@deepraxis/sdk 0.1.0-dev.4cbfc1f → 0.1.0-dev.5dca2b5

package/dist/generated/types.gen.d.ts

@@ -714,7 +714,7 @@ export type BrowserStreamMessage = {
 };
 export type OwnFileCreateFileRequest = {
     /**
-     * File bytes in one multipart file part, not a filename or file ID. The file must be nonempty and at most 104857600 bytes; its content determines the MIME type.
+     * File bytes in one multipart file part, not a filename or file ID. The file must be nonempty and at most 100000000 bytes; its content determines the MIME type.
      */
     file: Blob | File;
     /**
@@ -739,7 +739,7 @@ export type OwnFileCreateFileRequest = {
  */
 export type OwnFileOpenAiFile = {
     /**
-     * File identifier: file_dp_ followed by a 26-character uppercase Crockford ULID. Use the ID returned by upload or list.
+     * File identifier: file- followed by 24 base62 characters. Use the ID returned by upload or list.
      */
     id: string;
     /**
@@ -753,7 +753,7 @@ export type OwnFileOpenAiFile = {
     /**
      * The Unix timestamp (in seconds) for when the file will expire.
      */
-    expires_at?: number;
+    expires_at?: number | null;
     /**
      * The name of the file.
      */
@@ -772,22 +772,12 @@ export type OwnFileOpenAiFile = {
      * @deprecated
      */
     status: 'uploaded' | 'processed' | 'error';
-    /**
-     * Deprecated; always null or absent.
-     *
-     * @deprecated
-     */
-    status_details?: string | null;
     /**
      * Content-detected MIME type.
      */
     mime_type: string;
     /**
-     * Tenant-owned live files can be downloaded through this face.
-     */
-    downloadable: true;
-    /**
-     * Present for session output files.
+     * Session scope for session outputs; null for other files.
      */
     scope?: {
         /**
@@ -798,7 +788,7 @@ export type OwnFileOpenAiFile = {
          * Id of the session the file belongs to.
          */
         id: string;
-    };
+    } | null;
     /**
      * Path within the session output directory; present for session outputs.
      */
@@ -807,6 +797,18 @@ export type OwnFileOpenAiFile = {
      * Session output revision; present for session outputs.
      */
     revision?: number;
+    /**
+     * processing is not yet usable; active is ready; expired cannot be read.
+     */
+    state: 'processing' | 'active' | 'expired';
+    /**
+     * upload is user-provided, generated is platform-produced, session is a session output.
+     */
+    source: 'upload' | 'generated' | 'session';
+    /**
+     * Content digest, prefixed sha256:. Available after processing completes.
+     */
+    sha256: string;
 };
 export type OwnFileErrorResponse = {
     error: OwnFileError;
@@ -835,7 +837,7 @@ export type OwnFileListFilesResponse = {
 };
 export type OwnFileDeleteFileResponse = {
     /**
-     * File identifier: file_dp_ followed by a 26-character uppercase Crockford ULID. Use the ID returned by upload or list.
+     * File identifier: file- followed by 24 base62 characters. Use the ID returned by upload or list.
      */
     id: string;
     /**
@@ -847,6 +849,132 @@ export type OwnFileDeleteFileResponse = {
      */
     deleted: boolean;
 };
+export type OwnFilePraxisCreateUpload = {
+    /**
+     * Exact complete file length in bytes, from 1 through 2147483648 (2 GiB); the sum of completed parts must match.
+     */
+    bytes: number;
+    /**
+     * Filename for the resulting file, at most 255 UTF-8 bytes.
+     */
+    filename: string;
+    /**
+     * Declared MIME type; validated against the assembled content.
+     */
+    mime_type: string;
+    /**
+     * Use user_data for conversation attachments, assistants for assistant files, or vision for PNG, JPEG, GIF and WebP images.
+     */
+    purpose: 'user_data' | 'assistants' | 'vision';
+    /**
+     * Optional expiry policy for the resulting file; omission retains the file until deletion.
+     */
+    expires_after?: {
+        /**
+         * Expiry is measured from file creation; created_at is the only supported anchor.
+         */
+        anchor?: 'created_at';
+        /**
+         * Resulting file lifetime in seconds; omit expires_after to retain it until deletion.
+         */
+        seconds: number;
+    };
+    /**
+     * Optional fixed part size in bytes, 5242880–64000000. Requires part_number on every part; retries of identical bytes at the same number return the same part. Omit to use arbitrary-sized parts.
+     */
+    part_size?: number;
+};
+export type OwnFilePraxisUpload = {
+    /**
+     * Upload identifier returned by create. Use this value for parts, complete and cancel.
+     */
+    id: string;
+    /**
+     * Object type; upload identifies an upload session.
+     */
+    object: 'upload';
+    /**
+     * Declared size of the complete file in bytes.
+     */
+    bytes: number;
+    /**
+     * Creation time as Unix seconds.
+     */
+    created_at: number;
+    /**
+     * Expiry time as Unix seconds; unfinished uploads expire after one hour.
+     */
+    expires_at: number;
+    /**
+     * Filename supplied when creating the upload.
+     */
+    filename: string;
+    /**
+     * File purpose: user_data for conversation attachments, assistants for assistant files, vision for images.
+     */
+    purpose: 'user_data' | 'assistants' | 'vision';
+    /**
+     * Upload state: pending accepts parts; completed has a file; cancelled was cancelled; expired exceeded its one-hour lifetime.
+     */
+    status: 'pending' | 'completed' | 'cancelled' | 'expired';
+    /**
+     * Present after complete. A file with status uploaded is still processing; poll files.retrieve until processed before use.
+     */
+    file?: OwnFileOpenAiFile | null;
+    /**
+     * Declared MIME type, verified during assembly.
+     */
+    mime_type?: string;
+    /**
+     * Assembly failure, or null if no failure is recorded.
+     */
+    error?: {
+        /**
+         * File service error code identifying the assembly failure.
+         */
+        code: string;
+        /**
+         * Explanation of why assembly failed.
+         */
+        message: string;
+    } | null;
+};
+export type OwnFilePraxisUploadPart = {
+    /**
+     * Part identifier returned by this request. Supply it to complete in file byte order.
+     */
+    id: string;
+    /**
+     * Object type; upload.part identifies an uploaded part.
+     */
+    object: 'upload.part';
+    /**
+     * Part creation time as Unix seconds.
+     */
+    created_at: number;
+    /**
+     * Parent upload identifier supplied in the request path.
+     */
+    upload_id: string;
+    /**
+     * Accepted part length in bytes.
+     */
+    bytes?: number;
+    /**
+     * Part content digest prefixed sha256:.
+     */
+    sha256?: string;
+};
+export type OwnFilePraxisCompleteUpload = {
+    /**
+     * All part IDs in concatenation order, without duplicates. Fixed-size uploads require increasing part_number order.
+     */
+    part_ids: Array<string>;
+    /**
+     * Optional whole-file MD5 as 32 hexadecimal characters; verified after assembly.
+     */
+    md5?: string;
+};
 /**
  * Problem document returned by the Meta method catalog on failure.
  */
@@ -3784,7 +3912,7 @@ export type SandboxSandboxDetail = {
      */
     allowInternetAccess?: boolean;
     /**
-     * Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix.
+     * Base domain where the sandbox traffic is accessible
      */
     domain?: string;
     cpuCount: SandboxCpuCount;
@@ -11739,7 +11867,7 @@ export type MediaMediaEventPage = MediaPage & {
  */
 export type SandboxNewSandboxV2 = {
     /**
-     * Template ID or alias from templates.list; resolves to your ready Environment first, then a public Base. Omit it to use the default base template (`base`).
+     * Identifier of the required template
      */
     templateID: string;
     /**
@@ -11801,7 +11929,7 @@ export type SandboxSandbox = {
      */
     trafficAccessToken?: string;
     /**
-     * Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix.
+     * Base domain where the sandbox traffic is accessible
      */
     domain?: string;
 };
@@ -17085,7 +17213,7 @@ export type SandboxSandboxNetworkConfig = {
      */
     maskRequestHost?: string;
     /**
-     * Unlike E2B, network.httpsPorts is rejected; omit it and serve plaintext HTTP inside the sandbox. The public port URL still uses HTTPS. The upstream field denotes HTTPS-speaking internal ports, permits self-signed certificates and excludes envd port 49983.
+     * Unlike E2B, network.httpsPorts is rejected; omit it when creating a sandbox.
      */
     httpsPorts?: Array<number>;
     /**
@@ -27281,6 +27409,69 @@ export type UnarchiveAgentResponses = {
          * modified.
          */
         version: number;
+        /**
+         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        databases: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        vector_stores: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        files: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
         /**
          * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
          */
@@ -30106,7 +30297,7 @@ export type ConnectComputerErrors = {
         };
     };
     /**
-     * COMPUTER_BUDGET_EXHAUSTED: today's full-computer time has been used up. Connect with need light to continue using the lightweight shell.
+     * Platform error with Computer code, message and hint
      */
     429: {
         error: {
@@ -32122,7 +32313,7 @@ export type ForkSessionResponses = {
          */
         created_at: string;
         /**
-         * Id of the environment recipe the session's sandbox was created from. Omitted when no recipe was selected, that is, for a light machine or the Computer chosen by computer_id.
+         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         /**
@@ -34358,7 +34549,7 @@ export type FileDeleteFileData = {
     body?: never;
     path: {
         /**
-         * ID of a tenant-owned live file, as returned by upload or list; starts with file_dp_.
+         * ID of a tenant-owned live file, as returned by upload or list; starts with file-.
          */
         file_id: string;
     };
@@ -34387,7 +34578,7 @@ export type FileRetrieveFileData = {
     body?: never;
     path: {
         /**
-         * ID of a tenant-owned live file, as returned by upload or list; starts with file_dp_.
+         * ID of a tenant-owned live file, as returned by upload or list; starts with file-.
          */
         file_id: string;
     };
@@ -34416,7 +34607,7 @@ export type FileRetrieveFileContentData = {
     body?: never;
     path: {
         /**
-         * ID of a tenant-owned live file, as returned by upload or list; starts with file_dp_.
+         * ID of a tenant-owned live file, as returned by upload or list; starts with file-.
          */
         file_id: string;
     };
@@ -34449,6 +34640,139 @@ export type FileRetrieveFileContentResponses = {
     200: Blob | File;
 };
 export type FileRetrieveFileContentResponse = FileRetrieveFileContentResponses[keyof FileRetrieveFileContentResponses];
+export type FileCreateUploadData = {
+    body: OwnFilePraxisCreateUpload;
+    path?: never;
+    query?: never;
+    url: '/file/v1/uploads';
+};
+export type FileCreateUploadErrors = {
+    /**
+     * Invalid upload input or upload state; correct the request before retrying.
+     */
+    400: unknown;
+    /**
+     * The upload is missing or belongs to another organization.
+     */
+    404: unknown;
+    /**
+     * Completion inputs conflict with an earlier completion request.
+     */
+    409: unknown;
+};
+export type FileCreateUploadResponses = {
+    /**
+     * The upload state and, after completion, the resulting file.
+     */
+    200: OwnFilePraxisUpload;
+};
+export type FileCreateUploadResponse = FileCreateUploadResponses[keyof FileCreateUploadResponses];
+export type FileAddUploadPartData = {
+    body: {
+        /**
+         * Raw bytes of this part, nonempty and at most 64000000 bytes.
+         */
+        data: Blob | File;
+    };
+    path: {
+        /**
+         * Upload identifier from create.
+         */
+        upload_id: string;
+    };
+    query?: {
+        /**
+         * Fixed part position, starting at 1.
+         */
+        part_number?: number;
+    };
+    url: '/file/v1/uploads/{upload_id}/parts';
+};
+export type FileAddUploadPartErrors = {
+    /**
+     * Invalid upload input or upload state; correct the request before retrying.
+     */
+    400: unknown;
+    /**
+     * The upload is missing or belongs to another organization.
+     */
+    404: unknown;
+    /**
+     * Completion inputs conflict with an earlier completion request.
+     */
+    409: unknown;
+};
+export type FileAddUploadPartResponses = {
+    /**
+     * The part was accepted.
+     */
+    200: OwnFilePraxisUploadPart;
+};
+export type FileAddUploadPartResponse = FileAddUploadPartResponses[keyof FileAddUploadPartResponses];
+export type FileCompleteUploadData = {
+    body: OwnFilePraxisCompleteUpload;
+    path: {
+        /**
+         * Upload identifier from create.
+         */
+        upload_id: string;
+    };
+    query?: never;
+    url: '/file/v1/uploads/{upload_id}/complete';
+};
+export type FileCompleteUploadErrors = {
+    /**
+     * Invalid upload input or upload state; correct the request before retrying.
+     */
+    400: unknown;
+    /**
+     * The upload is missing or belongs to another organization.
+     */
+    404: unknown;
+    /**
+     * Completion inputs conflict with an earlier completion request.
+     */
+    409: unknown;
+};
+export type FileCompleteUploadResponses = {
+    /**
+     * The upload state and, after completion, the resulting file.
+     */
+    200: OwnFilePraxisUpload;
+};
+export type FileCompleteUploadResponse = FileCompleteUploadResponses[keyof FileCompleteUploadResponses];
+export type FileCancelUploadData = {
+    body?: never;
+    path: {
+        /**
+         * Upload identifier from create.
+         */
+        upload_id: string;
+    };
+    query?: never;
+    url: '/file/v1/uploads/{upload_id}/cancel';
+};
+export type FileCancelUploadErrors = {
+    /**
+     * Invalid upload input or upload state; correct the request before retrying.
+     */
+    400: unknown;
+    /**
+     * The upload is missing or belongs to another organization.
+     */
+    404: unknown;
+    /**
+     * Completion inputs conflict with an earlier completion request.
+     */
+    409: unknown;
+};
+export type FileCancelUploadResponses = {
+    /**
+     * The upload state and, after completion, the resulting file.
+     */
+    200: OwnFilePraxisUpload;
+};
+export type FileCancelUploadResponse = FileCancelUploadResponses[keyof FileCancelUploadResponses];
 export type HealthCheckData = {
     body?: never;
     path?: never;
@@ -38672,7 +38996,7 @@ export type ListOrganizationFeedbackResponse = ListOrganizationFeedbackResponses
 export type CreateOrganizationFeedbackData = {
     body: {
         /**
-         * Problem description and original error text; at most 4096 Unicode code points.
+         * Problem description, at most 4096 Unicode code points; may be empty only when contexts.praxis.error.message is a non-empty string.
          */
         message: string;
         /**
@@ -40703,7 +41027,7 @@ export type SessionsRetrieveResponses = {
          */
         created_at: string;
         /**
-         * Id of the environment recipe the session's sandbox was created from. Omitted when no recipe was selected, that is, for a light machine or the Computer chosen by computer_id.
+         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -40981,7 +41305,7 @@ export type SessionsUpdateResponses = {
          */
         created_at: string;
         /**
-         * Id of the environment recipe the session's sandbox was created from. Omitted when no recipe was selected, that is, for a light machine or the Computer chosen by computer_id.
+         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -41229,6 +41553,69 @@ export type AgentsListResponses = {
              * modified.
              */
             version: number;
+            /**
+             * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             */
+            databases: Array<{
+                /**
+                 * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+                 */
+                id: string;
+                /**
+                 * read_only permits reads of the bound resource; read_write permits reads and writes.
+                 */
+                access: 'read_only' | 'read_write';
+                /**
+                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 */
+                instructions?: string;
+                /**
+                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 */
+                enabled?: boolean;
+            }>;
+            /**
+             * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             */
+            vector_stores: Array<{
+                /**
+                 * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+                 */
+                id: string;
+                /**
+                 * read_only permits reads of the bound resource; read_write permits reads and writes.
+                 */
+                access: 'read_only' | 'read_write';
+                /**
+                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 */
+                instructions?: string;
+                /**
+                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 */
+                enabled?: boolean;
+            }>;
+            /**
+             * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             */
+            files: Array<{
+                /**
+                 * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+                 */
+                id: string;
+                /**
+                 * read_only permits reading the bound file; files do not accept read_write.
+                 */
+                access: 'read_only';
+                /**
+                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 */
+                instructions?: string;
+                /**
+                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 */
+                enabled?: boolean;
+            }>;
             /**
              * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
              */
@@ -41681,6 +42068,69 @@ export type AgentsCreateData = {
          * across all toolsets allowed.
          */
         tools?: Array<AgentManaged15 | AgentManaged29 | AgentManaged32>;
+        /**
+         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        databases?: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        vector_stores?: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        files?: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
         /**
          * Immutable agent kind. personal requires computer_id; service cannot bind a computer. Omit on create to infer from computer_id. On update, the same kind is ignored; changing kind or crossing its computer binding returns 400 invalid_request_error.
          */
@@ -42146,6 +42596,69 @@ export type AgentsCreateResponses = {
          * modified.
          */
         version: number;
+        /**
+         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        databases: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        vector_stores: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        files: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
         /**
          * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
          */
@@ -42626,6 +43139,69 @@ export type AgentsRetrieveResponses = {
          * modified.
          */
         version: number;
+        /**
+         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        databases: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        vector_stores: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        files: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
         /**
          * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
          */
@@ -43083,6 +43659,69 @@ export type AgentsUpdateData = {
          * current version; omit to apply the update unconditionally.
          */
         version?: number;
+        /**
+         * Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings.
+         */
+        databases?: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }> | null;
+        /**
+         * Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings.
+         */
+        vector_stores?: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }> | null;
+        /**
+         * Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings.
+         */
+        files?: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }> | null;
         /**
          * Immutable agent kind. personal requires computer_id; service cannot bind a computer. Omit on create to infer from computer_id. On update, the same kind is ignored; changing kind or crossing its computer binding returns 400 invalid_request_error.
          */
@@ -43553,6 +44192,69 @@ export type AgentsUpdateResponses = {
          * modified.
          */
         version: number;
+        /**
+         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        databases: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        vector_stores: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        files: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
         /**
          * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
          */
@@ -44027,6 +44729,69 @@ export type AgentsArchiveResponses = {
          * modified.
          */
         version: number;
+        /**
+         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        databases: Array<{
+            /**
+             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        vector_stores: Array<{
+            /**
+             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             */
+            access: 'read_only' | 'read_write';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
+        /**
+         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         */
+        files: Array<{
+            /**
+             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+             */
+            id: string;
+            /**
+             * read_only permits reading the bound file; files do not accept read_write.
+             */
+            access: 'read_only';
+            /**
+             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             */
+            instructions?: string;
+            /**
+             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             */
+            enabled?: boolean;
+        }>;
         /**
          * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
          */
@@ -44511,6 +45276,69 @@ export type AgentsVersionsListResponses = {
              * modified.
              */
             version: number;
+            /**
+             * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             */
+            databases: Array<{
+                /**
+                 * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+                 */
+                id: string;
+                /**
+                 * read_only permits reads of the bound resource; read_write permits reads and writes.
+                 */
+                access: 'read_only' | 'read_write';
+                /**
+                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 */
+                instructions?: string;
+                /**
+                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 */
+                enabled?: boolean;
+            }>;
+            /**
+             * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             */
+            vector_stores: Array<{
+                /**
+                 * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+                 */
+                id: string;
+                /**
+                 * read_only permits reads of the bound resource; read_write permits reads and writes.
+                 */
+                access: 'read_only' | 'read_write';
+                /**
+                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 */
+                instructions?: string;
+                /**
+                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 */
+                enabled?: boolean;
+            }>;
+            /**
+             * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             */
+            files: Array<{
+                /**
+                 * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
+                 */
+                id: string;
+                /**
+                 * read_only permits reading the bound file; files do not accept read_write.
+                 */
+                access: 'read_only';
+                /**
+                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 */
+                instructions?: string;
+                /**
+                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 */
+                enabled?: boolean;
+            }>;
             /**
              * Immutable agent kind. personal uses a durable computer; service uses a clean environment per session. Historical agents infer kind from their computer binding.
              */
@@ -45062,7 +45890,7 @@ export type SessionsListResponses = {
              */
             created_at: string;
             /**
-             * Id of the environment recipe the session's sandbox was created from. Omitted when no recipe was selected, that is, for a light machine or the Computer chosen by computer_id.
+             * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
              */
             environment_id?: string;
             metadata: AgentManaged173;
@@ -45196,10 +46024,9 @@ export type SessionsCreateData = {
          */
         agent: string | AgentManaged10 | AgentManaged167;
         /**
-         * ID of the `environment` defining the container configuration for
-         * this session.
+         * Execution environment id from agent.environments.list or agent.environments.create. For a service agent, omission selects the built-in light environment and returns session.environment_id=light; explicit null allocates no machine and makes machine tools, including codemode and bash, unavailable. Personal agents use their selected Computer.
          */
-        environment_id?: string;
+        environment_id?: string | null;
         /**
          * A hard spend ceiling. The session stops issuing new model requests
          * once the tracked list cost reaches `max_list_cost`.
@@ -45371,7 +46198,7 @@ export type SessionsCreateResponses = {
          */
         created_at: string;
         /**
-         * Id of the environment recipe the session's sandbox was created from. Omitted when no recipe was selected, that is, for a light machine or the Computer chosen by computer_id.
+         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -45609,7 +46436,7 @@ export type SessionsArchiveResponses = {
          */
         created_at: string;
         /**
-         * Id of the environment recipe the session's sandbox was created from. Omitted when no recipe was selected, that is, for a light machine or the Computer chosen by computer_id.
+         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;