtain this value from a create or retrieve response. Must be at least 1 if
 specified. When supplied, the request fails if it does not match the server's
 current version; omit to apply the update unconditionally.`
         },
+        {
+          name: "databases",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings."
+        },
+        {
+          name: "vector_stores",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings."
+        },
+        {
+          name: "files",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings."
+        },
         {
           name: "kind",
           type: "string",
@@ -348,6 +401,17 @@ current version; omit to apply the update unconditionally.`
           type: "object",
           required: false,
           description: "Praxis extension: switchable model ids on /agent/v1 only. The default model must be included. When omitted, only the default model is selectable."
+        },
+        {
+          name: "preset",
+          type: "string",
+          enum: [
+            "minimal",
+            "data-editor",
+            "full"
+          ],
+          required: false,
+          description: "Optional tool preset. minimal enables read, glob, grep and ask_user_question; data-editor also enables write and edit; full uses the default toolset with always_allow. Explicit tools override matching preset entries. codemode requires bash and is absent from data-editor."
         }
       ]
     }
@@ -355,7 +419,7 @@ current version; omit to apply the update unconditionally.`
   {
     resource: "agent.agents",
     method: "archive",
-    summary: "",
+    summary: "Archive agent",
     description: "Archive an agent so it can no longer be updated and no new session can be created from it (AGENT_ARCHIVED). The agent and all of its versions stay readable. Use it to retire an agent you no longer want to run; it does not delete anything.",
     http: "POST",
     path: "/agent/v1/agents/{agent_id}/archive",
@@ -369,10 +433,210 @@ current version; omit to apply the update unconditionally.`
     ],
     query: []
   },
+  {
+    resource: "agent.agents.endUsers",
+    method: "list",
+    summary: "List End Users",
+    description: `List users who have sessions or token issuance history on a service agent.
+
+Ordered by last_active_at and external_user_id descending. q is a case-sensitive literal prefix, including underscores. limit is 1–100, default 20. Reuse next_page with the same organization, agent, q and limit. Preemptively blocked users without history do not appear. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "GET",
+    path: "/agent/v1/agents/{agent_id}/end_users",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: [
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Maximum users per page; defaults to 20."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "next_page from the previous response with the same agent, q and limit."
+      },
+      {
+        name: "q",
+        type: "string",
+        required: false,
+        description: "Case-sensitive literal prefix of external_user_id; omit or use an empty string for all users."
+      }
+    ]
+  },
+  {
+    resource: "agent.agents.endUsers",
+    method: "delete",
+    summary: "Delete end-user data",
+    description: `Delete a host application's end-user data from one service agent after explicit confirmation.
+
+Develop only. Set confirm to the exact external_user_id; missing or mismatched confirmation returns 400. Returns 202 with a pending task id, not completion. Poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the user is blocked before a seven-day recovery snapshot is verified. Sessions including child sessions, conversation data, grants and feedback are then removed. A pre-existing block remains; a temporary block is removed on success. Attachment metadata is recorded and File attachments are retained. No charge is introduced by this operation. Example: DELETE /agent/v1/agents/agent_example/end_users/customer_123?confirm=customer_123.`,
+    http: "DELETE",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: [
+      {
+        name: "confirm",
+        type: "string",
+        required: true,
+        description: "Must exactly equal the external_user_id path parameter to confirm destructive deletion."
+      }
+    ]
+  },
+  {
+    resource: "agent.agents.endUsers",
+    method: "retrieve",
+    summary: "Get End User",
+    description: `Inspect one end user and their twenty most recently updated sessions.
+
+Use external_user_id from listing or your host application. Users without session or issuance history return 404, including preemptively blocked users. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "GET",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers.block",
+    method: "create",
+    summary: "Block End User",
+    description: `Block token issuance and session creation, then revoke existing tokens for an end user.
+
+May block a user before any history exists; timestamps are then null and counts and cost are zero. Requires an embed policy, otherwise returns 409 with setup guidance. Deduplicates the policy blocklist and retains its 1000-user maximum. If revocation returns 502, the user remains blocked; retry to finish revocation. Repeats keep the user blocked and revoke any remaining grants. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers",
+    method: "retrieveDeletion",
+    summary: "Get end-user deletion",
+    description: `Poll the latest deletion task for an end user, including after the user data has been removed.
+
+Use the same agent_id and external_user_id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. A failed task remains blocked and resumes when DELETE is retried with matching confirmation. snapshot_key is an operator recovery reference retained for seven days, not a public download URL. End-user credentials, inaccessible or personal agents, and missing tasks return 404. This read does not create a task or charge usage.`,
+    http: "GET",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers.revokeTokens",
+    method: "create",
+    summary: "Revoke End User Tokens",
+    description: `Revoke all issued tokens for an end user and terminate their open embed streams.
+
+Revokes credentials before marking grants revoked. Upstream failure returns 502 without changing grant revocation timestamps. Returns the count of newly revoked grants; a repeat without new grants returns zero. Does not block future issuance. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers.unblock",
+    method: "create",
+    summary: "Unblock End User",
+    description: `Allow an end user to receive new tokens and create new sessions again.
+
+Removes the user from the blocklist; previously revoked tokens stay revoked. Idempotent. Requires an embed policy, otherwise returns 409 with setup guidance. Returns null timestamps and zero counts and cost when no session or issuance history exists. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.unarchive",
+    method: "create",
+    summary: "Unarchive Agent",
+    description: "Restore an archived agent without creating a configuration version. Already active agents are unchanged. Missing or inaccessible agents return 404. Use the returned agent id to create new sessions.",
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/unarchive",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.agents.versions",
     method: "list",
-    summary: "",
+    summary: "List agent versions",
     description: "List the saved versions of one agent, in pages of at most 100 (default 20). Each item is the full agent definition at that version, so you can compare what changed between versions. Use agents.retrieve with version to read a single one; agent_id comes from agents.list or agents.create.",
     http: "GET",
     path: "/agent/v1/agents/{agent_id}/versions",
@@ -580,7 +844,9 @@ Own-face superset: Managed Agents has no persistent Computer attachment director
     summary: "Connect computer",
     description: `Resume the computer and issue a sandbox connection.
 
-Own-face extension: Managed Agents has no persistent Computer connection. Returns the public SDK sandbox_id, envd_access_token and template_id. Archived computers remain accessible; foreign or absent computers return 404. Never cache credentials.`,
+Own-face extension: Managed Agents has no persistent Computer connection. Returns the public SDK sandbox_id, envd_access_token and template_id, plus the machine tier the computer is on now (light or heavy) and the lease that keeps it there (lease_id, lease_expires_at; lease_id is null when no lease exists). Keep the lease while the connection stays open: renew it about every 20 seconds (POST .../leases/{lease_id}/renew) and release it on close (DELETE .../leases/{lease_id}). An unrenewed lease simply expires, and the full machine is reclaimed only after that. Archived computers remain accessible; foreign or absent computers return 404. Never cache credentials.
+
+Connect to a computer with a caller-held lease. Omit the body or send {} to request light: the lightweight shell, or the heavy instance while it is running. Send {"need":"heavy"} to request full Linux for interactive programs; files are synchronized before the heavy connection is returned with tier heavy. Renew the lease while using the connection and release it with DELETE when finished.`,
     http: "POST",
     path: "/agent/v1/computers/{computer_id}/connect",
     streaming: "no",
@@ -591,7 +857,22 @@ Own-face extension: Managed Agents has no persistent Computer connection. Return
         sdkName: "computer_id"
       }
     ],
-    query: []
+    query: [],
+    body: {
+      required: false,
+      fields: [
+        {
+          name: "need",
+          type: "string",
+          enum: [
+            "light",
+            "heavy"
+          ],
+          required: false,
+          description: "Defaults to light. light uses the lightweight shell, or the heavy instance while it is running. heavy requests a full Linux computer for interactive programs; heavy running time counts toward the daily budget in seconds."
+        }
+      ]
+    }
   },
   {
     resource: "agent.computers.files",
@@ -645,10 +926,56 @@ Praxis extension: MA only has session-scoped temporary containers and memory_sto
       }
     ]
   },
+  {
+    resource: "agent.computers.leases",
+    method: "delete",
+    summary: "Release computer lease",
+    description: `Give the lease back when a connection closes so the full machine can be reclaimed without waiting for it to expire.
+
+Own-face extension. Idempotent: an unknown or already released lease succeeds as well. Foreign or absent computers return 404.`,
+    http: "DELETE",
+    path: "/agent/v1/computers/{computer_id}/leases/{lease_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "computer_id",
+        sdkName: "computer_id"
+      },
+      {
+        name: "lease_id",
+        sdkName: "lease_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.computers.leases.renew",
+    method: "create",
+    summary: "Renew computer lease",
+    description: `Extend the lease a connection holds so the full machine stays in service while the connection is open.
+
+Own-face extension. A lease that is no longer valid (released, expired, or the computer moved to another machine) returns 409 LEASE_STALE; call connect again for a new connection and lease. Foreign or absent computers return 404.`,
+    http: "POST",
+    path: "/agent/v1/computers/{computer_id}/leases/{lease_id}/renew",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "computer_id",
+        sdkName: "computer_id"
+      },
+      {
+        name: "lease_id",
+        sdkName: "lease_id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.deploymentRuns",
     method: "list",
-    summary: "",
+    summary: "List deployment runs",
     description: "List deployment runs newest first. Filter by deployment_id, has_error, trigger_type (manual or schedule) and created_at[gt|gte|lt|lte]. The default limit is 20, maximum 100; pass next_page as page with the same filters to continue. Each record identifies the resolved agent version and either its session or creation error.",
     http: "GET",
     path: "/agent/v1/deployment_runs",
@@ -723,7 +1050,7 @@ Praxis extension: MA only has session-scoped temporary containers and memory_sto
   {
     resource: "agent.deploymentRuns",
     method: "retrieve",
-    summary: "",
+    summary: "Get deployment run",
     description: "Read a deployment run by the drun_ id returned by deployments.run or deployment_runs.list. Exactly one of session_id and error is non-null. Scheduled runs include scheduled_at in trigger_context. Foreign or absent ids return 404.",
     http: "GET",
     path: "/agent/v1/deployment_runs/{deployment_run_id}",
@@ -740,7 +1067,7 @@ Praxis extension: MA only has session-scoped temporary containers and memory_sto
   {
     resource: "agent.deployments",
     method: "list",
-    summary: "",
+    summary: "List deployments",
     description: "List stored deployments newest first. Filter by agent_id, status, or inclusive created_at bounds; status and include_archived cannot be combined, even when include_archived is false. The default limit is 20, maximum 100; pass next_page as page to continue. Archived deployments are hidden by default. Schedules show up to five future wall-clock occurrences, also while paused; archived schedules show none.",
     http: "GET",
     path: "/agent/v1/deployments",
@@ -804,8 +1131,8 @@ archived).`
   {
     resource: "agent.deployments",
     method: "create",
-    summary: "",
-    description: "Freeze session parameters as a deployment; this operation does not open a session. Pass an agent id or versioned reference, a name, 1–50 user.message initial events and an environment_id from environments.list. Unlike Anthropic Managed Agents, /agent/v1 also accepts agent_with_overrides (model, permission_mode and cwd) and target=computer for personal agents, with environment_id omitted. Cron schedules use five POSIX fields and an IANA timezone. File resources and empty vault_ids are accepted. Active schedules run every minute when due; session creation errors pause the deployment. Unsupported tools, mcp_servers, system and skills overrides return 400.",
+    summary: "Create deployment",
+    description: "Freeze session parameters as a deployment; this operation does not open a session. Pass an agent id or versioned reference, a name, 1–50 user.message initial events and an environment_id from environments.list. Unlike Anthropic Managed Agents, /agent/v1 also accepts agent_with_overrides (model, permission_mode and cwd) and target=computer for personal agents, with environment_id omitted. Cron schedules use five POSIX fields and an IANA timezone. File resources are accepted. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Active schedules run every minute when due; session creation errors pause the deployment. Unsupported tools, mcp_servers, system and skills overrides return 400.",
     http: "POST",
     path: "/agent/v1/deployments",
     streaming: "no",
@@ -894,7 +1221,7 @@ created from this deployment. Maximum 50.`
   {
     resource: "agent.deployments",
     method: "retrieve",
-    summary: "",
+    summary: "Get deployment",
     description: "Read a stored deployment by its depl_ id from deployments.create or deployments.list. The agent reference has a concrete version; own-face overrides are echoed unchanged. This read recomputes upcoming schedule times and does not execute the deployment. Foreign or absent ids return 404.",
     http: "GET",
     path: "/agent/v1/deployments/{deployment_id}",
@@ -911,7 +1238,7 @@ created from this deployment. Maximum 50.`
   {
     resource: "agent.deployments",
     method: "update",
-    summary: "",
+    summary: "Update deployment",
     description: "Partially update a deployment. Omitted fields keep their values; a supplied agent id re-pins the latest version, or supply a versioned reference. Metadata merges string values and deletes keys set to null. Null clears schedule, resources and description; name, environment_id and initial_events cannot be cleared. Archived deployments return 409. Overrides apply to new sessions; updating a schedule recalculates its next occurrence.",
     http: "POST",
     path: "/agent/v1/deployments/{deployment_id}",
@@ -1009,7 +1336,7 @@ null to clear. Maximum 50.`
   {
     resource: "agent.deployments",
     method: "archive",
-    summary: "",
+    summary: "Archive deployment",
     description: "Archive a deployment by its depl_ id. Repeated calls are idempotent; archived deployments remain readable and have no upcoming schedule times. Subsequent update, pause and unpause calls return 409. This operation does not create a deployment run.",
     http: "POST",
     path: "/agent/v1/deployments/{deployment_id}/archive",
@@ -1026,7 +1353,7 @@ null to clear. Maximum 50.`
   {
     resource: "agent.deployments",
     method: "pause",
-    summary: "",
+    summary: "Pause deployment",
     description: "Pause an active deployment and set paused_reason to {type: manual}. Repeated pause calls are idempotent; archived deployments return 409. Upcoming schedule times remain visible while paused; no run is executed.",
     http: "POST",
     path: "/agent/v1/deployments/{deployment_id}/pause",
@@ -1043,7 +1370,7 @@ null to clear. Maximum 50.`
   {
     resource: "agent.deployments.run",
     method: "create",
-    summary: "",
+    summary: "Run deployment",
     description: "Create one session from an active deployment using its pinned agent version and stored parameters. Pass the depl_ id from deployments.create or deployments.list; no request body is needed. Returns a drun_ record with exactly one of session_id or error populated. Creation errors automatically pause the deployment; paused or archived deployments return 409 without a run. Unlike the own face, the compatible face rejects computer targets with 400.",
     http: "POST",
     path: "/agent/v1/deployments/{deployment_id}/run",
@@ -1058,21 +1385,97 @@ null to clear. Maximum 50.`
     query: []
   },
   {
-    resource: "agent.deployments.unpause",
-    method: "create",
-    summary: "",
-    description: "Resume a paused deployment and clear paused_reason. Repeated unpause calls on an active deployment are idempotent; archived deployments return 409. This operation changes resource state only and does not execute a run.",
-    http: "POST",
-    path: "/agent/v1/deployments/{deployment_id}/unpause",
+    resource: "agent.deployments.unpause",
+    method: "create",
+    summary: "Unpause deployment",
+    description: "Resume a paused deployment and clear paused_reason. Repeated unpause calls on an active deployment are idempotent; archived deployments return 409. This operation changes resource state only and does not execute a run.",
+    http: "POST",
+    path: "/agent/v1/deployments/{deployment_id}/unpause",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "deployment_id",
+        sdkName: "deployment_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.embed",
+    method: "retrieveAppearance",
+    summary: "Read chat appearance",
+    description: "Load saved appearance for an iframe or Hosted chat page. Supply an end-user embed token as Bearer authorization, or a console-issued publishable key in Praxis-Publishable-Key before anonymous token issuance. The credential selects the agent; identity_number and agent_id query parameters are rejected with 400. Missing appearance returns an empty object. Kit option names retain camelCase. Responses are private and cacheable for 60 seconds. Component hosts configure Kit in their own code instead.",
+    http: "GET",
+    path: "/agent/v1/embed/appearance",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "agent.embed.exchange",
+    method: "create",
+    summary: "Exchange Hosted Code",
+    description: `Redeem a single-use hosted link credential for an end-user token.
+
+Read code from the c fragment parameter of hosted_url returned by embed token creation with hosted true, then remove the fragment before exchanging. No Authorization header is required; the code authenticates this request. The code expires after 60 seconds and is consumed atomically on exchange, so concurrent attempts have only one winner. Expired, used and unknown codes return the same 404 body. Keep the token in memory and return to the host website for a fresh link when it expires; exchange cannot refresh it. Requests are IP limited per minute using the anonymous entrypoint budget (default 20). Example body is {"code":"<code from hosted_url>"}.`,
+    http: "POST",
+    path: "/agent/v1/embed/exchange",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "code",
+          type: "string",
+          required: true,
+          description: "Single-use credential from the c fragment parameter of hosted_url returned by embed token creation. Valid for 60 seconds."
+        }
+      ]
+    }
+  },
+  {
+    resource: "agent.embedTokens",
+    method: "list",
+    summary: "List Embed Tokens",
+    description: `List embed token issuance records in your organization.
+
+Includes expired and revoked grants; returns neither token nor token_id. Sorts by created_at, then grant id, both descending. agent_id accepts agent_ or agt_; external_user_id matches exactly. limit is 1–100 (default 20). Reuse next_page as page with the same filters and organization; a mismatch returns 400. End-user credentials return 404.`,
+    http: "GET",
+    path: "/agent/v1/embed_tokens",
     streaming: "no",
     pagination: false,
-    pathParams: [
+    pathParams: [],
+    query: [
       {
-        name: "deployment_id",
-        sdkName: "deployment_id"
+        name: "agent_id",
+        type: "string",
+        required: false,
+        description: "Filter by service agent identifier (agent_ or agt_ prefix)."
+      },
+      {
+        name: "external_user_id",
+        type: "string",
+        required: false,
+        description: "Exact host user identifier supplied at issuance."
+      },
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Maximum records per page; defaults to 20."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "next_page from a previous response with the same filters."
       }
-    ],
-    query: []
+    ]
   },
   {
     resource: "agent.embedTokens",
@@ -1080,7 +1483,7 @@ null to clear. Maximum 50.`
     summary: "Create Embed Token",
     description: `Issue a short-lived credential on your backend for an end user of a service agent.
 
-Requires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. The hosted field is not supported.`,
+Requires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. Set hosted to true to also receive hosted_url; redirect the user there within 60 seconds. The agent must have an identity_number. The URL fragment contains a single-use exchange credential, not the token. Omit hosted or set false for ordinary token issuance.`,
     http: "POST",
     path: "/agent/v1/embed_tokens",
     streaming: "no",
@@ -1090,6 +1493,12 @@ Requires an active service agent in your organization with an embed policy. Pins
     body: {
       required: true,
       fields: [
+        {
+          name: "hosted",
+          type: "boolean",
+          required: false,
+          description: "Set true to also return a hosted chat URL with a single-use credential valid for 60 seconds. Defaults to false; the agent must have an identity_number."
+        },
         {
           name: "agent",
           type: "string",
@@ -1149,10 +1558,60 @@ Requires an active service agent in your organization with an embed policy. Pins
       ]
     }
   },
+  {
+    resource: "agent.embedTokens.anonymous",
+    method: "create",
+    summary: "Issue anonymous visitor token",
+    description: `Obtain a short-lived embedding token for a visitor without an account using the agent owner's publishable key.
+
+No Authorization header is required. Send the browser Origin allowed by the agent policy. Save a returned visitor_secret and reuse it for refreshes; only new visitors receive one. Unknown secrets create new visitors, and extra fields including visitor_id return 400. Issuance uses the key creator's organization membership, the key session budget and the smaller of the policy TTL maximum and 3600 seconds. IP requests are limited per minute (default 20); UTC daily session and spending caps are checked across the key's primary sessions created that day. Token issuance itself does not create a session or charge usage; subsequent sessions bill the host organization. Example body: {"publishable_key":"pk_praxis_example"}.`,
+    http: "POST",
+    path: "/agent/v1/embed_tokens/anonymous",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "publishable_key",
+          type: "string",
+          required: true,
+          description: "Public key created by the service agent owner; safe to include in browser code."
+        },
+        {
+          name: "visitor_secret",
+          type: "string",
+          required: false,
+          description: "Secret returned by a previous anonymous issuance for this key. Omit for a new visitor; an unknown secret creates a new visitor."
+        }
+      ]
+    }
+  },
+  {
+    resource: "agent.embedTokens.revoke",
+    method: "create",
+    summary: "Revoke Embed Token",
+    description: `Revoke an embed token and close its open event streams.
+
+Use an id from issuance or listing. Revokes the credential before setting revoked_at; upstream failure leaves it unset. Streams receive session.error (EMBED_TOKEN_REVOKED), then close immediately; other credentials are unaffected. Idempotent; repeats return the original revoked record without another revocation or audit. Missing or foreign grants and end-user credentials return 404.`,
+    http: "POST",
+    path: "/agent/v1/embed_tokens/{id}/revoke",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.environments",
     method: "list",
-    summary: "",
+    summary: "List environments",
     description: "List execution environments: the built-in recipes and the tenant-owned cloud environments that a session can run in. Archived environments are hidden unless include_archived is true. Pages hold at most 100 items (default 20); pass next_page as page to continue. Use the returned id as environment_id when creating a session.",
     http: "GET",
     path: "/agent/v1/environments",
@@ -1187,7 +1646,7 @@ Requires an active service agent in your organization with an embed policy. Pins
   {
     resource: "agent.environments",
     method: "create",
-    summary: "",
+    summary: "Create environment",
     description: "Create a tenant-owned cloud environment: a sandbox recipe (packages to install and networking policy) that sessions can select through environment_id. Package installation happens when the session's sandbox is created; a failed install terminates that session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. Limited networking is applied at sandbox creation. Unlike Anthropic Managed Agents, self_hosted environments, scope and cross-session package caching are not supported.",
     http: "POST",
     path: "/agent/v1/environments",
@@ -1241,7 +1700,7 @@ rejected. If not specified, defaults based on organization type.`
   {
     resource: "agent.environments",
     method: "retrieve",
-    summary: "",
+    summary: "Get environment",
     description: "Read one environment's configuration and status by id. Built-in environments are readable but never editable; tenant-owned ones can be updated or archived. environment_id comes from environments.list or environments.create.",
     http: "GET",
     path: "/agent/v1/environments/{environment_id}",
@@ -1258,7 +1717,7 @@ rejected. If not specified, defaults based on organization type.`
   {
     resource: "agent.environments",
     method: "update",
-    summary: "",
+    summary: "Update environment",
     description: "Update the configuration of a tenant-owned cloud environment. Built-in environments are read-only. Package installation and limited networking are applied when a session's sandbox is created. Omitted fields keep their value.",
     http: "POST",
     path: "/agent/v1/environments/{environment_id}",
@@ -1317,7 +1776,7 @@ owning account only.`
   {
     resource: "agent.environments",
     method: "archive",
-    summary: "",
+    summary: "Archive environment",
     description: "Soft-archive a tenant-owned cloud environment so it can no longer be used to create new sessions. Built-in environments are read-only and cannot be archived.",
     http: "POST",
     path: "/agent/v1/environments/{environment_id}/archive",
@@ -1334,7 +1793,7 @@ owning account only.`
   {
     resource: "agent.sessions",
     method: "list",
-    summary: "",
+    summary: "List sessions",
     description: "List sessions of the workspace behind your API key, newest first, in pages of at most 100 (default 20). Unlike Anthropic Managed Agents, only limit, page, agent_id and deployment_id are honored; the other filters declared here (agent_version, created_at ranges, memory_store_id, include_archived, order, statuses) are not supported and return 400. Use the returned id with sessions.retrieve or sessions.events.list; pass next_page as page for the next page.",
     http: "GET",
     path: "/agent/v1/sessions",
@@ -1434,14 +1893,33 @@ owning account only.`
         type: "string",
         required: false,
         description: "Opaque pagination cursor: pass the next_page value of the previous response unchanged. Omit it for the first page. A cursor from a different query or a malformed one returns 400."
+      },
+      {
+        name: "external_user_id",
+        type: "string",
+        required: false,
+        description: "Filter by an exact end-user identifier (1–128 characters: A-Z, a-z, 0-9, underscore, dot, colon, at sign or hyphen). Keep this filter unchanged when following page."
+      },
+      {
+        name: "source",
+        type: "string",
+        enum: [
+          "kit",
+          "iframe",
+          "hosted",
+          "api",
+          "automation"
+        ],
+        required: false,
+        description: "Filter by session origin: kit, iframe, hosted, api or automation. Keep this filter unchanged when following page."
       }
     ]
   },
   {
     resource: "agent.sessions",
     method: "create",
-    summary: "",
-    description: `Create a session: one conversation with an agent, running on a machine. Pass agent as an agent id (latest version) or {id, version, type:"agent"}. Unlike Anthropic Managed Agents, omit environment_id to get a light machine, unless computer_id (explicit, or the agent's default) selects a Computer; pass environment_id for a sandbox recipe. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Inline agent overrides and nonempty vault_ids are not supported. Omitted budget defaults to USD 20; null removes the limit, and a limit object uses a positive integer string of USD cents. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
+    summary: "Create session",
+    description: `Create a session: one conversation with an agent. Pass agent as an agent id (latest version) or {id, version, type:"agent"}. Unlike Anthropic Managed Agents, omit environment_id to get a light machine, unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, omission returns environment_id=light; explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Inline agent overrides are not supported. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Omitted budget defaults to USD 20; null removes the limit, and a limit object uses a positive integer string of USD cents. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
     http: "POST",
     path: "/agent/v1/sessions",
     streaming: "no",
@@ -1461,7 +1939,7 @@ owning account only.`
           name: "environment_id",
           type: "string",
           required: false,
-          description: "ID of the `environment` defining the container configuration for\nthis session."
+          description: "Execution environment id from agent.environments.list or agent.environments.create. For a service agent, omission selects the built-in light environment and returns session.environment_id=light; explicit null allocates no machine and makes machine tools, including codemode and bash, unavailable. Personal agents use their selected Computer."
         },
         {
           name: "budget",
@@ -1541,10 +2019,27 @@ offsets ("+08:00") and unknown names return 400. Never stored in
       ]
     }
   },
+  {
+    resource: "agent.sessions",
+    method: "delete",
+    summary: "Delete session",
+    description: "Delete an idle or terminated session and its event history after saving a deletion snapshot. Supply the session id from creation or listing. Running sessions return 409 INVALID_STATE: interrupt first or wait until idle or terminated. Afterwards retrieval and event listing return 404 and lists omit the session. Example: DELETE /agent/v1/sessions/sesn_example.",
+    http: "DELETE",
+    path: "/agent/v1/sessions/{session_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "session_id",
+        sdkName: "session_id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.sessions",
     method: "retrieve",
-    summary: "",
+    summary: "Get session",
     description: "Read one session by id: its agent snapshot, status, model and thinking selection, resources, title, metadata and, for a fork, forked_from. Use it to poll status; to read what happened use sessions.events.list. This response does not include a machine object or sandbox id. With no environment_id or Computer selected at creation, the session starts on a light machine; no environment lookup or provisioning is needed for a codemode calculation.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}",
@@ -1561,8 +2056,8 @@ offsets ("+08:00") and unknown names return 400. Never stored in
   {
     resource: "agent.sessions",
     method: "update",
-    summary: "",
-    description: "Update a session's title, metadata, model or thinking selection. metadata follows patch semantics: a string value sets the key, null deletes it, a null metadata clears all keys, untouched keys stay. model must be allowed by the session's agent version; thinking is {effort} or null (null restores inheritance); a model-only change clears a session thinking that the new model does not support, and combined changes are validated against the new model, with the previous selection kept on a 400. Changes apply from the next turn, not to a turn already running. Agent overrides and nonempty vault_ids are not supported (400 naming the field). A budget limit must exceed consumed cost; null removes it permanently for this session. Updating an archived session returns 409.",
+    summary: "Update session",
+    description: "Update a session's title, metadata, model or thinking selection. metadata follows patch semantics: a string value sets the key, null deletes it, a null metadata clears all keys, untouched keys stay. model must be allowed by the session's agent version; thinking is {effort} or null (null restores inheritance); a model-only change clears a session thinking that the new model does not support, and combined changes are validated against the new model, with the previous selection kept on a 400. Changes apply from the next turn, not to a turn already running. Agent overrides are not supported (400 naming the field). Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. A budget limit must exceed consumed cost; null removes it permanently for this session. Updating an archived session returns 409.",
     http: "POST",
     path: "/agent/v1/sessions/{session_id}",
     streaming: "no",
@@ -1627,7 +2122,7 @@ delete it. Omit the field to preserve.`
   {
     resource: "agent.sessions",
     method: "archive",
-    summary: "",
+    summary: "Archive session",
     description: "Archive a session. An archived session refuses new messages with 400 invalid_request_error, while its details and event history stay readable. Archiving again is idempotent and archived_at keeps the first archive time. Use it when a conversation is finished; it does not delete anything.",
     http: "POST",
     path: "/agent/v1/sessions/{session_id}/archive",
@@ -1813,8 +2308,8 @@ Praxis extension available only on /agent/v1, following Claude Agent SDK getCont
   {
     resource: "agent.sessions.events",
     method: "list",
-    summary: "",
-    description: "Read the event history of a session as a page of events, oldest first by default (order=desc for newest first). Use it after sending a message to collect the reply, to find tool calls that wait for approval (session.status_idle with stop_reason requires_action lists their event_ids), or to audit a run; to follow a running session live use sessions.events.stream instead. Filter by types and by a created_at range on processed_at; pages hold at most 100 events (default 20) and next_page continues. A failed run emits session.error before session.status_terminated. Native history also includes user.steer, user.withdraw, system.notification, session.forked, session.goal_changed and session.goal_verification; these are not accepted by the /anthropic/v1 event-type filter.",
+    summary: "List session events",
+    description: "Read the event history of a session as a page of events, oldest first by default (order=desc for newest first). Use it after sending a message to collect the reply, to find tool calls that wait for approval or client custom tool results (session.status_idle with stop_reason requires_action lists their event_ids), or to audit a run; to follow a running session live use sessions.events.stream instead. Filter by types and by a created_at range on processed_at; pages hold at most 100 events (default 20) and next_page continues. A failed run emits session.error before session.status_terminated. Native history also includes user.steer, user.withdraw, system.notification, session.forked, session.goal_changed and session.goal_verification; these are not accepted by the /anthropic/v1 event-type filter.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/events",
     streaming: "no",
@@ -1884,8 +2379,8 @@ Praxis extension available only on /agent/v1, following Claude Agent SDK getCont
   {
     resource: "agent.sessions.events",
     method: "send",
-    summary: "",
-    description: 'Send events to a session: user.message (exactly one nonempty text block), user.interrupt, user.tool_confirmation to allow or deny a pending tool call, user.steer to inject a queued user.message into a turn that is still running, and user.withdraw to retract a queued message. The response only acknowledges the inputs; read replies with sessions.events.list or sessions.events.stream. A message sent while the session waits for tool approval is queued (processed_at null) and runs in order after the approval is resolved. Archived sessions reject new messages. To approve, read a pending agent.tool_use or agent.mcp_tool_use event and send {type: "user.tool_confirmation", tool_use_id: <that event id>, result: "allow"} (or deny); include session_thread_id for a child approval. Native confirmations also accept updated_permissions, answers and annotations, which /anthropic/v1 rejects.',
+    summary: "Send session events",
+    description: 'Attach optional praxis_context={items:[{name,value}]} to user.message for untrusted page context on this turn only (maximum 32 items, 4096 UTF-8 JSON bytes). /anthropic/v1 rejects this field. Send events to a session: user.message (exactly one nonempty text block), user.interrupt, user.tool_confirmation to allow or deny a pending tool call, user.custom_tool_result to return a custom tool result, user.steer to inject a queued user.message into a turn that is still running, and user.withdraw to retract a queued message. The response only acknowledges the inputs; read replies with sessions.events.list or sessions.events.stream. A message sent while the session waits for tool approval is queued (processed_at null) and runs in order after the approval is resolved. Archived sessions reject new messages. To approve, read a pending agent.tool_use or agent.mcp_tool_use event and send {type: "user.tool_confirmation", tool_use_id: <that event id>, result: "allow"} (or deny); include session_thread_id for a child approval. Native confirmations also accept updated_permissions, answers and annotations, which /anthropic/v1 rejects. Both faces accept user.custom_tool_result with custom_tool_use_id from agent.custom_tool_use.id or the requires_action stop_reason.event_ids. Unlike Anthropic, result content accepts only text blocks (omit it for an empty array). Omitted or null is_error means false. The server routes child calls by id; session_thread_id is rejected in this input. Unknown call ids return 400; duplicate results or calls no longer waiting return 409.',
     http: "POST",
     path: "/agent/v1/sessions/{session_id}/events",
     streaming: "no",
@@ -1913,7 +2408,7 @@ Praxis extension available only on /agent/v1, following Claude Agent SDK getCont
   {
     resource: "agent.sessions.events",
     method: "stream",
-    summary: "",
+    summary: "Stream session events",
     description: "Open a Server-Sent Events stream of a session's events in real time. Use it to show a reply as it is produced; to read past events use sessions.events.list. Send a message through sessions.events.send in another request while the stream is open. Closing the stream only drops your subscription and does not stop the agent. Pass event_deltas[]=agent.message, agent.thinking or agent.tool_use to also receive event_start / event_delta previews before the final event.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/events/stream",
@@ -1972,7 +2467,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.resources",
     method: "list",
-    summary: "",
+    summary: "List session resources",
     description: "List the extra resources (file references) attached to a session, oldest first, at most 1000 per page (default 1000). Use the returned id with sessions.resources.retrieve or sessions.resources.delete; next_page continues a truncated list.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/resources",
@@ -2002,7 +2497,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.resources",
     method: "create",
-    summary: "",
+    summary: "Add session resource",
     description: "Attach a file resource to a session by file_id, up to 500 per session. The file must exist and belong to your tenant. It is mounted under /mnt/session/uploads/<file_id> unless mount_path is given; custom paths are rooted there and parent traversal is rejected. File content is immutable through this API, and synchronizing it into a running sandbox is not implemented in this version.",
     http: "POST",
     path: "/agent/v1/sessions/{session_id}/resources",
@@ -2046,7 +2541,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.resources",
     method: "delete",
-    summary: "",
+    summary: "Delete session resource",
     description: "Detach a resource from a session. Only the reference is removed; the underlying file is not deleted. The response is {id, type: session_resource_deleted}. resource_id comes from sessions.resources.list or the add call.",
     http: "DELETE",
     path: "/agent/v1/sessions/{session_id}/resources/{resource_id}",
@@ -2075,7 +2570,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.resources",
     method: "retrieve",
-    summary: "",
+    summary: "Get session resource",
     description: "Read one resource attached to a session: its type, file_id, mount_path and timestamps. resource_id comes from sessions.resources.list or sessions.resources.add.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/resources/{resource_id}",
@@ -2101,10 +2596,77 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
       }
     ]
   },
+  {
+    resource: "agent.sessions.runs",
+    method: "deleteFeedback",
+    summary: "Delete Run Feedback",
+    description: `Remove the rating and comment for a run.
+
+Own-face extension. Use the session id from session creation or listing and the run_id from its events. Requires a readable session and a run belonging to it. Idempotent; returns 204 even when no feedback exists. End users can delete feedback only for their own sessions. Does not delete the run or messages, enter model context, or start another run.`,
+    http: "DELETE",
+    path: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "session_id",
+        sdkName: "session_id"
+      },
+      {
+        name: "run_id",
+        sdkName: "run_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.sessions.runs.feedback",
+    method: "create",
+    summary: "Set Run Feedback",
+    description: `Submit thumbs up or thumbs down for a run, with an optional comment.
+
+Own-face extension. Use a readable session and a run_id from its events. Each submission replaces the previous rating and comment; omitted or null comment clears it, while created_at is preserved. Comments allow at most 2000 Unicode characters. End users can submit only for their own sessions. Feedback never enters model context or starts a run. For example, submit {"rating":"positive","comment":"Helpful"}. POST follows Managed Agents resource update conventions; the resource remains unique per session and run.`,
+    http: "POST",
+    path: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "session_id",
+        sdkName: "session_id"
+      },
+      {
+        name: "run_id",
+        sdkName: "run_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "rating",
+          type: "string",
+          enum: [
+            "positive",
+            "negative"
+          ],
+          required: true,
+          description: "positive means thumbs up; negative means thumbs down for this run."
+        },
+        {
+          name: "comment",
+          type: "string",
+          required: false,
+          description: "Optional comment, at most 2000 Unicode characters. Omit or send null to clear the previous comment."
+        }
+      ]
+    }
+  },
   {
     resource: "agent.sessions.threads",
     method: "list",
-    summary: "",
+    summary: "List session threads",
     description: "List the execution threads of a session: the primary thread plus every child thread started by subagents or advisors, in created_at order. Child threads reference the primary through parent_thread_id. Pages hold at most 100 threads (default 20). Use a thread id with sessions.threads.retrieve, sessions.threads.events.list or sessions.threads.events.stream.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/threads",
@@ -2134,7 +2696,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.threads",
     method: "retrieve",
-    summary: "",
+    summary: "Get session thread",
     description: "Read one execution thread of a session, field for field the same as its list item. Thread ids that are unknown, malformed or belong to another session all return 404, so existence is not revealed. thread_id comes from sessions.threads.list or from the session_thread_id of a session.thread_created event.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/threads/{thread_id}",
@@ -2163,7 +2725,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.threads",
     method: "archive",
-    summary: "",
+    summary: "Archive session thread",
     description: "Archive one execution thread. Archiving the primary thread archives the session; archiving a child archives only that child, leaving the parent and its siblings untouched. An archived child has status terminated and archived_at set, receives no new events and keeps its history readable.",
     http: "POST",
     path: "/agent/v1/sessions/{session_id}/threads/{thread_id}/archive",
@@ -2192,7 +2754,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.threads.events",
     method: "list",
-    summary: "",
+    summary: "List session thread events",
     description: "Read the event history of one execution thread: the session itself for the primary thread, or the child session for a child thread. It accepts the same filters, ordering and paging as sessions.events.list and returns the same data + next_page envelope. Child approvals carry session_thread_id so you can route a confirmation to the owning thread.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/threads/{thread_id}/events",
@@ -2233,7 +2795,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
   {
     resource: "agent.sessions.threads",
     method: "stream",
-    summary: "",
+    summary: "Stream session thread events",
     description: "Open a Server-Sent Events stream of one execution thread's live events, using the same implementation as sessions.events.stream; a read-only WebSocket is also available on this path. The parent session stream additionally carries child creation, status and message events. Pass event_deltas[]=agent.message, agent.thinking or agent.tool_use for incremental previews.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/threads/{thread_id}/stream",
@@ -2988,6 +3550,27 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
     ],
     query: []
   },
+  {
+    resource: "application.workers.versions.assets",
+    method: "retrieveManifest",
+    summary: "Get version asset manifest",
+    description: "Read the retained asset paths, content hashes and byte sizes of a version for publication planning. This read creates no session or version. A version without assets returns an empty manifest; unavailable artifacts and foreign resources return 404.",
+    http: "GET",
+    path: "/application/v1/workers/{worker_id}/versions/{version_id}/assets/manifest",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "worker_id",
+        sdkName: "worker_id"
+      },
+      {
+        name: "version_id",
+        sdkName: "version_id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "automation.actions",
     method: "list",
@@ -6411,7 +6994,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "{column}",
         type: "string",
         required: false,
-        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. See the filter operator matrix."
+        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. Supported operators: eq (equal), neq (not equal; ne is not supported), gt/gte/lt/lte (comparisons), like (case-sensitive text pattern), ilike (case-insensitive text pattern), in (membership), is (null/boolean test), cs (contains), cd (contained by), and ov (array overlap). For like/ilike, * or % matches any sequence and _ matches one character, e.g. title=ilike.*spring*; URL-encode a literal % as %25. Use days=in.(1,2,3), title=is.null, active=is.true or active=is.false; is.not_null and is.unknown are also accepted (unknown means null). Negate a condition with not., e.g. title=not.eq.draft. Multiple filters are ANDed; use or=(title.eq.a,title.eq.b), and=(days.gte.1,days.lte.3), not.or=(...) or not.and=(...), with nested and(...) and or(...) groups as needed. cs/cd accept JSON objects or arrays on JSON fields; cs also accepts a JSON scalar. For array values or multi-link fields, use cs.{a,b}, cd.{a,b} or ov.{a,b}. JSON paths use -> for JSON and ->> for text, e.g. attributes->>has_onsen=eq.true or attributes->tags=cs.[1,2]; chain -> segments and end with ->> for text. Dot paths such as attributes.has_onsen are unsupported. Full-text, regex, range operators and any/all modifiers are unsupported."
       },
       {
         name: "and",
@@ -6459,7 +7042,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "on_conflict",
         type: "string",
         required: false,
-        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
+        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
       },
       {
         name: "columns",
@@ -6473,7 +7056,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
     resource: "database.databases.rest",
     method: "retrieve",
     summary: "Select rows",
-    description: "Read matching rows with filters, selected columns and ordering. Returns at most 1000 rows per request, including when limit is omitted. Content-Range reports the actual returned interval and the total when count is requested. PATCH and DELETE are not subject to this read cap. Unlike Supabase, casts, aggregates, spread and join modifiers are unsupported. Each table supports up to 1,000,000 rows. Query budget: 8,000 ms with a shared 3,000,000-row safety ceiling. Create indexes on filtered or sorted fields, or narrow the request when it exceeds its budget. Synchronous SQLite aggregates use candidate-row throughput estimates before execution; deployed Workers freeze clocks during synchronous CPU work, so the timer is not a guaranteed server-side interrupt. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24/*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Error table: QUERY_CANCELED / PostgREST 57014 is HTTP 500, retryable=false: Query timed out: index filtered or sorted fields, or narrow the range. DATABASE_INVALID_STATE is HTTP 409 for operations on a deleting database. Cleared or nonexistent databases return DATABASE_NOT_FOUND / HTTP 404. The count is an HTTP Content-Range response header, not a JSON property. Praxis SDK/codemode methods return the body only; a page length is not a total unless you know all matches fit in that page.",
+    description: "Read matching rows with filters, selected columns and ordering. Returns at most 1000 rows per request, including when limit is omitted. Content-Range reports the actual returned interval and the total when count is requested. PATCH and DELETE are not subject to this read cap. Unlike Supabase, casts, aggregates, spread and join modifiers are unsupported. Each table supports up to 1,000,000 rows. Query budget: 8,000 ms with a shared 3,000,000-row safety ceiling. Create indexes on filtered or sorted fields, or narrow the request when it exceeds its budget. Synchronous SQLite aggregates use candidate-row throughput estimates before execution; deployed Workers freeze clocks during synchronous CPU work, so the timer is not a guaranteed server-side interrupt. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24/*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Error table: QUERY_CANCELED / PostgREST 57014 is HTTP 500, retryable=false: Query timed out: index filtered or sorted fields, or narrow the range. DATABASE_INVALID_STATE is HTTP 409 for operations on a deleting database. Cleared or nonexistent databases return DATABASE_NOT_FOUND / HTTP 404. The count is an HTTP Content-Range response header, not a JSON property. Use praxis.database.count in the SDK or codemode to return { count: number | null }; a page length is not a total unless you know all matches fit in that page.",
     http: "GET",
     path: "/database/v1/databases/{database_id}/rest/{table}",
     streaming: "no",
@@ -6499,7 +7082,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "{column}",
         type: "string",
         required: false,
-        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. See the filter operator matrix."
+        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. Supported operators: eq (equal), neq (not equal; ne is not supported), gt/gte/lt/lte (comparisons), like (case-sensitive text pattern), ilike (case-insensitive text pattern), in (membership), is (null/boolean test), cs (contains), cd (contained by), and ov (array overlap). For like/ilike, * or % matches any sequence and _ matches one character, e.g. title=ilike.*spring*; URL-encode a literal % as %25. Use days=in.(1,2,3), title=is.null, active=is.true or active=is.false; is.not_null and is.unknown are also accepted (unknown means null). Negate a condition with not., e.g. title=not.eq.draft. Multiple filters are ANDed; use or=(title.eq.a,title.eq.b), and=(days.gte.1,days.lte.3), not.or=(...) or not.and=(...), with nested and(...) and or(...) groups as needed. cs/cd accept JSON objects or arrays on JSON fields; cs also accepts a JSON scalar. For array values or multi-link fields, use cs.{a,b}, cd.{a,b} or ov.{a,b}. JSON paths use -> for JSON and ->> for text, e.g. attributes->>has_onsen=eq.true or attributes->tags=cs.[1,2]; chain -> segments and end with ->> for text. Dot paths such as attributes.has_onsen are unsupported. Full-text, regex, range operators and any/all modifiers are unsupported."
       },
       {
         name: "and",
@@ -6547,7 +7130,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "on_conflict",
         type: "string",
         required: false,
-        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
+        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
       },
       {
         name: "columns",
@@ -6561,7 +7144,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
     resource: "database.databases.rest",
     method: "head",
     summary: "Count rows",
-    description: "Inspect the HTTP row count and range without retrieving row data; send Prefer: count=exact for a filtered count. Returns no body and does not fetch or serialize row data. A known count determines the interval using limit/offset or Range with a default and maximum page size of 1000. Without a count preference, or when the selected count mode cannot supply a total, Content-Range is */*. Singular Accept still validates page cardinality. Unlike Supabase, planned and estimated counts do not use PostgreSQL planner estimates. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24/*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Praxis SDK/codemode methods return only the empty body, not the Content-Range response header; use an HTTP client when you need that header.",
+    description: "Inspect the HTTP row count and range without retrieving row data; send Prefer: count=exact for a filtered count. Returns no body and does not fetch or serialize row data. A known count determines the interval using limit/offset or Range with a default and maximum page size of 1000. Without a count preference, or when the selected count mode cannot supply a total, Content-Range is */*. Singular Accept still validates page cardinality. Unlike Supabase, planned and estimated counts do not use PostgreSQL planner estimates. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24/*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Use praxis.database.count in the SDK or codemode to return { count: number | null } from this header without retrieving rows.",
     http: "HEAD",
     path: "/database/v1/databases/{database_id}/rest/{table}",
     streaming: "no",
@@ -6587,7 +7170,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "{column}",
         type: "string",
         required: false,
-        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. See the filter operator matrix."
+        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. Supported operators: eq (equal), neq (not equal; ne is not supported), gt/gte/lt/lte (comparisons), like (case-sensitive text pattern), ilike (case-insensitive text pattern), in (membership), is (null/boolean test), cs (contains), cd (contained by), and ov (array overlap). For like/ilike, * or % matches any sequence and _ matches one character, e.g. title=ilike.*spring*; URL-encode a literal % as %25. Use days=in.(1,2,3), title=is.null, active=is.true or active=is.false; is.not_null and is.unknown are also accepted (unknown means null). Negate a condition with not., e.g. title=not.eq.draft. Multiple filters are ANDed; use or=(title.eq.a,title.eq.b), and=(days.gte.1,days.lte.3), not.or=(...) or not.and=(...), with nested and(...) and or(...) groups as needed. cs/cd accept JSON objects or arrays on JSON fields; cs also accepts a JSON scalar. For array values or multi-link fields, use cs.{a,b}, cd.{a,b} or ov.{a,b}. JSON paths use -> for JSON and ->> for text, e.g. attributes->>has_onsen=eq.true or attributes->tags=cs.[1,2]; chain -> segments and end with ->> for text. Dot paths such as attributes.has_onsen are unsupported. Full-text, regex, range operators and any/all modifiers are unsupported."
       },
       {
         name: "and",
@@ -6635,7 +7218,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "on_conflict",
         type: "string",
         required: false,
-        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
+        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
       },
       {
         name: "columns",
@@ -6675,7 +7258,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "{column}",
         type: "string",
         required: false,
-        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. See the filter operator matrix."
+        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. Supported operators: eq (equal), neq (not equal; ne is not supported), gt/gte/lt/lte (comparisons), like (case-sensitive text pattern), ilike (case-insensitive text pattern), in (membership), is (null/boolean test), cs (contains), cd (contained by), and ov (array overlap). For like/ilike, * or % matches any sequence and _ matches one character, e.g. title=ilike.*spring*; URL-encode a literal % as %25. Use days=in.(1,2,3), title=is.null, active=is.true or active=is.false; is.not_null and is.unknown are also accepted (unknown means null). Negate a condition with not., e.g. title=not.eq.draft. Multiple filters are ANDed; use or=(title.eq.a,title.eq.b), and=(days.gte.1,days.lte.3), not.or=(...) or not.and=(...), with nested and(...) and or(...) groups as needed. cs/cd accept JSON objects or arrays on JSON fields; cs also accepts a JSON scalar. For array values or multi-link fields, use cs.{a,b}, cd.{a,b} or ov.{a,b}. JSON paths use -> for JSON and ->> for text, e.g. attributes->>has_onsen=eq.true or attributes->tags=cs.[1,2]; chain -> segments and end with ->> for text. Dot paths such as attributes.has_onsen are unsupported. Full-text, regex, range operators and any/all modifiers are unsupported."
       },
       {
         name: "and",
@@ -6723,7 +7306,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
         name: "on_conflict",
         type: "string",
         required: false,
-        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
+        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
       },
       {
         name: "columns",
@@ -6743,7 +7326,7 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
     summary: "Insert rows",
     description: `Insert rows into an existing table after defining its fields; at most 500 rows per request. Each request is atomic: any failure rolls back the entire batch. There are no transactions across requests.
 Rows are filled to the union of their keys with null; send Prefer: missing=default to use field defaults for missing keys.
-The default is return=minimal: success returns HTTP 201 with an empty body. Send Prefer: return=representation to return the inserted rows. Unlike Supabase, upsert conflicts can target only id or one unique field, not a composite key. Each table supports up to 1,000,000 rows.`,
+The default is return=minimal: success returns HTTP 201 with an empty body. Send Prefer: return=representation to return the inserted rows. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. Unlike Supabase, upsert conflicts can target only id or one unique field, not a composite key. Each table supports up to 1,000,000 rows.`,
     http: "POST",
     path: "/database/v1/databases/{database_id}/rest/{table}",
     streaming: "no",
@@ -6769,7 +7352,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
         name: "{column}",
         type: "string",
         required: false,
-        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. See the filter operator matrix."
+        description: "Horizontal filter: replace {column} with a field name or JSON path, e.g. title=eq.summary. Repeat for more columns. Supported operators: eq (equal), neq (not equal; ne is not supported), gt/gte/lt/lte (comparisons), like (case-sensitive text pattern), ilike (case-insensitive text pattern), in (membership), is (null/boolean test), cs (contains), cd (contained by), and ov (array overlap). For like/ilike, * or % matches any sequence and _ matches one character, e.g. title=ilike.*spring*; URL-encode a literal % as %25. Use days=in.(1,2,3), title=is.null, active=is.true or active=is.false; is.not_null and is.unknown are also accepted (unknown means null). Negate a condition with not., e.g. title=not.eq.draft. Multiple filters are ANDed; use or=(title.eq.a,title.eq.b), and=(days.gte.1,days.lte.3), not.or=(...) or not.and=(...), with nested and(...) and or(...) groups as needed. cs/cd accept JSON objects or arrays on JSON fields; cs also accepts a JSON scalar. For array values or multi-link fields, use cs.{a,b}, cd.{a,b} or ov.{a,b}. JSON paths use -> for JSON and ->> for text, e.g. attributes->>has_onsen=eq.true or attributes->tags=cs.[1,2]; chain -> segments and end with ->> for text. Dot paths such as attributes.has_onsen are unsupported. Full-text, regex, range operators and any/all modifiers are unsupported."
       },
       {
         name: "and",
@@ -6817,7 +7400,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
         name: "on_conflict",
         type: "string",
         required: false,
-        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
+        description: "POST upsert: id or one unique field with resolution=merge-duplicates|ignore-duplicates. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. POST accepts an optional client id matching [A-Za-z0-9_-]{1,64}; omitted ids are generated. PATCH cannot change id."
       },
       {
         name: "columns",
@@ -6869,7 +7452,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
     resource: "database.databases.tables",
     method: "create",
     summary: "Create table",
-    description: "Creates a table together with its initial fields in one call and returns it (HTTP 201) with generated tbl_ and fld_ ids. name must match ^[a-z_][a-z0-9_]{0,62}$ and be unused in this database (duplicate: 409 UNIQUE_VIOLATION). fields is required and may be an empty array; fields can also be added later with databaseAddField. Limits: 50 tables per database, 64 fields per table, and 16 indexed or unique fields per table; exceeding one returns 400 LIMIT_EXCEEDED. Every row also has a system id column, which is not declared as a field. Insert data afterwards with databaseInsert. Unlike Supabase, define schema with this table API and the field APIs; PostgreSQL DDL and SQL migration files cannot be submitted. Each table supports up to 1,000,000 rows.",
+    description: 'Creates a table together with its initial fields in one call and returns it (HTTP 201) with generated tbl_ and fld_ ids. name must match ^[a-z_][a-z0-9_]{0,62}$ and be unused in this database (duplicate: 409 UNIQUE_VIOLATION). fields is required and may be an empty array; fields can also be added later with databaseAddField. Limits: 50 tables per database, 64 fields per table, and 16 indexed or unique fields per table; exceeding one returns 400 LIMIT_EXCEEDED. Fields default to indexed:false. Set indexed:true explicitly for fields used in filters or ordering. Only indexed:true or unique:true consumes one of the 16 indexed-or-unique field slots; a field with both consumes one slot. Unique fields still consume a slot even with indexed:false. Existing fields are unchanged. Minimal field example: {"name":"notes","type":"string","indexed":false}. Every row also has a system id column, which is not declared as a field. Insert data afterwards with databaseInsert. Unlike Supabase, define schema with this table API and the field APIs; PostgreSQL DDL and SQL migration files cannot be submitted. Each table supports up to 1,000,000 rows.',
     http: "POST",
     path: "/database/v1/databases/{database_id}/tables",
     streaming: "no",
@@ -6990,7 +7573,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
     resource: "database.databases.tables.fields",
     method: "create",
     summary: "Add field",
-    description: "Adds one field to an existing table and returns the updated table (HTTP 201). Required inputs are name (lowercase letters, digits and underscores; id and names starting with _ are reserved) and type (string, integer, number, boolean, datetime, json or link); json needs options.schema and link needs options.linked_table_id and options.multiple. Adding a required field to a table that already has rows needs a default, otherwise the call fails with 400 VALIDATION_FAILED; a default is written into every existing row. Scalar fields are indexed by default, while json and link fields cannot be indexed. Limits: 64 fields and 16 indexed or unique fields per table (400 LIMIT_EXCEEDED). Unlike Supabase, schema evolution uses field definitions rather than ALTER TABLE statements or SQL migrations.",
+    description: 'Adds one field to an existing table and returns the updated table (HTTP 201). Required inputs are name (lowercase letters, digits and underscores; id and names starting with _ are reserved) and type (string, integer, number, boolean, datetime, json or link); json needs options.schema and link needs options.linked_table_id and options.multiple. Adding a required field to a table that already has rows needs a default, otherwise the call fails with 400 VALIDATION_FAILED; a default is written into every existing row. Fields default to indexed:false. Set indexed:true explicitly for fields used in filters or ordering. Only indexed:true or unique:true consumes one of the 16 indexed-or-unique field slots; a field with both consumes one slot. Unique fields still consume a slot even with indexed:false. Existing fields are unchanged. Minimal field example: {"name":"notes","type":"string","indexed":false}. JSON and link fields cannot be indexed. Limits: 64 fields and 16 indexed or unique fields per table (400 LIMIT_EXCEEDED). Unlike Supabase, schema evolution uses field definitions rather than ALTER TABLE statements or SQL migrations.',
     http: "POST",
     path: "/database/v1/databases/{database_id}/tables/{table}/fields",
     streaming: "no",
@@ -7154,28 +7737,137 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
         required: false,
         description: "File ID cursor for the preceding page; mutually exclusive with after. Use an ID from the current listing."
       }
-    ]
+    ]
+  },
+  {
+    resource: "file.files",
+    method: "create",
+    summary: "Upload file",
+    description: 'Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data, assistants and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File(["Return within 23 days."], "policy.txt", { type: "text/plain" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–2592000), or praxis[expires_in_seconds] (3600–7776000), never both. Without expiry, the file persists until deleted.',
+    http: "POST",
+    path: "/file/v1/files",
+    streaming: "no",
+    pagination: false,
+    multipart: true,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "file",
+          type: "string",
+          required: true,
+          description: "File bytes in one multipart file part, not a filename or file ID. The file must be nonempty and at most 100000000 bytes; its content determines the MIME type."
+        },
+        {
+          name: "purpose",
+          type: "string",
+          enum: [
+            "user_data",
+            "assistants",
+            "vision"
+          ],
+          required: true,
+          description: "Purpose label stored with the file: user_data, assistants or vision. The vision purpose accepts only PNG, JPEG, GIF and WebP images. Conversation image references require user_data."
+        },
+        {
+          name: "expires_after",
+          type: "object",
+          required: false,
+          description: "Optional expiry relative to created_at. Files without an expiry persist until deleted."
+        },
+        {
+          name: "praxis",
+          type: "object",
+          required: false,
+          description: "Own-face extensions. Use at most one expiry setting."
+        }
+      ]
+    }
+  },
+  {
+    resource: "file.files",
+    method: "delete",
+    summary: "Delete file",
+    description: "Delete a tenant-owned file. New metadata/content reads return not found. Already-authorized downloads may finish.",
+    http: "DELETE",
+    path: "/file/v1/files/{file_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "file_id",
+        sdkName: "file_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "file.files",
+    method: "retrieve",
+    summary: "Retrieve file",
+    description: "Retrieve metadata for a live file owned by your tenant. Use its file- ID from upload or list. Missing, deleted, expired and other-tenant files return 404; use the content endpoint to download the bytes.",
+    http: "GET",
+    path: "/file/v1/files/{file_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "file_id",
+        sdkName: "file_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "file.files",
+    method: "retrieveContent",
+    summary: "Retrieve file content",
+    description: "Download the original bytes of a live file owned by your tenant. Supply its file- ID from upload or list. A single byte Range can return a partial response; a range outside the file returns 416. Missing, deleted, expired and other-tenant files return 404.",
+    http: "GET",
+    path: "/file/v1/files/{file_id}/content",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "file_id",
+        sdkName: "file_id"
+      }
+    ],
+    query: []
   },
   {
-    resource: "file.files",
+    resource: "file.uploads",
     method: "create",
-    summary: "Upload file",
-    description: 'Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 104857600 bytes, and only user_data, assistants and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File(["Return within 23 days."], "policy.txt", { type: "text/plain" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. OpenAI Uploads chunking is not supported. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–2592000), or praxis[expires_in_seconds] (3600–7776000), never both. Without expiry, the file persists until deleted.',
+    summary: "Create an upload",
+    description: "Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 2 GiB (2147483648 bytes) and only user_data, assistants and vision purposes. Add parts of at most 64000000 bytes and complete within one hour. Optional part_size enables fixed-size, retryable parts. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.",
     http: "POST",
-    path: "/file/v1/files",
+    path: "/file/v1/uploads",
     streaming: "no",
     pagination: false,
-    multipart: true,
     pathParams: [],
     query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "file",
+          name: "bytes",
+          type: "integer",
+          required: true,
+          description: "Exact complete file length in bytes, from 1 through 2147483648 (2 GiB); the sum of completed parts must match."
+        },
+        {
+          name: "filename",
+          type: "string",
+          required: true,
+          description: "Filename for the resulting file, at most 255 UTF-8 bytes."
+        },
+        {
+          name: "mime_type",
           type: "string",
           required: true,
-          description: "File bytes in one multipart file part, not a filename or file ID. The file must be nonempty and at most 104857600 bytes; its content determines the MIME type."
+          description: "Declared MIME type; validated against the assembled content."
         },
         {
           name: "purpose",
@@ -7186,73 +7878,110 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
             "vision"
           ],
           required: true,
-          description: "Purpose label stored with the file: user_data, assistants or vision. The vision purpose accepts only PNG, JPEG, GIF and WebP images. Conversation image references require user_data."
+          description: "Use user_data for conversation attachments, assistants for assistant files, or vision for PNG, JPEG, GIF and WebP images."
         },
         {
           name: "expires_after",
           type: "object",
           required: false,
-          description: "Optional expiry relative to created_at. Files without an expiry persist until deleted."
+          description: "Optional expiry policy for the resulting file; omission retains the file until deletion."
         },
         {
-          name: "praxis",
-          type: "object",
+          name: "part_size",
+          type: "integer",
           required: false,
-          description: "Own-face extensions. Use at most one expiry setting."
+          description: "Optional fixed part size in bytes, 5242880–64000000. Requires part_number on every part; retries of identical bytes at the same number return the same part. Omit to use arbitrary-sized parts."
         }
       ]
     }
   },
   {
-    resource: "file.files",
-    method: "delete",
-    summary: "Delete file",
-    description: "Delete a tenant-owned file. New metadata/content reads return not found. Already-authorized downloads may finish.",
-    http: "DELETE",
-    path: "/file/v1/files/{file_id}",
+    resource: "file.uploads",
+    method: "cancel",
+    summary: "Cancel an upload",
+    description: "Cancel an unfinished upload using upload_id from create and release its reserved storage. Further parts and completion are rejected. Cancelling an already cancelled upload returns the same terminal result; a completed upload cannot be cancelled. Delete its resulting file instead.",
+    http: "POST",
+    path: "/file/v1/uploads/{upload_id}/cancel",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "file_id",
-        sdkName: "file_id"
+        name: "upload_id",
+        sdkName: "upload_id"
       }
     ],
     query: []
   },
   {
-    resource: "file.files",
-    method: "retrieve",
-    summary: "Retrieve file",
-    description: "Retrieve metadata for a live file owned by your tenant. Use its file_dp_ ID from upload or list. Missing, deleted, expired and other-tenant files return 404; use the content endpoint to download the bytes.",
-    http: "GET",
-    path: "/file/v1/files/{file_id}",
+    resource: "file.uploads",
+    method: "complete",
+    summary: "Complete an upload",
+    description: "Assemble the uploaded parts into a file. Supply upload_id from create and part_ids from addPart in file byte order; their sizes must total the declared bytes. Optional md5 verifies the assembled content. Retrying identical part_ids and normalized md5 returns the same result; different inputs return 409. Unlike OpenAI, completed can contain a file still processing (status uploaded). Poll files.retrieve using file.id until status processed (own face state active); error, expiry or 404 means processing failed and the file cannot be used.",
+    http: "POST",
+    path: "/file/v1/uploads/{upload_id}/complete",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "file_id",
-        sdkName: "file_id"
+        name: "upload_id",
+        sdkName: "upload_id"
       }
     ],
-    query: []
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "part_ids",
+          type: "array",
+          itemType: "string",
+          required: true,
+          description: "All part IDs in concatenation order, without duplicates. Fixed-size uploads require increasing part_number order."
+        },
+        {
+          name: "md5",
+          type: "string",
+          required: false,
+          description: "Optional whole-file MD5 as 32 hexadecimal characters; verified after assembly."
+        }
+      ]
+    }
   },
   {
-    resource: "file.files",
-    method: "retrieveContent",
-    summary: "Retrieve file content",
-    description: "Download the original bytes of a live file owned by your tenant. Supply its file_dp_ ID from upload or list. A single byte Range can return a partial response; a range outside the file returns 416. Missing, deleted, expired and other-tenant files return 404.",
-    http: "GET",
-    path: "/file/v1/files/{file_id}/content",
+    resource: "file.uploads.parts",
+    method: "create",
+    summary: "Add an upload part",
+    description: "Send one nonempty part as the multipart data field, at most 64000000 bytes. Parts may arrive concurrently in any order. Use upload_id from create. For a fixed-size upload, supply part_number starting at 1 and exactly part_size bytes except for the final remainder; retry the same number with identical bytes to recover its part ID. Without part_size, each request creates a new part and part_number is ignored. Save the returned part IDs for complete.",
+    http: "POST",
+    path: "/file/v1/uploads/{upload_id}/parts",
     streaming: "no",
     pagination: false,
+    multipart: true,
     pathParams: [
       {
-        name: "file_id",
-        sdkName: "file_id"
+        name: "upload_id",
+        sdkName: "upload_id"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "part_number",
+        type: "integer",
+        required: false,
+        description: "Required when create set part_size; 1 through ceil(bytes / part_size). Ignored for general uploads."
+      }
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "data",
+          type: "string",
+          required: true,
+          description: "Raw bytes of this part, nonempty and at most 64000000 bytes."
+        }
+      ]
+    }
   },
   {
     resource: "knowledge.vectorStores",
@@ -11539,80 +12268,223 @@ for more details.`
         sdkName: "id"
       }
     ],
-    query: []
-  },
-  {
-    resource: "organization.feedback",
-    method: "create",
-    summary: "Report a problem with the Praxis platform",
-    description: `Report a problem with the Praxis platform when an API fails, documentation is unclear, or a capability is missing. AI callers in codemode should include the original error text in message, the X-Request-Id or error event ID in associated_event_id, and relevant session, agent, model, or request IDs in contexts. Continue the user's task after reporting. Each successful call stores feedback and returns its id; repeated calls create separate reports. The authenticated principal determines the reporter; any reporter supplied in the body is ignored. Machine tokens force source to codemode. Requires a valid API key, Console session, or machine token. Minimal body: {"message":"The API documentation does not explain this error."}.`,
-    http: "POST",
-    path: "/organization/v1/feedback",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
+    query: []
+  },
+  {
+    resource: "organization.feedback",
+    method: "list",
+    summary: "List your organization's feedback",
+    description: "Feedback submitted by your organization, newest first, with phase and unread state. Filter by phase and search titles and message text (case-insensitive). Page with next_page. Requires a valid API key, Console session, or machine token of the organization.",
+    http: "GET",
+    path: "/organization/v1/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [
+      {
+        name: "phase",
+        type: "string",
+        required: false,
+        description: "Only feedback in these phases: a comma-separated list of open, awaiting_customer, in_progress, resolved or closed, for example open,in_progress; see the phase field of a feedback for what each means."
+      },
+      {
+        name: "query",
+        type: "string",
+        required: false,
+        description: "Case-insensitive text matched against titles and message bodies."
+      },
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page, 1 to 100."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "Opaque cursor from next_page of the previous response."
+      }
+    ]
+  },
+  {
+    resource: "organization.feedback",
+    method: "create",
+    summary: "Report a problem with the Praxis platform",
+    description: `Report a problem with the Praxis platform when an API fails, documentation is unclear, or a capability is missing. AI callers in codemode should include the original error text in message, the X-Request-Id or error event ID in associated_event_id, and relevant session, agent, model, or request IDs in contexts. Continue the user's task after reporting. Each successful call stores feedback and returns its id; repeated calls create separate reports. The authenticated principal determines the reporter; any reporter supplied in the body is ignored. Machine tokens force source to codemode. Requires a valid API key, Console session, or machine token. Minimal body: {"message":"The API documentation does not explain this error."}.`,
+    http: "POST",
+    path: "/organization/v1/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "message",
+          type: "string",
+          required: true,
+          description: "Problem description, at most 4096 Unicode code points; may be empty only when contexts.praxis.error.message is a non-empty string."
+        },
+        {
+          name: "contact_email",
+          type: "string",
+          required: false,
+          description: "Optional email address for follow-up about this report."
+        },
+        {
+          name: "name",
+          type: "string",
+          required: false,
+          description: "Optional display name of the person submitting feedback."
+        },
+        {
+          name: "url",
+          type: "string",
+          required: false,
+          description: "Page or API URL where the problem occurred."
+        },
+        {
+          name: "associated_event_id",
+          type: "string",
+          required: false,
+          description: "X-Request-Id from the failed response or the related error event ID."
+        },
+        {
+          name: "title",
+          type: "string",
+          required: false,
+          description: "Short summary shown in the feedback list; at most 200 Unicode code points."
+        },
+        {
+          name: "type",
+          type: "string",
+          required: false,
+          description: "Feedback type key enabled in the help settings, such as issue, suggestion, billing or other. Unknown or disabled keys are rejected with INVALID_PARAMS."
+        },
+        {
+          name: "tags",
+          type: "object",
+          required: false,
+          description: "Optional string labels for grouping the reported problem."
+        },
+        {
+          name: "contexts",
+          type: "object",
+          required: false,
+          description: "Structured diagnostic context; contexts.praxis can contain session_id, agent_id, model, and request_ids."
+        },
+        {
+          name: "source",
+          type: "string",
+          enum: [
+            "console",
+            "api"
+          ],
+          required: false,
+          description: "Use console for Console reports or api for API callers (default); machine tokens always store codemode regardless of this value."
+        },
+        {
+          name: "attachments",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Up to five attachments; decoded bytes must not exceed 10 MiB per attachment or 20 MiB in total."
+        }
+      ]
+    }
+  },
+  {
+    resource: "organization.feedback.counts",
+    method: "list",
+    summary: "Count your organization's feedback by phase",
+    description: "How many of your organization's feedback are in each phase, for status tabs. Counts never include another organization's feedback.",
+    http: "GET",
+    path: "/organization/v1/feedback/counts",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "organization.feedback",
+    method: "retrieve",
+    summary: "Get one of your organization's feedback",
+    description: "Read one feedback submitted by your organization with its current phase and first-response timing. Another organization's feedback answers 404 FEEDBACK_NOT_FOUND exactly like a missing one.",
+    http: "GET",
+    path: "/organization/v1/feedback/{id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "organization.feedback.messages",
+    method: "list",
+    summary: "List the messages of a feedback",
+    description: "The conversation of one feedback in time order: your messages, support replies and system events. Internal support notes are never returned. Page with next_page.",
+    http: "GET",
+    path: "/organization/v1/feedback/{id}/messages",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: [
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page, 1 to 100."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "Opaque cursor from next_page of the previous response."
+      }
+    ]
+  },
+  {
+    resource: "organization.feedback.messages",
+    method: "create",
+    summary: "Reply on a feedback",
+    description: "Add your message to a feedback conversation, for example to answer a question from support. A reply while the phase is awaiting_customer moves it to in_progress and notifies support.",
+    http: "POST",
+    path: "/organization/v1/feedback/{id}/messages",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
     query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "message",
+          name: "body",
           type: "string",
           required: true,
-          description: "Problem description and original error text; at most 4096 Unicode code points."
-        },
-        {
-          name: "contact_email",
-          type: "string",
-          required: false,
-          description: "Optional email address for follow-up about this report."
-        },
-        {
-          name: "name",
-          type: "string",
-          required: false,
-          description: "Optional display name of the person submitting feedback."
-        },
-        {
-          name: "url",
-          type: "string",
-          required: false,
-          description: "Page or API URL where the problem occurred."
-        },
-        {
-          name: "associated_event_id",
-          type: "string",
-          required: false,
-          description: "X-Request-Id from the failed response or the related error event ID."
-        },
-        {
-          name: "tags",
-          type: "object",
-          required: false,
-          description: "Optional string labels for grouping the reported problem."
-        },
-        {
-          name: "contexts",
-          type: "object",
-          required: false,
-          description: "Structured diagnostic context; contexts.praxis can contain session_id, agent_id, model, and request_ids."
-        },
-        {
-          name: "source",
-          type: "string",
-          enum: [
-            "console",
-            "api"
-          ],
-          required: false,
-          description: "Use console for Console reports or api for API callers (default); machine tokens always store codemode regardless of this value."
+          description: "Markdown text; at most 4096 Unicode code points."
         },
         {
           name: "attachments",
           type: "array",
           itemType: "object",
           required: false,
-          description: "Up to five attachments; decoded bytes must not exceed 10 MiB per attachment or 20 MiB in total."
+          description: "Up to five attachments; decoded bytes must not exceed 10 MiB each or 20 MiB in total."
         }
       ]
     }
@@ -14017,6 +14889,232 @@ for more details.`
   }
 ];
 
+// ../../packages/sdk/typescript/src/core/errors.ts
+function problemFrom(status, headers, body, statusText) {
+  const value = body && typeof body === "object" ? body : {};
+  const nested = value.error && typeof value.error === "object" ? value.error : {};
+  const string = (v) => typeof v === "string" && v.trim() ? v : undefined;
+  const fallback = statusText || { 400: "Bad Request", 401: "Unauthorized", 403: "Forbidden", 404: "Not Found", 405: "Method Not Allowed", 408: "Request Timeout", 409: "Conflict", 413: "Payload Too Large", 415: "Unsupported Media Type", 422: "Unprocessable Entity", 429: "Too Many Requests", 500: "Internal Server Error", 502: "Bad Gateway", 503: "Service Unavailable", 504: "Gateway Timeout" }[status] || `HTTP ${status}`;
+  const detail = string(value.detail) ?? string(nested.message) ?? string(value.message) ?? string(body);
+  const title = string(value.title) ?? fallback;
+  const param = nested.param ?? value.param;
+  return {
+    status,
+    message: detail ?? title,
+    title,
+    detail,
+    code: string(value.code) ?? string(nested.code) ?? string(nested.type) ?? string(value.error_code),
+    type: string(nested.type) ?? string(value.type),
+    param: typeof param === "string" ? param : param === null || nested.param === null ? null : undefined,
+    errors: Array.isArray(value.errors) ? value.errors : [],
+    requestId: headers.get("x-request-id") ?? string(value.requestId) ?? string(value.request_id),
+    raw: body
+  };
+}
+
+class PraxisError extends Error {
+  status;
+  code;
+  type;
+  title;
+  detail;
+  errors;
+  requestId;
+  param;
+  raw;
+  constructor(problem = {}, options) {
+    super(problem.message ?? problem.detail ?? problem.title ?? `Praxis request failed${problem.status ? ` (${problem.status})` : ""}`, options);
+    this.name = "PraxisError";
+    this.status = problem.status;
+    this.code = problem.code;
+    this.type = problem.type;
+    this.title = problem.title;
+    this.detail = problem.detail;
+    this.errors = problem.errors ?? [];
+    this.requestId = problem.requestId;
+    this.param = problem.param;
+    this.raw = problem.raw;
+  }
+  static fromResponse(response, body) {
+    return new PraxisError(problemFrom(response.status, response.headers, body, response.statusText));
+  }
+}
+
+class PraxisConnectionError extends PraxisError {
+  constructor(cause) {
+    super({ code: "CONNECTION_ERROR", title: "Unable to connect to Praxis" }, { cause });
+    this.name = "PraxisConnectionError";
+  }
+}
+
+class PraxisTimeoutError extends PraxisError {
+  constructor(timeoutMs) {
+    super({ code: "TIMEOUT", title: `Praxis request exceeded ${timeoutMs} ms` });
+    this.name = "PraxisTimeoutError";
+  }
+}
+
+// ../../packages/sdk/typescript/src/core/retry.ts
+function canRetry(request) {
+  return request.method !== "POST" || Boolean(request.headers.get("Idempotency-Key")?.trim());
+}
+function retryAfterMs(value, now = Date.now()) {
+  if (!value)
+    return;
+  if (/^\d+(?:\.\d+)?$/.test(value.trim()))
+    return Number(value) * 1000;
+  const date = Date.parse(value);
+  return Number.isFinite(date) ? Math.max(0, date - now) : undefined;
+}
+function retryDelay(attempt, retryAfter, random = Math.random) {
+  return retryAfterMs(retryAfter) ?? Math.min(30000, 500 * 2 ** attempt) * (0.5 + random() * 0.5);
+}
+function abortable(promise, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+function sleep(ms, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", abort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+async function fetchWithRetry(request, fetcher, options) {
+  const eligible = canRetry(request);
+  const wait = options.wait ?? sleep;
+  for (let attempt = 0;; attempt++) {
+    options.signal.throwIfAborted();
+    let response;
+    try {
+      response = await abortable(fetcher(request.clone()), options.signal);
+    } catch (cause) {
+      options.signal.throwIfAborted();
+      if (!eligible || attempt >= options.maxRetries)
+        throw new PraxisConnectionError(cause);
+      await wait(retryDelay(attempt, null, options.random), options.signal);
+      continue;
+    }
+    const retriable = response.status === 408 || response.status === 429 || response.status >= 500 && response.status <= 599;
+    if (!eligible || !retriable || attempt >= options.maxRetries)
+      return response;
+    const delay = retryDelay(attempt, response.headers.get("Retry-After"), options.random);
+    await response.body?.cancel();
+    await wait(delay, options.signal);
+  }
+}
+
+// ../../packages/sdk/typescript/src/helpers/file-upload.ts
+var MAX_RETRIES = 5;
+function retryable(error) {
+  return error instanceof PraxisConnectionError || error instanceof PraxisTimeoutError || error instanceof SyntaxError || error instanceof PraxisError && (error.status === 408 || error.status === 429 || error.status !== undefined && error.status >= 500 && error.status <= 599);
+}
+async function retry(signal, operation) {
+  for (let used = 0;; used++) {
+    signal.throwIfAborted();
+    try {
+      return await operation();
+    } catch (error) {
+      signal.throwIfAborted();
+      if (used >= MAX_RETRIES || !retryable(error))
+        throw error;
+      await sleep(500 * 2 ** used, signal);
+    }
+  }
+}
+async function uploadFile(client, file, options) {
+  options.signal?.throwIfAborted();
+  if (file.size < 1 || file.size > 2 * 1024 ** 3)
+    throw new RangeError("File size must be 1 byte through 2 GiB");
+  const partSize = options.partSize ?? 50 * 1024 ** 2;
+  const concurrency = options.concurrency ?? 3;
+  if (!Number.isSafeInteger(partSize) || partSize < 5 * 1024 ** 2 || partSize > 64000000)
+    throw new RangeError("partSize must be an integer from 5242880 through 64000000");
+  if (!Number.isSafeInteger(concurrency) || concurrency < 1)
+    throw new RangeError("concurrency must be a positive integer");
+  const filename = options.filename ?? (typeof File !== "undefined" && file instanceof File ? file.name : "upload");
+  const work = new AbortController;
+  const abort = () => work.abort(options.signal?.reason);
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const signal = work.signal;
+  const request = { signal, maxRetries: 0, timeoutMs: 120000 };
+  let uploadId;
+  const active = async (initial) => {
+    let result = initial;
+    for (let polls = 0;; polls++) {
+      signal.throwIfAborted();
+      if (result.state === "active")
+        return result;
+      if (result.state !== "processing")
+        throw new PraxisError({ code: "FILE_PROCESSING_FAILED", message: `File ${result.id} is not active (${result.state})` });
+      await sleep(Math.min(5000, 1000 * 2 ** polls), signal);
+      result = await retry(signal, () => client.file.files.retrieve({ path: { file_id: result.id }, ...request }));
+    }
+  };
+  try {
+    signal.throwIfAborted();
+    options.onProgress?.(0);
+    if (file.size <= 32 * 1024 ** 2) {
+      const result2 = await client.file.files.create({ body: { file: new File([file], filename, { type: file.type }), purpose: options.purpose }, ...request });
+      options.onProgress?.(1);
+      return await active(result2);
+    }
+    const upload = await client.file.uploads.create({ body: { bytes: file.size, filename, mime_type: file.type || "application/octet-stream", purpose: options.purpose, part_size: partSize }, ...request });
+    uploadId = upload.id;
+    signal.throwIfAborted();
+    const path = { upload_id: uploadId };
+    const count = Math.ceil(file.size / partSize);
+    const ids = new Array(count);
+    let cursor = 0, confirmed = 0;
+    const worker = async () => {
+      while (cursor < count) {
+        signal.throwIfAborted();
+        const index = cursor++;
+        const chunk = file.slice(index * partSize, Math.min(file.size, (index + 1) * partSize));
+        const part = await retry(signal, () => client.file.uploads.parts.create({ path, query: { part_number: index + 1 }, body: { data: new File([chunk], filename) }, ...request }));
+        ids[index] = part.id;
+        confirmed += chunk.size;
+        options.onProgress?.(confirmed / file.size);
+      }
+    };
+    const workers = Array.from({ length: Math.min(concurrency, count) }, worker);
+    try {
+      await Promise.all(workers);
+    } catch (error) {
+      work.abort();
+      await Promise.allSettled(workers);
+      throw error;
+    }
+    const result = await retry(signal, () => client.file.uploads.complete({ path, body: { part_ids: ids }, ...request }));
+    if (result.error)
+      throw new PraxisError({ code: result.error.code, message: result.error.message });
+    if (result.status !== "completed" || !result.file)
+      throw new PraxisError({ code: "INVALID_RESPONSE", message: "Complete did not return a completed Upload with a file" });
+    return await active(result.file);
+  } catch (error) {
+    work.abort();
+    if (uploadId) {
+      await client.file.uploads.cancel({ path: { upload_id: uploadId }, maxRetries: 0, timeoutMs: 1e4 }).catch(() => {});
+    }
+    if (options.signal?.aborted)
+      throw options.signal.reason;
+    throw error;
+  } finally {
+    options.signal?.removeEventListener("abort", abort);
+  }
+}
+
 // ../../packages/sdk/typescript/src/core/multipart.ts
 function multipartBodySerializer(body) {
   const data = new FormData;
@@ -14084,9 +15182,9 @@ function createSseClient({
   ...options
 }) {
   let lastEventId;
-  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const createStream = async function* () {
-    let retryDelay = sseDefaultRetryDelay ?? 3000;
+    let retryDelay2 = sseDefaultRetryDelay ?? 3000;
     let attempt = 0;
     const signal = options.signal ?? new AbortController().signal;
     while (true) {
@@ -14150,7 +15248,7 @@ function createSseClient({
                 } else if (line.startsWith("retry:")) {
                   const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
                   if (!Number.isNaN(parsed)) {
-                    retryDelay = parsed;
+                    retryDelay2 = parsed;
                   }
                 }
               }
@@ -14178,7 +15276,7 @@ function createSseClient({
                 data,
                 event: eventName,
                 id: lastEventId,
-                retry: retryDelay
+                retry: retryDelay2
               });
               if (dataLines.length) {
                 yield data;
@@ -14195,8 +15293,8 @@ function createSseClient({
         if (sseMaxRetryAttempts !== undefined && attempt >= sseMaxRetryAttempts) {
           break;
         }
-        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 30000);
-        await sleep(backoff);
+        const backoff = Math.min(retryDelay2 * 2 ** (attempt - 1), sseMaxRetryDelay ?? 30000);
+        await sleep2(backoff);
       }
     }
   };
@@ -14839,6 +15937,169 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ baseUrl: "https://api.deepraxis.com" }));
 
 // ../../packages/sdk/typescript/src/generated/sdk.gen.ts
+var unarchiveAgent = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/unarchive",
+  ...options
+});
+var deleteRunFeedback = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+  ...options
+});
+var setRunFeedback = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listEndUsers = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users",
+  ...options
+});
+var deleteEndUser = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+  ...options
+});
+var getEndUser = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+  ...options
+});
+var getEndUserDeletion = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
+  ...options
+});
+var revokeEndUserTokens = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
+  ...options
+});
+var blockEndUser = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
+  ...options
+});
+var unblockEndUser = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
+  ...options
+});
+var exchangeEmbedCode = (options) => (options.client ?? client).post({
+  url: "/agent/v1/embed/exchange",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var createAnonymousEmbedToken = (options) => (options.client ?? client).post({
+  url: "/agent/v1/embed_tokens/anonymous",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listEmbedTokens = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/embed_tokens",
+  ...options
+});
 var createEmbedToken = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
@@ -14856,6 +16117,19 @@ var createEmbedToken = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var revokeEmbedToken = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/embed_tokens/{id}/revoke",
+  ...options
+});
 var computersList = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
@@ -14997,6 +16271,36 @@ var connectComputer = (options) => (options.client ?? client).post({
     type: "apiKey"
   }],
   url: "/agent/v1/computers/{computer_id}/connect",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var renewComputerLease = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/computers/{computer_id}/leases/{lease_id}/renew",
+  ...options
+});
+var releaseComputerLease = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/computers/{computer_id}/leases/{lease_id}",
   ...options
 });
 var listToolsets = (options) => (options?.client ?? client).get({
@@ -15124,6 +16428,15 @@ var listSessionCompactions = (options) => (options.client ?? client).get({
   url: "/agent/v1/sessions/{session_id}/compactions",
   ...options
 });
+var getEmbedAppearance = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, { name: "Praxis-Publishable-Key", type: "apiKey" }],
+  url: "/agent/v1/embed/appearance",
+  ...options
+});
 var createAudioSpeech = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
@@ -15405,6 +16718,55 @@ var fileRetrieveFileContent = (options) => (options.client ?? client).get({
   url: "/file/v1/files/{file_id}/content",
   ...options
 });
+var fileCreateUpload = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/file/v1/uploads",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var fileAddUploadPart = (options) => (options.client ?? client).post({
+  ...formDataBodySerializer,
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/file/v1/uploads/{upload_id}/parts",
+  ...options,
+  headers: {
+    "Content-Type": null,
+    ...options.headers
+  }
+});
+var fileCompleteUpload = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/file/v1/uploads/{upload_id}/complete",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var fileCancelUpload = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/file/v1/uploads/{upload_id}/cancel",
+  ...options
+});
 var healthCheck = (options) => (options?.client ?? client).get({ url: "/meta/v1/health", ...options });
 var metaMethodsSearch = (options) => (options?.client ?? client).get({ url: "/meta/v1/methods", ...options });
 var metaMethodsRetrieve = (options) => (options.client ?? client).get({ url: "/meta/v1/methods/{name}", ...options });
@@ -15811,7 +17173,88 @@ var createMessage = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
-var countTokens = (options) => (options.client ?? client).post({
+var countTokens = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/model/v1/messages/count_tokens",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var compactResponse = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/model/v1/responses/compact",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var countResponseInputTokens = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/model/v1/responses/input_tokens",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listOrganizationFeedback = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback",
+  ...options
+});
+var createOrganizationFeedback = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var getOrganizationFeedbackCounts = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -15821,14 +17264,10 @@ var countTokens = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/model/v1/messages/count_tokens",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/organization/v1/feedback/counts",
+  ...options
 });
-var compactResponse = (options) => (options.client ?? client).post({
+var getOrganizationFeedback = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -15838,14 +17277,10 @@ var compactResponse = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/model/v1/responses/compact",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/organization/v1/feedback/{id}",
+  ...options
 });
-var countResponseInputTokens = (options) => (options.client ?? client).post({
+var listOrganizationFeedbackMessages = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -15855,14 +17290,10 @@ var countResponseInputTokens = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/model/v1/responses/input_tokens",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/organization/v1/feedback/{id}/messages",
+  ...options
 });
-var createOrganizationFeedback = (options) => (options.client ?? client).post({
+var createOrganizationFeedbackMessage = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -15872,7 +17303,7 @@ var createOrganizationFeedback = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/organization/v1/feedback",
+  url: "/organization/v1/feedback/{id}/messages",
   ...options,
   headers: {
     "Content-Type": "application/json",
@@ -16171,7 +17602,7 @@ var runSandboxCommand = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
-var agentsList = (options) => (options?.client ?? client).get({
+var sessionsDelete = (options) => (options.client ?? client).delete({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16181,10 +17612,10 @@ var agentsList = (options) => (options?.client ?? client).get({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/agents",
+  url: "/agent/v1/sessions/{session_id}",
   ...options
 });
-var agentsCreate = (options) => (options.client ?? client).post({
+var sessionsRetrieve = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16194,14 +17625,27 @@ var agentsCreate = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/agents",
+  url: "/agent/v1/sessions/{session_id}",
+  ...options
+});
+var sessionsUpdate = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/sessions/{session_id}",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var agentsRetrieve = (options) => (options.client ?? client).get({
+var agentsList = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16211,10 +17655,10 @@ var agentsRetrieve = (options) => (options.client ?? client).get({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/agents/{agent_id}",
+  url: "/agent/v1/agents",
   ...options
 });
-var agentsUpdate = (options) => (options.client ?? client).post({
+var agentsCreate = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16224,14 +17668,14 @@ var agentsUpdate = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/agents/{agent_id}",
+  url: "/agent/v1/agents",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var agentsArchive = (options) => (options.client ?? client).post({
+var agentsRetrieve = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16241,10 +17685,10 @@ var agentsArchive = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/agents/{agent_id}/archive",
+  url: "/agent/v1/agents/{agent_id}",
   ...options
 });
-var agentsVersionsList = (options) => (options.client ?? client).get({
+var agentsUpdate = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16254,10 +17698,14 @@ var agentsVersionsList = (options) => (options.client ?? client).get({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/agents/{agent_id}/versions",
-  ...options
+  url: "/agent/v1/agents/{agent_id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
 });
-var sessionsList = (options) => (options?.client ?? client).get({
+var agentsArchive = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16267,10 +17715,10 @@ var sessionsList = (options) => (options?.client ?? client).get({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/sessions",
+  url: "/agent/v1/agents/{agent_id}/archive",
   ...options
 });
-var sessionsCreate = (options) => (options.client ?? client).post({
+var agentsVersionsList = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16280,14 +17728,10 @@ var sessionsCreate = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/sessions",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/agent/v1/agents/{agent_id}/versions",
+  ...options
 });
-var sessionsRetrieve = (options) => (options.client ?? client).get({
+var sessionsList = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16297,10 +17741,10 @@ var sessionsRetrieve = (options) => (options.client ?? client).get({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/sessions/{session_id}",
+  url: "/agent/v1/sessions",
   ...options
 });
-var sessionsUpdate = (options) => (options.client ?? client).post({
+var sessionsCreate = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
     scheme: "bearer",
@@ -16310,7 +17754,7 @@ var sessionsUpdate = (options) => (options.client ?? client).post({
     name: "X-API-Key",
     type: "apiKey"
   }],
-  url: "/agent/v1/sessions/{session_id}",
+  url: "/agent/v1/sessions",
   ...options,
   headers: {
     "Content-Type": "application/json",
@@ -16811,6 +18255,15 @@ var applicationCreateVersion = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var applicationGetVersionAssetManifest = (options) => (options.client ?? client).get({
+  security: [{
+    key: "application-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/application/v1/workers/{worker_id}/versions/{version_id}/assets/manifest",
+  ...options
+});
 var applicationGetVersion = (options) => (options.client ?? client).get({
   security: [{
     key: "application-bearerAuth",
@@ -19631,8 +21084,26 @@ function createAgent(transport) {
     agents: {
       archive: bind(transport, agentsArchive),
       create: bind(transport, agentsCreate),
+      endUsers: {
+        block: {
+          create: bind(transport, blockEndUser)
+        },
+        delete: bind(transport, deleteEndUser),
+        list: bind(transport, listEndUsers),
+        retrieve: bind(transport, getEndUser),
+        retrieveDeletion: bind(transport, getEndUserDeletion),
+        revokeTokens: {
+          create: bind(transport, revokeEndUserTokens)
+        },
+        unblock: {
+          create: bind(transport, unblockEndUser)
+        }
+      },
       list: bind(transport, agentsList),
       retrieve: bind(transport, agentsRetrieve),
+      unarchive: {
+        create: bind(transport, unarchiveAgent)
+      },
       update: bind(transport, agentsUpdate),
       versions: {
         list: bind(transport, agentsVersionsList)
@@ -19650,6 +21121,12 @@ function createAgent(transport) {
         list: bind(transport, computersFilesList),
         retrieveContent: bind(transport, computersFilesContent)
       },
+      leases: {
+        delete: bind(transport, releaseComputerLease),
+        renew: {
+          create: bind(transport, renewComputerLease)
+        }
+      },
       list: bind(transport, computersList),
       retrieve: bind(transport, computersRetrieve),
       update: bind(transport, computersUpdate)
@@ -19672,8 +21149,21 @@ function createAgent(transport) {
       },
       update: bind(transport, deploymentsUpdate)
     },
+    embed: {
+      exchange: {
+        create: bind(transport, exchangeEmbedCode)
+      },
+      retrieveAppearance: bind(transport, getEmbedAppearance)
+    },
     embedTokens: {
-      create: bind(transport, createEmbedToken)
+      anonymous: {
+        create: bind(transport, createAnonymousEmbedToken)
+      },
+      create: bind(transport, createEmbedToken),
+      list: bind(transport, listEmbedTokens),
+      revoke: {
+        create: bind(transport, revokeEmbedToken)
+      }
     },
     environments: {
       archive: bind(transport, environmentsArchive),
@@ -19694,6 +21184,7 @@ function createAgent(transport) {
         list: bind(transport, listSessionCompactions)
       },
       create: bind(transport, sessionsCreate),
+      delete: bind(transport, sessionsDelete),
       events: {
         list: bind(transport, sessionsEventsList),
         send: bind(transport, sessionsEventsSend),
@@ -19710,6 +21201,12 @@ function createAgent(transport) {
       retrieve: bind(transport, sessionsRetrieve),
       retrieveCompact: bind(transport, getSessionCompaction),
       retrieveContext: bind(transport, getSessionContext),
+      runs: {
+        deleteFeedback: bind(transport, deleteRunFeedback),
+        feedback: {
+          create: bind(transport, setRunFeedback)
+        }
+      },
       threads: {
         archive: bind(transport, aliasOperation(sessionsThreadsArchive, { query: { session_id: "query_session_id" } })),
         events: {
@@ -19769,6 +21266,9 @@ function createApplication(transport) {
       },
       update: bind(transport, applicationUpdateWorker),
       versions: {
+        assets: {
+          retrieveManifest: bind(transport, applicationGetVersionAssetManifest)
+        },
         create: bind(transport, applicationCreateVersion),
         list: bindPage(transport, applicationListVersions),
         retrieve: bind(transport, applicationGetVersion)
@@ -19976,6 +21476,14 @@ function createFile(transport) {
       list: bind(transport, fileListFiles),
       retrieve: bind(transport, fileRetrieveFile),
       retrieveContent: bind(transport, fileRetrieveFileContent)
+    },
+    uploads: {
+      cancel: bind(transport, fileCancelUpload),
+      complete: bind(transport, fileCompleteUpload),
+      create: bind(transport, fileCreateUpload),
+      parts: {
+        create: bind(transport, (options) => fileAddUploadPart({ ...options, bodySerializer: multipartBodySerializer, headers: { "Content-Type": null, ...options.headers } }))
+      }
     }
   };
 }
@@ -20184,7 +21692,16 @@ function createOrganization(transport) {
       retrieve: bind(transport, getOrganizationEvent)
     },
     feedback: {
-      create: bind(transport, createOrganizationFeedback)
+      counts: {
+        list: bind(transport, getOrganizationFeedbackCounts)
+      },
+      create: bind(transport, createOrganizationFeedback),
+      list: bind(transport, listOrganizationFeedback),
+      messages: {
+        create: bind(transport, createOrganizationFeedbackMessage),
+        list: bind(transport, listOrganizationFeedbackMessages)
+      },
+      retrieve: bind(transport, getOrganizationFeedback)
     },
     usage: {
       list: bind(transport, listOrganizationUsage)
@@ -20337,132 +21854,6 @@ var resourceFactories = {
   vault: createVault
 };
 
-// ../../packages/sdk/typescript/src/core/errors.ts
-function problemFrom(status, headers, body, statusText) {
-  const value = body && typeof body === "object" ? body : {};
-  const nested = value.error && typeof value.error === "object" ? value.error : {};
-  const string = (v) => typeof v === "string" && v.trim() ? v : undefined;
-  const fallback = statusText || { 400: "Bad Request", 401: "Unauthorized", 403: "Forbidden", 404: "Not Found", 405: "Method Not Allowed", 408: "Request Timeout", 409: "Conflict", 413: "Payload Too Large", 415: "Unsupported Media Type", 422: "Unprocessable Entity", 429: "Too Many Requests", 500: "Internal Server Error", 502: "Bad Gateway", 503: "Service Unavailable", 504: "Gateway Timeout" }[status] || `HTTP ${status}`;
-  const detail = string(value.detail) ?? string(nested.message) ?? string(value.message) ?? string(body);
-  const title = string(value.title) ?? fallback;
-  const param = nested.param ?? value.param;
-  return {
-    status,
-    message: detail ?? title,
-    title,
-    detail,
-    code: string(value.code) ?? string(nested.code) ?? string(nested.type) ?? string(value.error_code),
-    type: string(nested.type) ?? string(value.type),
-    param: typeof param === "string" ? param : param === null || nested.param === null ? null : undefined,
-    errors: Array.isArray(value.errors) ? value.errors : [],
-    requestId: headers.get("x-request-id") ?? string(value.requestId) ?? string(value.request_id),
-    raw: body
-  };
-}
-
-class PraxisError extends Error {
-  status;
-  code;
-  type;
-  title;
-  detail;
-  errors;
-  requestId;
-  param;
-  raw;
-  constructor(problem = {}, options) {
-    super(problem.message ?? problem.detail ?? problem.title ?? `Praxis request failed${problem.status ? ` (${problem.status})` : ""}`, options);
-    this.name = "PraxisError";
-    this.status = problem.status;
-    this.code = problem.code;
-    this.type = problem.type;
-    this.title = problem.title;
-    this.detail = problem.detail;
-    this.errors = problem.errors ?? [];
-    this.requestId = problem.requestId;
-    this.param = problem.param;
-    this.raw = problem.raw;
-  }
-  static fromResponse(response, body) {
-    return new PraxisError(problemFrom(response.status, response.headers, body, response.statusText));
-  }
-}
-
-class PraxisConnectionError extends PraxisError {
-  constructor(cause) {
-    super({ code: "CONNECTION_ERROR", title: "Unable to connect to Praxis" }, { cause });
-    this.name = "PraxisConnectionError";
-  }
-}
-
-class PraxisTimeoutError extends PraxisError {
-  constructor(timeoutMs) {
-    super({ code: "TIMEOUT", title: `Praxis request exceeded ${timeoutMs} ms` });
-    this.name = "PraxisTimeoutError";
-  }
-}
-
-// ../../packages/sdk/typescript/src/core/retry.ts
-function canRetry(request) {
-  return request.method !== "POST" || Boolean(request.headers.get("Idempotency-Key")?.trim());
-}
-function retryAfterMs(value, now = Date.now()) {
-  if (!value)
-    return;
-  if (/^\d+(?:\.\d+)?$/.test(value.trim()))
-    return Number(value) * 1000;
-  const date = Date.parse(value);
-  return Number.isFinite(date) ? Math.max(0, date - now) : undefined;
-}
-function retryDelay(attempt, retryAfter, random = Math.random) {
-  return retryAfterMs(retryAfter) ?? Math.min(30000, 500 * 2 ** attempt) * (0.5 + random() * 0.5);
-}
-function abortable(promise, signal) {
-  signal.throwIfAborted();
-  return new Promise((resolve, reject) => {
-    const abort = () => reject(signal.reason);
-    signal.addEventListener("abort", abort, { once: true });
-    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
-  });
-}
-function sleep(ms, signal) {
-  signal.throwIfAborted();
-  return new Promise((resolve, reject) => {
-    const abort = () => {
-      clearTimeout(timer);
-      reject(signal.reason);
-    };
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", abort);
-      resolve();
-    }, ms);
-    signal.addEventListener("abort", abort, { once: true });
-  });
-}
-async function fetchWithRetry(request, fetcher, options) {
-  const eligible = canRetry(request);
-  const wait = options.wait ?? sleep;
-  for (let attempt = 0;; attempt++) {
-    options.signal.throwIfAborted();
-    let response;
-    try {
-      response = await abortable(fetcher(request.clone()), options.signal);
-    } catch (cause) {
-      options.signal.throwIfAborted();
-      if (!eligible || attempt >= options.maxRetries)
-        throw new PraxisConnectionError(cause);
-      await wait(retryDelay(attempt, null, options.random), options.signal);
-      continue;
-    }
-    const retriable = response.status === 408 || response.status === 429 || response.status >= 500 && response.status <= 599;
-    if (!eligible || !retriable || attempt >= options.maxRetries)
-      return response;
-    const delay = retryDelay(attempt, response.headers.get("Retry-After"), options.random);
-    await response.body?.cancel();
-    await wait(delay, options.signal);
-  }
-}
-
 // ../../packages/sdk/typescript/src/core/sse.ts
 async function* parseSSE(body, options = {}) {
   const reader = body.getReader();
@@ -20676,9 +22067,13 @@ class Transport {
     };
   }
   async request(operation, options = {}) {
+    return (await this.requestWithResponse(operation, options)).data;
+  }
+  async requestWithResponse(operation, options = {}) {
     const scope = this.scope(options, false);
     try {
-      return (await abortable(operation(scope.options), scope.signal)).data;
+      const result = await abortable(operation(scope.options), scope.signal);
+      return { data: result.data, response: result.response };
     } finally {
       scope.close();
     }
@@ -20710,6 +22105,10 @@ function base64(bytes) {
   return btoa(chunks.join(""));
 }
 async function publish(client2, input) {
+  const rolloutFields = ["gradual", "gradualRollout", "gradual_rollout", "canary", "rollout", "percentage", "percent", "traffic", "traffic_percentage", "strategy", "versions"];
+  if (Object.keys(input).some((key) => rolloutFields.includes(key) || /percentage|percent|canary|gradual|rollout|灰度/i.test(key))) {
+    throw new PraxisError({ code: "INVALID_PARAMS", message: '平台不支持灰度 (gradual rollout is not supported). Roll back with praxis.application.workers.deployments.create({ path: { worker_id }, body: { strategy: "percentage", versions: [{ version_id: previousVersionId, percentage: 100 }] } }); the previous version artifacts must still be retained.' });
+  }
   const timeout = input.timeout_ms ?? 120000;
   if (!Number.isFinite(timeout) || timeout < 0)
     throw new RangeError("timeout_ms must be non-negative and finite");
@@ -20728,7 +22127,7 @@ async function publish(client2, input) {
   const files = Object.entries(input.files);
   if (files.length > 1e5)
     throw new PraxisError({ code: "LIMIT_EXCEEDED", message: "At most 100000 asset paths can be published" });
-  const manifest = {};
+  let manifest = {};
   const contents = new Map;
   for (const [path2, content] of files) {
     const normalized = path2.startsWith("/") ? path2 : `/${path2}`;
@@ -20737,8 +22136,8 @@ async function publish(client2, input) {
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
     if (bytes.length > FILE_BYTES)
       throw new PraxisError({ code: "LIMIT_EXCEEDED", message: `Asset ${normalized} exceeds 25 MiB` });
-    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
-    const hash = Array.from(digest.subarray(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("");
+    const digest2 = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    const hash = Array.from(digest2.subarray(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("");
     manifest[normalized] = { hash, size: bytes.length };
     contents.set(hash, bytes);
   }
@@ -20751,9 +22150,60 @@ async function publish(client2, input) {
     }
   }
   const created = !worker;
+  if (!worker && input.dryRun)
+    throw new PraxisError({ code: "NOT_FOUND", message: "请先创建应用 (create the application before dryRun)" });
   worker ??= await workers.create({ body: { name: input.name, subdomain: { enabled: true } } });
   const path = { worker_id: worker.id };
+  let currentVersion;
+  let currentDeployment;
+  let previous = {};
+  if (worker.praxis?.current_deployment_id) {
+    currentDeployment = await workers.deployments.retrieve({ path: { ...path, deployment_id: worker.praxis.current_deployment_id } });
+    const active = currentDeployment.versions[0];
+    if (!active)
+      throw new PraxisError({ code: "INVALID_RESPONSE", message: "Current deployment has no version" });
+    currentVersion = await workers.versions.retrieve({ path: { ...path, version_id: active.version_id } });
+    previous = (await workers.versions.assets.retrieveManifest({ path: { ...path, version_id: active.version_id } })).manifest;
+  }
+  manifest = {
+    ...Object.fromEntries(Object.entries(previous).filter(([key]) => input.keepExisting || Object.hasOwn(manifest, key))),
+    ...manifest
+  };
+  if (Object.keys(manifest).length > 1e5)
+    throw new PraxisError({ code: "LIMIT_EXCEEDED", message: "At most 100000 asset paths can be published" });
+  const added = Object.keys(manifest).filter((key) => !Object.hasOwn(previous, key));
+  const changed = Object.keys(manifest).filter((key) => previous[key] && (previous[key].hash !== manifest[key].hash || previous[key].size !== manifest[key].size));
+  const removed = Object.keys(previous).filter((key) => !Object.hasOwn(manifest, key));
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(manifest))));
+  const manifestHash = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const staticOnly = !["main", "bindings", "compatibility_date", "compatibility_flags", "assets_config"].some((key) => Object.hasOwn(input, key));
+  const unchanged = staticOnly && !!currentVersion && manifestHash === currentVersion.praxis.assets_manifest?.manifest_hash;
+  const hashes = new Set(Object.values(manifest).map((entry) => entry.hash));
+  const currentResult = {
+    url: worker.subdomain.url,
+    worker_id: worker.id,
+    version_id: currentVersion?.id ?? null,
+    deployment_id: currentDeployment?.id ?? null,
+    status: currentDeployment?.praxis.status ?? "draft",
+    created,
+    ...currentVersion ? { version: currentVersion } : {},
+    unchanged,
+    uploaded: 0,
+    reused: hashes.size
+  };
+  if (unchanged && !input.dryRun)
+    return currentResult;
   const session = await workers.assetsUploadSession.create({ path, body: { manifest } });
+  if (input.dryRun) {
+    const missing = new Set(session.buckets.flat());
+    if ([...missing].some((hash) => !hashes.has(hash)))
+      throw new PraxisError({ code: "INVALID_RESPONSE", message: "Upload session requested an unknown hash" });
+    return {
+      ...currentResult,
+      reused: hashes.size - missing.size,
+      plan: { added, changed, removed, upload_hashes: missing.size, existing_hashes: hashes.size - missing.size }
+    };
+  }
   let jwt = session.buckets.length ? null : session.jwt;
   const uploaded = new Set;
   for (const bucket of session.buckets) {
@@ -20824,16 +22274,31 @@ async function publish(client2, input) {
     status: deployment.praxis.status,
     created,
     uploaded: uploaded.size,
-    reused: contents.size - uploaded.size
+    reused: hashes.size - uploaded.size
   };
 }
 
+// ../../packages/sdk/typescript/src/helpers/database-count.ts
+async function count(transport, input) {
+  const { response } = await transport.requestWithResponse(databaseHead, {
+    path: { database_id: input.database_id, table: input.table },
+    query: input.filters,
+    headers: { Prefer: `count=${input.count ?? "exact"}` }
+  });
+  const total = response.headers.get("Content-Range")?.split("/")[1];
+  return { count: total === undefined || total === "*" ? null : Number(total) };
+}
+
 // ../../packages/sdk/typescript/src/core/client.ts
 class Praxis {
   constructor(options) {
     const transport = new Transport(options);
     for (const [name, create] of Object.entries(resourceFactories)) {
       const resource = create(transport);
+      if (name === "file")
+        Object.assign(resource, { uploadFile: (file, options2) => uploadFile(this, file, options2) });
+      if (name === "database")
+        Object.assign(resource, { count: (input) => count(transport, input) });
       if (name === "application")
         Object.assign(resource, { publish: (input) => publish(this, input) });
       Object.defineProperty(this, name, { value: resource, enumerable: true });
@@ -21965,7 +23430,7 @@ function plain(value) {
 }
 
 // src/output/human.ts
-var count = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
+var count3 = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
 function identity(result, ctx) {
   const op = "op" in result ? result.op : undefined;
   const split = op?.lastIndexOf(".") ?? -1;
@@ -22053,7 +23518,7 @@ function objectView(data, resource, id, ctx, paint) {
         return v.map(scalar).map(plain).join(", ");
       folded = true;
       const preview = v.slice(0, 3).map((item) => record(item).id ?? record(item).name).filter((x) => x !== undefined).map((x) => plain(scalar(x)));
-      return `${count(v.length, "item")}${preview.length ? ` (${preview.join(", ")})` : ""}`;
+      return `${count3(v.length, "item")}${preview.length ? ` (${preview.join(", ")})` : ""}`;
     }
     if (v !== null && typeof v === "object") {
       if (depth >= 1) {
@@ -22094,7 +23559,7 @@ function renderHuman(result, ctx) {
       return {
         stdout: result.items.length ? table(result.items, ctx, out) : out.dim(`No ${plain(resource)}${/(s|x|ch|sh)$/.test(resource) ? "es" : "s"}.`) + `
 `,
-        stderr: err.dim(`${result.total !== undefined ? `${result.items.length} of ${result.total} items` : count(result.items.length, "item")}${result.nextCursor ? ` · next: ${ctx.nextCommand ?? "praxis --help"}` : ""}`) + `
+        stderr: err.dim(`${result.total !== undefined ? `${result.items.length} of ${result.total} items` : count3(result.items.length, "item")}${result.nextCursor ? ` · next: ${ctx.nextCommand ?? "praxis --help"}` : ""}`) + `
 `
       };
     case "object": {
@@ -22374,7 +23839,7 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.1.0-dev.98b03cc";
+var version = "0.1.0-dev.a3beed2";
 var commands = commandTree(operations);
 var manual = [["login"], ["logout"], ["whoami"], ["org", "list"], ["org", "switch"], ["api"], ["skill"]];
 function route(argv) {