@deepraxis/sdk 0.1.1-dev.d25d171 → 0.1.1-dev.de0a917

package/dist/operations.generated.d.ts

@@ -2,7 +2,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.agents";
     readonly method: "list";
     readonly summary: "List agents";
-    readonly description: "List the agents of the workspace behind your API key, newest first, in pages of at most 100 (default 20). Use it to find an agent id before creating a session; to read one agent use agents.retrieve, to see its history use agents.versions.list. Archived agents are hidden unless include_archived is true. Filter kind=personal for durable-computer agents or kind=service for per-session environments. Pass next_page from the response as page to read the next page; a null next_page means the end.";
+    readonly description: "List the agents of the workspace behind your API key, newest first, in pages of at most 100 (default 20). Use it to find an agent id before creating a session; to read one agent use agents.retrieve, to see its history use agents.versions.list. Archived agents are hidden unless include_archived is true. Filter kind=general or kind=personal for durable-computer agents, kind=service for per-session environments, or kind=assume for external MCP clients. Pass next_page from the response as page to read the next page; a null next_page means the end.";
     readonly http: "GET";
     readonly path: "/agent/v1/agents";
     readonly streaming: "no";
@@ -37,7 +37,7 @@ export declare const operations: readonly [{
     }, {
         readonly name: "kind";
         readonly type: "string";
-        readonly enum: readonly ["personal", "service"];
+        readonly enum: readonly ["general", "personal", "service", "assume"];
         readonly required: false;
         readonly description: "Filter agents by their immutable kind, including agents created before kind was recorded.";
     }];
@@ -45,7 +45,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.agents";
     readonly method: "create";
     readonly summary: "Create agent";
-    readonly description: "Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400. Use tools: [{type: \"agent_toolset_20260401\"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: \"agent_toolset_20260401\", default_config: {enabled: false}, configs: [{name: \"codemode\", enabled: true}, {name: \"bash\", enabled: true, permission_policy: {type: \"always_ask\"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. model and every models.allowed entry must be a catalog model that can run an agent: an unknown id returns 400 \"model <id> is not in the model catalog\" and an embedding, image or speech model returns 400 \"model <id> cannot run an agent\". name is a label, not a unique key: 1 to 256 characters after trimming, no NUL or line breaks. avatar is trimmed, must not contain spaces or point at a loopback, private or internal host, and its scheme is stored in lowercase. script and workflow binding ids are stored in lowercase, the form automation matches; bindings together with environment_id null return 400 because bindings need a machine. Example: {\"name\":\"helper\",\"model\":{\"id\":\"deepseek-flash\"},\"tools\":[{\"type\":\"agent_toolset_20260401\"}]}.";
+    readonly description: "Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400. Use tools: [{type: \"agent_toolset_20260401\"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: \"agent_toolset_20260401\", default_config: {enabled: false}, configs: [{name: \"codemode\", enabled: true}, {name: \"bash\", enabled: true, permission_policy: {type: \"always_ask\"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. model and every models.allowed entry must be a catalog model that can run an agent: an unknown id returns 400 \"model <id> is not in the model catalog\" and an embedding, image or speech model returns 400 \"model <id> cannot run an agent\". name is a label, not a unique key: 1 to 256 characters after trimming, no NUL or line breaks. avatar is trimmed, must not contain spaces or point at a loopback, private or internal host, and its scheme is stored in lowercase. script and workflow binding ids are stored in lowercase, the form automation matches; bindings together with environment_id null return 400 because bindings need a machine. Example: {\"name\":\"helper\",\"model\":{\"id\":\"deepseek-flash\"},\"tools\":[{\"type\":\"agent_toolset_20260401\"}]}. For kind assume, provide name without model, models, subagent_model, subagents or multiagent; omit computer_id to register a new computer named after the agent without starting an instance, or provide an existing computer_id; vault_ids are accepted, bindings and environment_id are refused. Drive assume agents over MCP at /agent/v1/agents/{id}/mcp.";
     readonly http: "POST";
     readonly path: "/agent/v1/agents";
     readonly streaming: "no";
@@ -57,8 +57,8 @@ export declare const operations: readonly [{
         readonly fields: readonly [{
             readonly name: "model";
             readonly type: "object";
-            readonly required: true;
-            readonly description: "A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected.";
+            readonly required: false;
+            readonly description: "A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected. Forbidden and omitted on assume agents.";
         }, {
             readonly name: "name";
             readonly type: "string";
@@ -84,7 +84,7 @@ export declare const operations: readonly [{
             readonly name: "multiagent";
             readonly type: "object";
             readonly required: false;
-            readonly description: "A coordinator topology: the session's primary thread orchestrates\nwork by spawning session threads, each running an agent drawn from the `agents`\nroster.";
+            readonly description: "Coordinator roster. A bare string agent id is equivalent to {type: \"agent\", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: \"self\"} refers to this agent. Specify a concrete version to pin it explicitly.";
         }, {
             readonly name: "skills";
             readonly type: "array";
@@ -107,13 +107,13 @@ export declare const operations: readonly [{
             readonly type: "array";
             readonly itemType: "object";
             readonly required: false;
-            readonly description: "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.";
+            readonly description: "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; general and personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings. Saving checks added or changed database, vector_store, media_library and file bindings in the organization: unknown or deleted ids return 400. If an owner is unavailable or takes more than 3 seconds, saving succeeds with verified=false for the affected bindings. Unchanged bindings keep their previous verification result and are not rechecked. workflow and script ids are not verified at save time.";
         }, {
             readonly name: "kind";
             readonly type: "string";
-            readonly enum: readonly ["personal", "service"];
+            readonly enum: readonly ["general", "personal", "service", "assume"];
             readonly required: false;
-            readonly description: "Immutable agent kind. personal requires computer_id; service cannot bind a computer. Omit on create to infer from computer_id. On update, the same kind is ignored; changing kind or crossing its computer binding returns 400 invalid_request_error.";
+            readonly description: "Immutable agent kind. general and personal require computer_id; service cannot bind a computer. Omit on create to infer from computer_id (general with a computer, service without). On update, the same kind is ignored; changing kind or crossing its computer binding returns 400 invalid_request_error. Assume agents use a durable computer driven over MCP without a conversation model; model, models, subagent_model, subagents and multiagent are forbidden and omitted.";
         }, {
             readonly name: "computer_id";
             readonly type: "string";
@@ -124,6 +124,11 @@ export declare const operations: readonly [{
             readonly type: "string";
             readonly required: false;
             readonly description: "Praxis extension: default subagent model ID, pinned in the agent revision. Call model overrides this; otherwise it overrides the roster member model or the parent model for built-ins. Null clears the default. /agent/v1 only.";
+        }, {
+            readonly name: "image_model";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Model used by the imagine image tool; defaults to gpt-image-2 when unset. Only models that can generate images are accepted. Omit to preserve; null clears the configured model. /agent/v1 only.";
         }, {
             readonly name: "subagents";
             readonly type: "array";
@@ -140,7 +145,7 @@ export declare const operations: readonly [{
             readonly name: "settings";
             readonly type: "object";
             readonly required: false;
-            readonly description: "Praxis extension: managed settings saved with the configuration revision. Omit to preserve; null clears. Configuration storage only; these switches and hooks are not applied to runtime yet. /agent/v1 only.";
+            readonly description: "Agent runtime settings follow Claude Code managed settings. Praxis freezes output-style selection for each new session; inline output_styles extend file-based styles. Omit settings to keep saved settings; null clears them.";
         }, {
             readonly name: "models";
             readonly type: "object";
@@ -150,7 +155,7 @@ export declare const operations: readonly [{
             readonly name: "avatar";
             readonly type: "string";
             readonly required: false;
-            readonly description: "Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. Both personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it.";
+            readonly description: "Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. General, personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it.";
         }, {
             readonly name: "environment_id";
             readonly type: "string";
@@ -168,13 +173,19 @@ export declare const operations: readonly [{
             readonly enum: readonly ["minimal", "data-editor", "full"];
             readonly required: false;
             readonly description: "Optional tool preset. minimal enables read, glob, grep and ask_user_question; data-editor also enables write and edit; full uses the default toolset with always_allow. Explicit tools override matching preset entries. codemode requires bash and is absent from data-editor.";
+        }, {
+            readonly name: "output_styles";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: false;
+            readonly description: "Inline custom output styles, including for agents without a computer. Omit to keep the saved list; null or [] clears it. Same-name precedence is inline, project files, personal files, then plugins. Selection is settings.outputStyle; styles apply to main conversations and are frozen per session.";
         }];
     };
 }, {
     readonly resource: "agent.agents";
     readonly method: "retrieve";
     readonly summary: "Get agent";
-    readonly description: "Read one agent by id. The top level is the latest saved version, the editable head whose version you send back for optimistic concurrency; after a save with apply false it differs from active_version, and new sessions use active_version, which you read with version=active. With version, read a specific saved version. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so it can be sent back unchanged to agents.update. Use agents.versions.list to enumerate versions.";
+    readonly description: "Read the agent configuration currently effective for new sessions. By default, version equals active_version and latest_version identifies the newest saved version, including an unapplied save. Use latest_version for optimistic concurrency when updating. Pass version as a positive integer to read that saved version; version=active is equivalent to omission. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so tools can be sent back unchanged to agents.update. Use agents.versions.list to enumerate saved versions.";
     readonly http: "GET";
     readonly path: "/agent/v1/agents/{agent_id}";
     readonly streaming: "no";
@@ -182,19 +193,19 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name.";
+        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [{
         readonly name: "version";
         readonly type: "number";
         readonly required: false;
-        readonly description: "Agent version to read; omit for the latest saved version. An integer of at least 1 (versions are listed by agents.versions.list), or the string active for the version new sessions use.";
+        readonly description: "Agent version to read. Omit, or send active, for the currently effective version used by new sessions. Send an integer of at least 1 from agents.versions.list to read that saved version. The default response also includes latest_version, the newest saved version number.";
     }];
 }, {
     readonly resource: "agent.agents";
     readonly method: "update";
     readonly summary: "Update agent";
-    readonly description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version. apply defaults to true and moves active_version to the new version, or to the latest when configuration is unchanged; apply false saves without applying. version_note optionally records up to 280 characters on a newly created version; null means no note, and a note sent when the request changes nothing else returns 400 because a note is stored only with a new version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400.";
+    readonly description: "Save configuration changes as a new immutable version. Send latest_version from a default retrieve or update response as the request version for optimistic concurrency; a stale value returns 409. apply defaults to true and makes the new version effective; apply false saves without changing active_version. The response contains the effective configuration, with version equal to active_version and latest_version naming the newest saved version. An unchanged configuration, including a note-only update, is a no-op returning 200 and the current effective version without creating or activating a version. version_note records up to 280 characters only when a configuration change creates a new version; null is equivalent to omission. Use agents.versions.apply to activate an existing saved version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400. Assume agents reject model, models, subagent_model, subagents and multiagent on every update; other fields follow the general agent rules, with vault_ids also accepted.";
     readonly http: "POST";
     readonly path: "/agent/v1/agents/{agent_id}";
     readonly streaming: "no";
@@ -202,7 +213,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name.";
+        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
     readonly body: {
@@ -227,12 +238,12 @@ export declare const operations: readonly [{
             readonly name: "model";
             readonly type: "object";
             readonly required: false;
-            readonly description: "A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected.";
+            readonly description: "A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected. Forbidden and omitted on assume agents.";
         }, {
             readonly name: "multiagent";
             readonly type: "object";
             readonly required: false;
-            readonly description: "A coordinator topology: the session's primary thread orchestrates\nwork by spawning session threads, each running an agent drawn from the `agents`\nroster.";
+            readonly description: "Coordinator roster. A bare string agent id is equivalent to {type: \"agent\", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: \"self\"} refers to this agent. Specify a concrete version to pin it explicitly.";
         }, {
             readonly name: "name";
             readonly type: "string";
@@ -259,17 +270,17 @@ export declare const operations: readonly [{
             readonly name: "version";
             readonly type: "number";
             readonly required: false;
-            readonly description: "The agent's current version, used to prevent concurrent overwrites.\nObtain this value from a create or retrieve response. Must be at least 1 if\nspecified. When supplied, the request fails if it does not match the server's\ncurrent version; omit to apply the update unconditionally.";
+            readonly description: "Newest saved version used for optimistic concurrency. Obtain latest_version from the default retrieve or update response, or version from versions.list. A stale value returns 409; omit for an unconditional update.";
         }, {
             readonly name: "apply";
             readonly type: "boolean";
             readonly required: false;
-            readonly description: "Defaults to true: apply the newly saved version, or the latest version when configuration is unchanged. Set false to save without changing active_version. Unlike Managed Agents, saving and applying can be separate.";
+            readonly description: "Defaults to true: apply a newly saved configuration version. Set false to save without changing active_version. An unchanged configuration is a no-op, including note-only updates; use versions.apply to activate a saved version.";
         }, {
             readonly name: "version_note";
             readonly type: "string";
             readonly required: false;
-            readonly description: "Optional change explanation stored as note on the new immutable version, up to 280 characters. Omission or null stores no note. A note sent when nothing else changes returns 400 (nothing to save), because a note is stored only with a new version.";
+            readonly description: "Optional change explanation, at most 280 characters. Recorded only when a configuration change creates a new immutable version. A note-only update is a no-op returning 200 and the current effective version. Null is equivalent to omission.";
         }, {
             readonly name: "bindings";
             readonly type: "array";
@@ -279,9 +290,9 @@ export declare const operations: readonly [{
         }, {
             readonly name: "kind";
             readonly type: "string";
-            readonly enum: readonly ["personal", "service"];
+            readonly enum: readonly ["general", "personal", "service", "assume"];
             readonly required: false;
-            readonly description: "Immutable agent kind. personal requires computer_id; service cannot bind a computer. Omit on create to infer from computer_id. On update, the same kind is ignored; changing kind or crossing its computer binding returns 400 invalid_request_error.";
+            readonly description: "Immutable agent kind. general and personal require computer_id; service cannot bind a computer. Omit on create to infer from computer_id (general with a computer, service without). On update, the same kind is ignored; changing kind or crossing its computer binding returns 400 invalid_request_error. Assume agents use a durable computer driven over MCP without a conversation model; model, models, subagent_model, subagents and multiagent are forbidden and omitted.";
         }, {
             readonly name: "computer_id";
             readonly type: "string";
@@ -292,6 +303,11 @@ export declare const operations: readonly [{
             readonly type: "string";
             readonly required: false;
             readonly description: "Praxis extension: default subagent model ID, pinned in the agent revision. Call model overrides this; otherwise it overrides the roster member model or the parent model for built-ins. Null clears the default. /agent/v1 only.";
+        }, {
+            readonly name: "image_model";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Model used by the imagine image tool; defaults to gpt-image-2 when unset. Only models that can generate images are accepted. Omit to preserve; null clears the configured model. /agent/v1 only.";
         }, {
             readonly name: "subagents";
             readonly type: "array";
@@ -308,7 +324,7 @@ export declare const operations: readonly [{
             readonly name: "settings";
             readonly type: "object";
             readonly required: false;
-            readonly description: "Praxis extension: managed settings saved with the configuration revision. Omit to preserve; null clears. Configuration storage only; these switches and hooks are not applied to runtime yet. /agent/v1 only.";
+            readonly description: "Agent runtime settings follow Claude Code managed settings. Praxis freezes output-style selection for each new session; inline output_styles extend file-based styles. Omit settings to keep saved settings; null clears them.";
         }, {
             readonly name: "models";
             readonly type: "object";
@@ -318,7 +334,7 @@ export declare const operations: readonly [{
             readonly name: "avatar";
             readonly type: "string";
             readonly required: false;
-            readonly description: "Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. Both personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it.";
+            readonly description: "Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. General, personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it.";
         }, {
             readonly name: "environment_id";
             readonly type: "string";
@@ -336,8 +352,29 @@ export declare const operations: readonly [{
             readonly enum: readonly ["minimal", "data-editor", "full"];
             readonly required: false;
             readonly description: "Optional tool preset. minimal enables read, glob, grep and ask_user_question; data-editor also enables write and edit; full uses the default toolset with always_allow. Explicit tools override matching preset entries. codemode requires bash and is absent from data-editor.";
+        }, {
+            readonly name: "output_styles";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: false;
+            readonly description: "Inline custom output styles, including for agents without a computer. Omit to keep the saved list; null or [] clears it. Same-name precedence is inline, project files, personal files, then plugins. Selection is settings.outputStyle; styles apply to main conversations and are frozen per session.";
         }];
     };
+}, {
+    readonly resource: "agent.agents";
+    readonly method: "retrieveAppearance";
+    readonly summary: "Get agent appearance";
+    readonly description: "Read the saved chat appearance of a service agent.\n\nAgent Kit calls this from the page with a customer access token of this agent; your API key and console members can read it too. A token of another agent returns 404. The body is the same as the embed appearance read; a missing appearance returns the agent's own name and avatar only. Responses are private and cacheable for 60 seconds.";
+    readonly http: "GET";
+    readonly path: "/agent/v1/agents/{agent_id}/appearance";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "agent_id";
+        readonly sdkName: "agent_id";
+        readonly description: "Service agent id from agent creation or listing; with a customer access token, the agent the token was issued for. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
+    }];
+    readonly query: readonly [];
 }, {
     readonly resource: "agent.agents";
     readonly method: "archive";
@@ -350,9 +387,50 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name.";
+        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
+}, {
+    readonly resource: "agent.agents.customers";
+    readonly method: "list";
+    readonly summary: "List customers";
+    readonly description: "List the customers of a service agent, identified and anonymous, most recently seen first.\n\nCall this from your backend with your API key, or from the console. Customers follow Shopify Admin customers (list, retrieve, block, sign-out and data deletion of the people who use your storefront), so that experience applies. The list includes customers who signed in but have not started a session yet, and customers recorded under your own ids by embed tokens before customer sign-in existed; an id first seen that way is identified unless it starts with anon_. Unlike Shopify, a customer can be anonymous: a visitor admitted with the publishable key gets an anon_ id, and when it later signs in with anonymous_access_token it is merged: merged_into names the identified customer, and its sessions count toward that customer. Filter with q (a case-sensitive customer id prefix), type (identified or anonymous) and blocked (true or false). limit is 1 to 100, default 20; reuse next_page with the same filters and limit. A customer access token gets 404. Example: GET /agent/v1/agents/agent_example/customers?type=identified&blocked=false&limit=50.";
+    readonly http: "GET";
+    readonly path: "/agent/v1/agents/{agent_id}/customers";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "agent_id";
+        readonly sdkName: "agent_id";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
+    }];
+    readonly query: readonly [{
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum customers per page, 1 to 100; defaults to 20.";
+    }, {
+        readonly name: "page";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "next_page from the previous response with the same q, type, blocked and limit.";
+    }, {
+        readonly name: "q";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Case-sensitive literal prefix of the customer id; omit for all customers.";
+    }, {
+        readonly name: "type";
+        readonly type: "string";
+        readonly enum: readonly ["identified", "anonymous"];
+        readonly required: false;
+        readonly description: "Only identified or only anonymous customers; omit for both.";
+    }, {
+        readonly name: "blocked";
+        readonly type: "boolean";
+        readonly required: false;
+        readonly description: "true for blocked customers only, false for customers who are not blocked; omit for both.";
+    }];
 }, {
     readonly resource: "agent.agents.customers.auth.accessTokens";
     readonly method: "create";
@@ -365,7 +443,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing.";
+        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
     readonly body: {
@@ -384,7 +462,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing.";
+        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
 }, {
@@ -399,7 +477,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing.";
+        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
 }, {
@@ -414,7 +492,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing.";
+        readonly description: "Service agent id (agent_…) or its short identity number, from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
     readonly body: {
@@ -478,152 +556,122 @@ export declare const operations: readonly [{
         }];
     };
 }, {
-    readonly resource: "agent.agents.endUsers";
-    readonly method: "list";
-    readonly summary: "List End Users";
-    readonly description: "List users who have sessions or token issuance history on a service agent.\n\nOrdered by last_active_at and external_user_id descending. q is a case-sensitive literal prefix, including underscores. limit is 1–100, default 20. Reuse next_page with the same organization, agent, q and limit. Preemptively blocked users without history do not appear. End-user credentials and inaccessible or personal agents return 404.";
-    readonly http: "GET";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [{
-        readonly name: "agent_id";
-        readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
-    }];
-    readonly query: readonly [{
-        readonly name: "limit";
-        readonly type: "integer";
-        readonly required: false;
-        readonly description: "Maximum users per page; defaults to 20.";
-    }, {
-        readonly name: "page";
-        readonly type: "string";
-        readonly required: false;
-        readonly description: "next_page from the previous response with the same agent, q and limit.";
-    }, {
-        readonly name: "q";
-        readonly type: "string";
-        readonly required: false;
-        readonly description: "Case-sensitive literal prefix of external_user_id; omit or use an empty string for all users.";
-    }];
-}, {
-    readonly resource: "agent.agents.endUsers";
+    readonly resource: "agent.agents.customers";
     readonly method: "delete";
-    readonly summary: "Delete end-user data";
-    readonly description: "Delete a host application's end-user data from one service agent after explicit confirmation.\n\nDevelop only. Set confirm to the exact external_user_id; missing or mismatched confirmation returns 400. Returns 202 with a pending task id, not completion. Poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the user is blocked before a seven-day recovery snapshot is verified. Sessions including child sessions, conversation data, grants and feedback are then removed. A pre-existing block remains; a temporary block is removed on success. Attachment metadata is recorded and File attachments are retained. No charge is introduced by this operation. Example: DELETE /agent/v1/agents/agent_example/end_users/customer_123?confirm=customer_123.";
+    readonly summary: "Delete customer data";
+    readonly description: "Delete a customer's data from one service agent after explicit confirmation.\n\nDevelop only. Set confirm to the exact customer id; a missing or different confirm returns 400 naming the value to send. Returns 202 with a pending task id; poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the customer is blocked before a seven-day recovery snapshot is verified; sessions including child sessions, conversation data, grants and feedback are then removed. A block that existed before stays; a temporary block is removed on success. File attachments are retained. Example: DELETE /agent/v1/agents/agent_example/customers/cus_8f2a91?confirm=cus_8f2a91.";
     readonly http: "DELETE";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}";
+    readonly path: "/agent/v1/agents/{agent_id}/customers/{customer_id}";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
-        readonly name: "external_user_id";
-        readonly sdkName: "external_user_id";
-        readonly description: "Host user identifier supplied at issuance or from end-user listing.";
+        readonly name: "customer_id";
+        readonly sdkName: "customer_id";
+        readonly description: "Customer id from customer listing, or your own customer_id.";
     }];
     readonly query: readonly [{
         readonly name: "confirm";
         readonly type: "string";
         readonly required: true;
-        readonly description: "Must exactly equal the external_user_id path parameter to confirm destructive deletion.";
+        readonly description: "Must equal the customer_id path parameter exactly, confirming the destructive deletion.";
     }];
 }, {
-    readonly resource: "agent.agents.endUsers";
+    readonly resource: "agent.agents.customers";
     readonly method: "retrieve";
-    readonly summary: "Get End User";
-    readonly description: "Inspect one end user and their twenty most recently updated sessions.\n\nUse external_user_id from listing or your host application. Users without session or issuance history return 404, including preemptively blocked users. End-user credentials and inaccessible or personal agents return 404.";
+    readonly summary: "Get customer";
+    readonly description: "Retrieve one customer of a service agent with its twenty most recently updated sessions.\n\nUse the customer id from the list or your own customer_id. An unknown customer returns 404 CUSTOMER_NOT_FOUND, and so does a customer access token. Unlike Shopify, an identified customer's session_count, cost and recent_sessions include the sessions of anonymous customers merged into it; the merged anonymous customer still shows its own sessions and its merged_into.";
     readonly http: "GET";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}";
+    readonly path: "/agent/v1/agents/{agent_id}/customers/{customer_id}";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
-        readonly name: "external_user_id";
-        readonly sdkName: "external_user_id";
-        readonly description: "Host user identifier supplied at issuance or from end-user listing.";
+        readonly name: "customer_id";
+        readonly sdkName: "customer_id";
+        readonly description: "Customer id from customer listing, or your own customer_id.";
     }];
     readonly query: readonly [];
 }, {
-    readonly resource: "agent.agents.endUsers.block";
+    readonly resource: "agent.agents.customers.block";
     readonly method: "create";
-    readonly summary: "Block End User";
-    readonly description: "Block token issuance and session creation, then revoke existing tokens for an end user.\n\nMay block a user before any history exists; timestamps are then null and counts and cost are zero. Requires an embed policy, otherwise returns 409 with setup guidance. Deduplicates the policy blocklist and retains its 1000-user maximum. If revocation returns 502, the user remains blocked; retry to finish revocation. Repeats keep the user blocked and revoke any remaining grants. End-user credentials and inaccessible or personal agents return 404.";
+    readonly summary: "Block customer";
+    readonly description: "Block a customer and end every sign-in it has on this agent.\n\nBlocks the customer, then ends every live sign-in the way logout does: each access token is revoked and its open event streams close. From then on grant_codes, access_tokens, renew and new sessions for this customer return CUSTOMER_BLOCKED until you unblock it. Idempotent: a repeat keeps the first block time and revokes whatever is still live. If credential revocation fails the request returns 502 and the customer stays blocked; retry to finish. An unknown customer returns 404 CUSTOMER_NOT_FOUND.";
     readonly http: "POST";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block";
+    readonly path: "/agent/v1/agents/{agent_id}/customers/{customer_id}/block";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
-        readonly name: "external_user_id";
-        readonly sdkName: "external_user_id";
-        readonly description: "Host user identifier supplied at issuance or from end-user listing.";
+        readonly name: "customer_id";
+        readonly sdkName: "customer_id";
+        readonly description: "Customer id from customer listing, or your own customer_id.";
     }];
     readonly query: readonly [];
 }, {
-    readonly resource: "agent.agents.endUsers";
+    readonly resource: "agent.agents.customers";
     readonly method: "retrieveDeletion";
-    readonly summary: "Get end-user deletion";
-    readonly description: "Poll the latest deletion task for an end user, including after the user data has been removed.\n\nUse the same agent_id and external_user_id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. A failed task remains blocked and resumes when DELETE is retried with matching confirmation. snapshot_key is an operator recovery reference retained for seven days, not a public download URL. End-user credentials, inaccessible or personal agents, and missing tasks return 404. This read does not create a task or charge usage.";
+    readonly summary: "Get customer deletion";
+    readonly description: "Poll the latest deletion task of a customer, including after its data has been removed.\n\nUse the same agent_id and customer id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. snapshot_key is an operator recovery reference retained for seven days, not a download URL. A customer access token and a missing task return 404.";
     readonly http: "GET";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion";
+    readonly path: "/agent/v1/agents/{agent_id}/customers/{customer_id}/deletion";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
-        readonly name: "external_user_id";
-        readonly sdkName: "external_user_id";
-        readonly description: "Host user identifier supplied at issuance or from end-user listing.";
+        readonly name: "customer_id";
+        readonly sdkName: "customer_id";
+        readonly description: "Customer id from customer listing, or your own customer_id.";
     }];
     readonly query: readonly [];
 }, {
-    readonly resource: "agent.agents.endUsers.revokeTokens";
+    readonly resource: "agent.agents.customers.revokeTokens";
     readonly method: "create";
-    readonly summary: "Revoke End User Tokens";
-    readonly description: "Revoke all issued tokens for an end user and terminate their open embed streams.\n\nRevokes credentials before marking grants revoked. Upstream failure returns 502 without changing grant revocation timestamps. Returns the count of newly revoked grants; a repeat without new grants returns zero. Does not block future issuance. End-user credentials and inaccessible or personal agents return 404.";
+    readonly summary: "Revoke customer tokens";
+    readonly description: "Sign a customer out everywhere without blocking it.\n\nEnds every live sign-in of the customer, revoking each access token and closing its open event streams; the customer can sign in again right away. Returns the number of access tokens this request revoked; a repeat returns 0. Credential revocation failure returns 502; retry to finish. An unknown customer returns 404 CUSTOMER_NOT_FOUND.";
     readonly http: "POST";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens";
+    readonly path: "/agent/v1/agents/{agent_id}/customers/{customer_id}/revoke_tokens";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
-        readonly name: "external_user_id";
-        readonly sdkName: "external_user_id";
-        readonly description: "Host user identifier supplied at issuance or from end-user listing.";
+        readonly name: "customer_id";
+        readonly sdkName: "customer_id";
+        readonly description: "Customer id from customer listing, or your own customer_id.";
     }];
     readonly query: readonly [];
 }, {
-    readonly resource: "agent.agents.endUsers.unblock";
+    readonly resource: "agent.agents.customers.unblock";
     readonly method: "create";
-    readonly summary: "Unblock End User";
-    readonly description: "Allow an end user to receive new tokens and create new sessions again.\n\nRemoves the user from the blocklist; previously revoked tokens stay revoked. Idempotent. Requires an embed policy, otherwise returns 409 with setup guidance. Returns null timestamps and zero counts and cost when no session or issuance history exists. End-user credentials and inaccessible or personal agents return 404.";
+    readonly summary: "Unblock customer";
+    readonly description: "Allow a blocked customer to sign in and start sessions again.\n\nIdempotent. Access tokens revoked while the customer was blocked stay revoked; sign the customer in again with a new grant code. An unknown customer returns 404 CUSTOMER_NOT_FOUND.";
     readonly http: "POST";
-    readonly path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock";
+    readonly path: "/agent/v1/agents/{agent_id}/customers/{customer_id}/unblock";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Active service agent identifier from agent creation or listing.";
+        readonly description: "Active service agent id from agent creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
-        readonly name: "external_user_id";
-        readonly sdkName: "external_user_id";
-        readonly description: "Host user identifier supplied at issuance or from end-user listing.";
+        readonly name: "customer_id";
+        readonly sdkName: "customer_id";
+        readonly description: "Customer id from customer listing, or your own customer_id.";
     }];
     readonly query: readonly [];
 }, {
@@ -638,14 +686,14 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Agent id from creation or listing.";
+        readonly description: "Agent id from creation or listing. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [];
 }, {
     readonly resource: "agent.agents.versions";
     readonly method: "list";
     readonly summary: "List agent versions";
-    readonly description: "List the saved versions of one agent, in pages of at most 100 (default 20). Each item is the full agent definition at that version, so you can compare what changed between versions. active is true only for the item that new sessions use; active_version on each item is the agent-level value, kept for compatibility. Use agents.retrieve with version to read a single one; agent_id comes from agents.list or agents.create.";
+    readonly description: "List the saved versions of one agent in ascending version number, oldest first, in pages of at most 100 (default 20). Each item is the full agent definition at that saved version, so you can compare configurations. active is true only for the item new sessions use. active_version on every item is the same agent-level currently effective version; it is not that item's version. Use agents.retrieve with version to read a single saved version; agent_id comes from agents.list or agents.create. Pass next_page as page to continue.";
     readonly http: "GET";
     readonly path: "/agent/v1/agents/{agent_id}/versions";
     readonly streaming: "no";
@@ -653,7 +701,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name.";
+        readonly description: "Agent id, as returned by agents.create or agents.list (for a session filter, the agent the session was created with). Not the agent name. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }];
     readonly query: readonly [{
         readonly name: "limit";
@@ -670,7 +718,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.agents.versions";
     readonly method: "apply";
     readonly summary: "Apply Agent Version";
-    readonly description: "Apply a version from agents.versions.list by its version number. This idempotent operation changes active_version without creating a version; existing sessions and tokens keep their version. The response is the latest saved agent with its current active_version. Missing versions return 404 Agent version not found; archived agents return 409 Agent is archived. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.";
+    readonly description: "Apply a saved version from agents.versions.list for new sessions and newly issued tokens, without creating a version. Existing sessions and tokens retain their version. The response contains the effective configuration with version equal to active_version and latest_version naming the newest saved version. Missing versions return 404; archived agents return 409. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.";
     readonly http: "POST";
     readonly path: "/agent/v1/agents/{agent_id}/versions/{version}/apply";
     readonly streaming: "no";
@@ -678,7 +726,7 @@ export declare const operations: readonly [{
     readonly pathParams: readonly [{
         readonly name: "agent_id";
         readonly sdkName: "agent_id";
-        readonly description: "Agent identifier from agents.create or agents.list.";
+        readonly description: "Agent identifier from agents.create or agents.list. Also accepts an 8-character identity number (0–9, A–Z); malformed, absent and foreign references return 404, and response ids always use agent_….";
     }, {
         readonly name: "version";
         readonly sdkName: "version";
@@ -711,7 +759,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.computers";
     readonly method: "create";
     readonly summary: "Create Computer";
-    readonly description: "Create a durable computer: a named machine whose files outlive sessions, for personal agents.\n\nPraxis extension: MA only has session-scoped temporary containers and memory_stores, not durable browsable computers. Archived files remain readable, but new sessions cannot bind them. environment_id is an optional recipe reference; computers start with a light sandbox and expose the public SDK sandbox_id. Lists include archived computers.";
+    readonly description: "Create a durable computer: a named machine whose files outlive sessions, for general and personal agents.\n\nPraxis extension: MA only has session-scoped temporary containers and memory_stores, not durable browsable computers. Archived files remain readable, but new sessions cannot bind them. environment_id is an optional recipe reference; computers start with a light sandbox and expose the public SDK sandbox_id. Lists include archived computers.";
     readonly http: "POST";
     readonly path: "/agent/v1/computers";
     readonly streaming: "no";
@@ -1053,7 +1101,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.deployments";
     readonly method: "create";
     readonly summary: "Create deployment";
-    readonly description: "Freeze session parameters as a deployment; this operation does not open a session. Pass an agent id or versioned reference, a name, 1–50 user.message initial events and an environment_id from environments.list. Unlike Anthropic Managed Agents, /agent/v1 also accepts agent_with_overrides (model, permission_mode and cwd) and target=computer for personal agents, with environment_id omitted. Cron schedules use five POSIX fields and an IANA timezone. File resources are accepted. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Active schedules run every minute when due; session creation errors pause the deployment. Unsupported tools, mcp_servers, system and skills overrides return 400.";
+    readonly description: "Freeze session parameters as a deployment; this operation does not open a session. Pass an agent id or versioned reference, a name, 1–50 user.message initial events and an environment_id from environments.list. Unlike Anthropic Managed Agents, /agent/v1 also accepts agent_with_overrides (model, permission_mode and cwd) and target=computer for general and personal agents, with environment_id omitted. Cron schedules use five POSIX fields and an IANA timezone. File resources are accepted. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Active schedules run every minute when due; session creation errors pause the deployment. Unsupported tools, mcp_servers, system and skills overrides return 400.";
     readonly http: "POST";
     readonly path: "/agent/v1/deployments";
     readonly streaming: "no";
@@ -1119,7 +1167,7 @@ export declare const operations: readonly [{
             readonly name: "target";
             readonly type: "object";
             readonly required: false;
-            readonly description: "Execution target. environment (default) requires an existing, unarchived environment_id. computer is available only for personal agents and permits environment_id to be omitted.";
+            readonly description: "Execution target. environment (default) requires an existing, unarchived environment_id. computer is available only for general and personal agents and permits environment_id to be omitted.";
         }];
     };
 }, {
@@ -1211,7 +1259,7 @@ export declare const operations: readonly [{
             readonly name: "target";
             readonly type: "object";
             readonly required: false;
-            readonly description: "Execution target. environment (default) requires an existing, unarchived environment_id. computer is available only for personal agents and permits environment_id to be omitted.";
+            readonly description: "Execution target. environment (default) requires an existing, unarchived environment_id. computer is available only for general and personal agents and permits environment_id to be omitted.";
         }];
     };
 }, {
@@ -1274,175 +1322,6 @@ export declare const operations: readonly [{
         readonly description: "Deployment id (depl_...), returned by deployments.create or deployments.list.";
     }];
     readonly query: readonly [];
-}, {
-    readonly resource: "agent.embed";
-    readonly method: "retrieveAppearance";
-    readonly summary: "Read chat appearance";
-    readonly description: "Load saved appearance for an iframe or Hosted chat page. Supply an end-user embed token as Bearer authorization, or a console-issued publishable key in Praxis-Publishable-Key before anonymous token issuance. The credential selects the agent; identity_number and agent_id query parameters are rejected with 400. Missing appearance returns an empty object. Kit option names retain camelCase. Responses are private and cacheable for 60 seconds. Component hosts configure Kit in their own code instead.";
-    readonly http: "GET";
-    readonly path: "/agent/v1/embed/appearance";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [];
-    readonly query: readonly [];
-}, {
-    readonly resource: "agent.embed.exchange";
-    readonly method: "create";
-    readonly summary: "Exchange Hosted Code";
-    readonly description: "Redeem a single-use hosted link credential for an end-user token.\n\nRead code from the c fragment parameter of hosted_url returned by embed token creation with hosted true, then remove the fragment before exchanging. No Authorization header is required; the code authenticates this request. The code expires after 60 seconds and is consumed atomically on exchange, so concurrent attempts have only one winner. Expired, used and unknown codes return the same 404 body. Keep the token in memory and return to the host website for a fresh link when it expires; exchange cannot refresh it. Requests are IP limited per minute using the anonymous entrypoint budget (default 20). Example body is {\"code\":\"<code from hosted_url>\"}.";
-    readonly http: "POST";
-    readonly path: "/agent/v1/embed/exchange";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [];
-    readonly query: readonly [];
-    readonly body: {
-        readonly required: true;
-        readonly fields: readonly [{
-            readonly name: "code";
-            readonly type: "string";
-            readonly required: true;
-            readonly description: "Single-use credential from the c fragment parameter of hosted_url returned by embed token creation. Valid for 60 seconds.";
-        }];
-    };
-}, {
-    readonly resource: "agent.embedTokens";
-    readonly method: "list";
-    readonly summary: "List Embed Tokens";
-    readonly description: "List embed token issuance records in your organization.\n\nIncludes expired and revoked grants; returns neither token nor token_id. Sorts by created_at, then grant id, both descending. agent_id accepts agent_ or agt_; external_user_id matches exactly. limit is 1–100 (default 20). Reuse next_page as page with the same filters and organization; a mismatch returns 400. End-user credentials return 404.";
-    readonly http: "GET";
-    readonly path: "/agent/v1/embed_tokens";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [];
-    readonly query: readonly [{
-        readonly name: "agent_id";
-        readonly type: "string";
-        readonly required: false;
-        readonly description: "Filter by service agent identifier (agent_ or agt_ prefix).";
-    }, {
-        readonly name: "external_user_id";
-        readonly type: "string";
-        readonly required: false;
-        readonly description: "Exact host user identifier supplied at issuance.";
-    }, {
-        readonly name: "limit";
-        readonly type: "integer";
-        readonly required: false;
-        readonly description: "Maximum records per page; defaults to 20.";
-    }, {
-        readonly name: "page";
-        readonly type: "string";
-        readonly required: false;
-        readonly description: "next_page from a previous response with the same filters.";
-    }];
-}, {
-    readonly resource: "agent.embedTokens";
-    readonly method: "create";
-    readonly summary: "Create Embed Token";
-    readonly description: "Issue a short-lived credential on your backend for an end user of a service agent.\n\nRequires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. Set hosted to true to also receive hosted_url; redirect the user there within 60 seconds. The agent must have an identity_number. The URL fragment contains a single-use exchange credential, not the token. Omit hosted or set false for ordinary token issuance.";
-    readonly http: "POST";
-    readonly path: "/agent/v1/embed_tokens";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [];
-    readonly query: readonly [];
-    readonly body: {
-        readonly required: true;
-        readonly fields: readonly [{
-            readonly name: "hosted";
-            readonly type: "boolean";
-            readonly required: false;
-            readonly description: "Set true to also return a hosted chat URL with a single-use credential valid for 60 seconds. Defaults to false; the agent must have an identity_number.";
-        }, {
-            readonly name: "agent";
-            readonly type: "string";
-            readonly required: true;
-            readonly description: "Service agent ID or identity_number from agent retrieval; it must belong to your organization and be active.";
-        }, {
-            readonly name: "version";
-            readonly type: "integer";
-            readonly required: false;
-            readonly description: "Existing agent version to pin. Omit to pin the latest version at issuance.";
-        }, {
-            readonly name: "external_user_id";
-            readonly type: "string";
-            readonly required: true;
-            readonly description: "Your application's stable end-user identifier, scoped to this organization and agent.";
-        }, {
-            readonly name: "ttl_seconds";
-            readonly type: "integer";
-            readonly required: false;
-            readonly description: "Token lifetime in seconds. Defaults to the embed policy TTL and cannot exceed its maximum or 3600 seconds.";
-        }, {
-            readonly name: "budget_cents";
-            readonly type: "integer";
-            readonly required: false;
-            readonly description: "Session budget in cents. Defaults to the embed policy session budget and cannot exceed its maximum.";
-        }, {
-            readonly name: "system_message";
-            readonly type: "array";
-            readonly itemType: "object";
-            readonly required: false;
-            readonly description: "Optional host context as text blocks, limited to 8192 UTF-8 bytes in total.";
-        }, {
-            readonly name: "agent_override";
-            readonly type: "object";
-            readonly required: false;
-            readonly description: "Optional system prompt override, accepted only when the embed policy allows agent overrides.";
-        }, {
-            readonly name: "allowed_origins";
-            readonly type: "array";
-            readonly itemType: "string";
-            readonly required: false;
-            readonly description: "Optional subset of the policy origin entries, compared exactly. Omit to snapshot every policy origin.";
-        }, {
-            readonly name: "metadata";
-            readonly type: "object";
-            readonly required: false;
-            readonly description: "Host metadata preserved verbatim; at most 16 keys of 1–64 characters and string values of at most 512 characters. Defaults to an empty object.";
-        }];
-    };
-}, {
-    readonly resource: "agent.embedTokens.anonymous";
-    readonly method: "create";
-    readonly summary: "Issue anonymous visitor token";
-    readonly description: "Obtain a short-lived embedding token for a visitor without an account using the agent owner's publishable key.\n\nNo Authorization header is required. Send the browser Origin allowed by the agent policy. Save a returned visitor_secret and reuse it for refreshes; only new visitors receive one. Unknown secrets create new visitors, and extra fields including visitor_id return 400. Issuance uses the key creator's organization membership, the key session budget and the smaller of the policy TTL maximum and 3600 seconds. IP requests are limited per minute (default 20); UTC daily session and spending caps are checked across the key's primary sessions created that day. Token issuance itself does not create a session or charge usage; subsequent sessions bill the host organization. Example body: {\"publishable_key\":\"pk_praxis_example\"}.";
-    readonly http: "POST";
-    readonly path: "/agent/v1/embed_tokens/anonymous";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [];
-    readonly query: readonly [];
-    readonly body: {
-        readonly required: true;
-        readonly fields: readonly [{
-            readonly name: "publishable_key";
-            readonly type: "string";
-            readonly required: true;
-            readonly description: "Public key created by the service agent owner; safe to include in browser code.";
-        }, {
-            readonly name: "visitor_secret";
-            readonly type: "string";
-            readonly required: false;
-            readonly description: "Secret returned by a previous anonymous issuance for this key. Omit for a new visitor; an unknown secret creates a new visitor.";
-        }];
-    };
-}, {
-    readonly resource: "agent.embedTokens.revoke";
-    readonly method: "create";
-    readonly summary: "Revoke Embed Token";
-    readonly description: "Revoke an embed token and close its open event streams.\n\nUse an id from issuance or listing. Revokes the credential before setting revoked_at; upstream failure leaves it unset. Streams receive session.error (EMBED_TOKEN_REVOKED), then close immediately; other credentials are unaffected. Idempotent; repeats return the original revoked record without another revocation or audit. Missing or foreign grants and end-user credentials return 404.";
-    readonly http: "POST";
-    readonly path: "/agent/v1/embed_tokens/{id}/revoke";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [{
-        readonly name: "id";
-        readonly sdkName: "id";
-        readonly description: "Grant id returned by issuance or listing.";
-    }];
-    readonly query: readonly [];
 }, {
     readonly resource: "agent.environments";
     readonly method: "list";
@@ -1669,7 +1548,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.sessions";
     readonly method: "create";
     readonly summary: "Create session";
-    readonly description: "Create a session: one conversation with an agent. Pass agent as an agent id or {type:\"agent\", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:\"agent_with_overrides\", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:\"limit\", max_list_cost:{amount, currency:\"USD\"}} where amount is a positive integer string of US cents (\"2000\" is USD 20.00); omitted budget defaults to \"2000\" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.";
+    readonly description: "Create a session: one conversation with an agent. Pass agent as an agent id or {type:\"agent\", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:\"agent_with_overrides\", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:\"limit\", max_list_cost:{amount, currency:\"USD\"}} where amount is a positive decimal string of US dollars with at most 2 decimal places (\"20.00\" is USD 20.00); omitted budget defaults to \"20.00\" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion. Assume agents return 400 INVALID_PARAMS; drive them over MCP at /agent/v1/agents/{id}/mcp instead.";
     readonly http: "POST";
     readonly path: "/agent/v1/sessions";
     readonly streaming: "no";
@@ -1910,7 +1789,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.sessions";
     readonly method: "compact";
     readonly summary: "Compact Session (Extension)";
-    readonly description: "Request session context compaction and retrieve an operation receipt.\n\nAvailable only on /agent/v1. The body may be omitted or {}. Optional instructions must be a string and is forwarded unchanged. Idempotency-Key is forwarded unchanged; a UUID is generated when absent. Returns { type: session_compaction, id, status, reason? }, where id is the operation ID. queued/running return 202; skipped/succeeded/failed return 200. Non-string instructions return 400 invalid_request_error. Missing or inaccessible managed sessions return 404 not_found_error.";
+    readonly description: "Request session context compaction and retrieve an operation receipt.\n\nAvailable only on /agent/v1. The body may be omitted or {}. Optional instructions must be a string and is forwarded unchanged. Idempotency-Key is forwarded unchanged; a UUID is generated when absent. Returns { type: session_compaction, id, status, reason? }, where id is the operation ID. queued/running return 202; skipped/succeeded/failed/cancelled return 200. Non-string instructions return 400 invalid_request_error. Missing or inaccessible managed sessions return 404 not_found_error.";
     readonly http: "POST";
     readonly path: "/agent/v1/sessions/{session_id}/compact";
     readonly streaming: "no";
@@ -1953,7 +1832,7 @@ export declare const operations: readonly [{
     readonly resource: "agent.sessions.compactions";
     readonly method: "list";
     readonly summary: "List Session Compactions (Extension)";
-    readonly description: "Read session compaction history and summaries.\n\nAvailable only on /agent/v1. Returns { data: [...] }. Each entry contains type, id, event_id, trigger, status, model, compacted_message_count, input_tokens_before, input_tokens_after, summary, error and created_at, as recorded by the service. Missing or inaccessible managed sessions return 404 not_found_error.";
+    readonly description: "Read session compaction history and summaries.\n\nAvailable only on /agent/v1. Returns { data: [...], active }. active is the queued or running compaction ({ type: session_compaction, id, status, trigger: manual|auto|idle }), or null when none; manual work takes precedence. Each data entry contains type, id, event_id, trigger, status, model, compacted_message_count, input_tokens_before, input_tokens_after, summary, error and created_at, as recorded by the service. Missing or inaccessible managed sessions return 404 not_found_error.";
     readonly http: "GET";
     readonly path: "/agent/v1/sessions/{session_id}/compactions";
     readonly streaming: "no";
@@ -2123,9 +2002,9 @@ export declare const operations: readonly [{
     }];
     readonly query: readonly [{
         readonly name: "limit";
-        readonly type: "number";
+        readonly type: "integer";
         readonly required: false;
-        readonly description: "Number of items per page.";
+        readonly description: "Number of resources per page, from 1 to 100; defaults to 100.";
     }, {
         readonly name: "page";
         readonly type: "string";
@@ -2985,7 +2864,7 @@ export declare const operations: readonly [{
     readonly resource: "application.workers.grants";
     readonly method: "create";
     readonly summary: "Create grant";
-    readonly description: "Let this Worker's platform token access one of your databases, folders or knowledge bases.";
+    readonly description: "Record access to an organization-owned database or knowledge base, all organization files (files, id *), or models (models, id *, read only). Each resource and optional alias must be unique within this Worker. Foreign and missing resources both return RESOURCE_NOT_FOUND (404); an unavailable resource service returns PROVIDER_CAPACITY (503, retryable).";
     readonly http: "POST";
     readonly path: "/application/v1/workers/{worker_id}/grants";
     readonly streaming: "no";
@@ -3002,13 +2881,18 @@ export declare const operations: readonly [{
             readonly name: "resource";
             readonly type: "object";
             readonly required: true;
-            readonly description: "Resource to grant.";
+            readonly description: "Resource to grant. Each (type, id) may be granted once per Worker; duplicates return GRANT_CONFLICT (409).";
+        }, {
+            readonly name: "alias";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Optional name, unique within this Worker. Available for reuse after the grant is deleted.";
         }, {
             readonly name: "access";
             readonly type: "string";
             readonly enum: readonly ["read", "read_write"];
             readonly required: true;
-            readonly description: "Access level.";
+            readonly description: "Access level; models accepts read only.";
         }];
     };
 }, {
@@ -3241,7 +3125,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.actions";
     readonly method: "list";
     readonly summary: "List actions";
-    readonly description: "Discover callable Actions and their ns/name references without executing them. Combine each returned namespace and name as ns/name; Action calls use the current revision and do not accept @version or @tag. Filter by name or description; results include seven-day statistics and revision summaries without implementation source. Archived actions are excluded by default.";
+    readonly description: "Discover callable Actions and their ns/name references without executing them. Combine each returned namespace and name as ns/name; Action calls use the current revision and do not accept @version or @tag. Filter by name or description; results include seven-day statistics and revision summaries without implementation source. Archived actions are excluded by default. List items carry no input contract: get the action and read current_revision.input_schema. Call it with call(\"ns/name\", input) in a script or call: ns/name with with: in a workflow.";
     readonly http: "GET";
     readonly path: "/automation/v1/actions";
     readonly streaming: "no";
@@ -3356,7 +3240,7 @@ export declare const operations: readonly [{
             readonly name: "timeout_ms";
             readonly type: "number";
             readonly required: false;
-            readonly description: "Positive integer milliseconds; code defaults to and is capped at 30,000. container/shell are not yet available.";
+            readonly description: "Positive integer milliseconds; code defaults to and is capped at 300,000. container/shell are not yet available.";
         }, {
             readonly name: "implementation";
             readonly type: "object";
@@ -3378,7 +3262,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.actions";
     readonly method: "retrieve";
     readonly summary: "Get an Action with its current input and output JSON Schemas";
-    readonly description: "Read the Action and its full current implementation, with input and output JSON Schemas at current_revision.input_schema and current_revision.output_schema. To read a built-in Action, use ns=praxis and name=<bare name>, for example name=ocr; invoke it in a script with call(\"ocr\", input). The response ETag is the current revision ID for conditional updates.";
+    readonly description: "Read the Action and its full current implementation, with input and output JSON Schemas at current_revision.input_schema and current_revision.output_schema. To read a built-in Action, use ns=praxis and name=<bare name>, for example name=ocr; invoke it in a script with call(\"ocr\", input) or in a workflow step with call: ocr and with:. Input that breaks the contract returns INPUT_INVALID, with the fields in errors[]. The response ETag is the current revision ID for conditional updates.";
     readonly http: "GET";
     readonly path: "/automation/v1/actions/{ns}/{name}";
     readonly streaming: "no";
@@ -3397,7 +3281,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.actions";
     readonly method: "update";
     readonly summary: "Update an action";
-    readonly description: "Update after checking compatibility against the current and five recent revisions. Widening inputs and narrowing outputs are compatible, including length, item count, property count, type (integer/number), and multipleOf (the new input factor divides the old one; the reverse holds for outputs). dry_run=true returns only CompatResult and may omit If-Match; a supplied header is still checked, and * matches any existing representation. Normal updates require If-Match and return ActionDef with ETag; previews return no ETag. Omitted optional fields retain their existing values only for description and labels; when constructing a new revision, errors defaults to [], omitted annotations keys to false, timeout_ms to 30000, and message to null. Incompatible normal updates return 422 SCHEMA_INCOMPATIBLE with issues; unchanged contents retain the existing revision.";
+    readonly description: "Update after checking compatibility against the current and five recent revisions. Widening inputs and narrowing outputs are compatible, including length, item count, property count, type (integer/number), and multipleOf (the new input factor divides the old one; the reverse holds for outputs). dry_run=true returns only CompatResult and may omit If-Match; a supplied header is still checked, and * matches any existing representation. Normal updates require If-Match and return ActionDef with ETag; previews return no ETag. Omitted optional fields retain their existing values only for description and labels; when constructing a new revision, errors defaults to [], omitted annotations keys to false, timeout_ms to 300000, and message to null. Incompatible normal updates return 422 SCHEMA_INCOMPATIBLE with issues; unchanged contents retain the existing revision.";
     readonly http: "PUT";
     readonly path: "/automation/v1/actions/{ns}/{name}";
     readonly streaming: "no";
@@ -3454,7 +3338,7 @@ export declare const operations: readonly [{
             readonly name: "timeout_ms";
             readonly type: "number";
             readonly required: false;
-            readonly description: "Positive integer milliseconds; code defaults to and is capped at 30,000. container/shell are not yet available.";
+            readonly description: "Positive integer milliseconds; code defaults to and is capped at 300,000. container/shell are not yet available.";
         }, {
             readonly name: "implementation";
             readonly type: "object";
@@ -3714,28 +3598,12 @@ export declare const operations: readonly [{
         readonly fields: readonly [];
     };
 }, {
-    readonly resource: "automation.resolve";
-    readonly method: "retrieve";
-    readonly summary: "Resolve a run target";
-    readonly description: "Resolve ns/name@tag, an exact version or a version range to a runnable exact version. Omitting @ selects latest; archived targets are rejected and no match returns NO_MATCHING_VERSION.";
-    readonly http: "GET";
-    readonly path: "/automation/v1/resolve";
-    readonly streaming: "no";
-    readonly pagination: false;
-    readonly pathParams: readonly [];
-    readonly query: readonly [{
-        readonly name: "target";
-        readonly type: "string";
-        readonly required: true;
-        readonly description: "ns/name@tag, ns/name@version or ns/name@range; omitting @ selects latest.";
-    }];
-}, {
-    readonly resource: "automation.runs";
+    readonly resource: "automation.humanTasks";
     readonly method: "list";
-    readonly summary: "List runs";
-    readonly description: "Filter tenant runs and list them newest first. Filters include multiple statuses, target, origin, labels[k] and a creation-time lower bound. q matches a run ID exactly when it starts with run_; otherwise it matches a definition-name prefix. Large input/output values are null in lists with input_truncated/output_truncated true; get run details for full values.";
+    readonly summary: "List human tasks";
+    readonly description: "List the human tasks that praxis/approval workflow steps opened, newest first. By default it returns only open tasks assigned to the caller: their approval inbox. scope=all lists every task of the organization, and status and run_id narrow the list. Use a returned id with retrieve for details and respond to decide. Read-only: listing never changes a task.";
     readonly http: "GET";
-    readonly path: "/automation/v1/runs";
+    readonly path: "/automation/v1/human-tasks";
     readonly streaming: "no";
     readonly pagination: true;
     readonly pathParams: readonly [];
@@ -3743,33 +3611,185 @@ export declare const operations: readonly [{
         readonly name: "limit";
         readonly type: "integer";
         readonly required: false;
-        readonly description: "Page size: integer 1–100, default 50.";
+        readonly description: "Page size, 1–100, default 50.";
     }, {
         readonly name: "cursor";
         readonly type: "string";
         readonly required: false;
-        readonly description: "Opaque next_cursor from the previous page; keep the original filters when paging.";
+        readonly description: "The next_cursor of the previous page; omit for the first page.";
     }, {
-        readonly name: "kind";
+        readonly name: "status";
         readonly type: "array";
         readonly itemType: "string";
-        readonly enum: readonly ["script", "workflow"];
+        readonly enum: readonly ["open", "completed", "expired", "cancelled"];
         readonly required: false;
-        readonly description: "script or workflow; omit for both. Separate multiple values with commas to match any value.";
+        readonly description: "Filter by status, comma-separated: open, completed, expired, cancelled. Defaults to open.";
     }, {
-        readonly name: "definition";
-        readonly type: "array";
-        readonly itemType: "string";
+        readonly name: "run_id";
+        readonly type: "string";
         readonly required: false;
-        readonly description: "Exact definition name in ns/name format. Separate multiple values with commas to match any value.";
+        readonly description: "Only tasks opened by this run (run_).";
     }, {
-        readonly name: "version";
-        readonly type: "array";
-        readonly itemType: "string";
+        readonly name: "scope";
+        readonly type: "string";
+        readonly enum: readonly ["assigned", "all"];
         readonly required: false;
-        readonly description: "An exact canonical semantic version, such as 1.2.0 or 1.3.0-beta.1, not a range. Separate multiple values with commas to match any value.";
-    }, {
-        readonly name: "status";
+        readonly description: "assigned (default) lists only tasks assigned to the caller; all lists every task of the organization.";
+    }];
+}, {
+    readonly resource: "automation.humanTasks";
+    readonly method: "retrieve";
+    readonly summary: "Retrieve a human task";
+    readonly description: "Read one human task - title, Markdown body, context, actions, form, assignees, mode, due time, responses and outcome - so an assignee can choose an action and fill the form. Read-only; the Console approval page /automation/tasks/{id} reads the same resource.";
+    readonly http: "GET";
+    readonly path: "/automation/v1/human-tasks/{id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "id";
+        readonly sdkName: "id";
+        readonly description: "Human task ID (htask_), from the list or the run's waits.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "automation.humanTasks";
+    readonly method: "cancel";
+    readonly summary: "Cancel a human task";
+    readonly description: "Cancel an open human task; only the person who started the run or an organization API key may cancel. The task becomes cancelled and the waiting workflow step raises a runtime error with code HUMAN_TASK_CANCELLED, which try/catch can catch. Open tasks are cancelled automatically when their run ends, so this call is not needed then.";
+    readonly http: "POST";
+    readonly path: "/automation/v1/human-tasks/{id}/cancel";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "id";
+        readonly sdkName: "id";
+        readonly description: "Human task ID (htask_).";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: false;
+        readonly fields: readonly [{
+            readonly name: "reason";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Optional cancellation reason, at most 500 characters.";
+        }];
+    };
+}, {
+    readonly resource: "automation.humanTasks";
+    readonly method: "delegate";
+    readonly summary: "Delegate a human task";
+    readonly description: "An assignee who has not responded hands their place to another user (to_user), replacing their entry in assignees.users in place, so sequential order is kept. The new user cannot already be an assignee, nor the initiator unless self-approval is allowed. The task must still be open.";
+    readonly http: "POST";
+    readonly path: "/automation/v1/human-tasks/{id}/delegate";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "id";
+        readonly sdkName: "id";
+        readonly description: "Human task ID (htask_).";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "to_user";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "User ID taking over; cannot already be an assignee, nor the initiator unless self-approval is allowed.";
+        }];
+    };
+}, {
+    readonly resource: "automation.humanTasks";
+    readonly method: "respond";
+    readonly summary: "Respond to a human task";
+    readonly description: "Submit an action (action_id), form values (values) and a comment as the calling user. Depending on the task's mode the response either decides it (status becomes completed, outcome is set, and the waiting workflow resumes with outcome as the step output) or is recorded while other assignees are awaited. When two assignees respond at once, exactly one decides and the other gets TASK_CLOSED. An agent may respond only if the workflow set allow_agent_decision. Send an Idempotency-Key to retry safely.";
+    readonly http: "POST";
+    readonly path: "/automation/v1/human-tasks/{id}/respond";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "id";
+        readonly sdkName: "id";
+        readonly description: "Human task ID (htask_).";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "action_id";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "The chosen action ID from the task's actions, for example approve.";
+        }, {
+            readonly name: "values";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "Any JSON object whose keys are strings and whose values are any JSON value.";
+        }, {
+            readonly name: "comment";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Comment of at most 4000 characters; required when the action has require_comment true.";
+        }];
+    };
+}, {
+    readonly resource: "automation.resolve";
+    readonly method: "retrieve";
+    readonly summary: "Resolve a run target";
+    readonly description: "Resolve ns/name@tag, an exact version or a version range to a runnable exact version. Omitting @ selects latest; archived targets are rejected and no match returns NO_MATCHING_VERSION.";
+    readonly http: "GET";
+    readonly path: "/automation/v1/resolve";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [{
+        readonly name: "target";
+        readonly type: "string";
+        readonly required: true;
+        readonly description: "ns/name@tag, ns/name@version or ns/name@range; omitting @ selects latest.";
+    }];
+}, {
+    readonly resource: "automation.runs";
+    readonly method: "list";
+    readonly summary: "List runs";
+    readonly description: "Filter tenant runs and list them newest first. Filters include multiple statuses, target, origin, labels[k] and a creation-time lower bound. q matches a run ID exactly when it starts with run_; otherwise it matches a definition-name prefix. Large input/output values are null in lists with input_truncated/output_truncated true; get run details for full values.";
+    readonly http: "GET";
+    readonly path: "/automation/v1/runs";
+    readonly streaming: "no";
+    readonly pagination: true;
+    readonly pathParams: readonly [];
+    readonly query: readonly [{
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Page size: integer 1–100, default 50.";
+    }, {
+        readonly name: "cursor";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Opaque next_cursor from the previous page; keep the original filters when paging.";
+    }, {
+        readonly name: "kind";
+        readonly type: "array";
+        readonly itemType: "string";
+        readonly enum: readonly ["script", "workflow"];
+        readonly required: false;
+        readonly description: "script or workflow; omit for both. Separate multiple values with commas to match any value.";
+    }, {
+        readonly name: "definition";
+        readonly type: "array";
+        readonly itemType: "string";
+        readonly required: false;
+        readonly description: "Exact definition name in ns/name format. Separate multiple values with commas to match any value.";
+    }, {
+        readonly name: "version";
+        readonly type: "array";
+        readonly itemType: "string";
+        readonly required: false;
+        readonly description: "An exact canonical semantic version, such as 1.2.0 or 1.3.0-beta.1, not a range. Separate multiple values with commas to match any value.";
+    }, {
+        readonly name: "status";
         readonly type: "array";
         readonly itemType: "string";
         readonly enum: readonly ["pending", "running", "waiting", "suspended", "cancelled", "faulted", "completed"];
@@ -3844,7 +3864,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.runs";
     readonly method: "create";
     readonly summary: "Run a published target or execute draft source";
-    readonly description: "Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call(\"ocr\", { document: { type: \"file\", file_id } }); return result; }`; send it as source with language=\"ts\", input={\"file_id\":\"<uploaded file ID>\"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: \"glm-ocr\", document: { type: \"file\", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke(\"namespace/name\", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 7 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.";
+    readonly description: "Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call(\"ocr\", { document: { type: \"file\", file_id } }); return result; }`; send it as source with language=\"ts\", input={\"file_id\":\"<uploaded file ID>\"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: \"glm-ocr\", document: { type: \"file\", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke(\"namespace/name\", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 5 min (run-sandbox after 6 h); scripts have a 30 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 30 days. Each run can start at most 1,000 child runs, with at most 100 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. With language=yaml, source is a workflow YAML: the run input is . in the first step, and the shape is described in create workflow. Error details are in errors[] (pointer, detail, hint). New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.";
     readonly http: "POST";
     readonly path: "/automation/v1/runs";
     readonly streaming: "no";
@@ -4241,7 +4261,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.scripts";
     readonly method: "create";
     readonly summary: "Create a script";
-    readonly description: "Save a TypeScript script as an editable draft for later reuse; this does not publish or start a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. The draft is a source string with a default-exported function, for example `export default async (input: {name: string}) => ({greeting: \"Hello, \" + input.name});`. Scripts provide praxis, call, invoke, console and codemode as module-scope bindings, not on globalThis, with no import needed: praxis.<domain>.<resource>.<method>(...) calls a platform API, call(\"ocr\", input) calls a built-in Action, and invoke(\"namespace/name\", input) starts a child run. Action IDs are strings (bare names for built-ins, namespace/name for your own Actions); praxis.ocr(...) does not exist. To test it, pass that source and language=ts to praxis.automation.runs.create without publishing. To publish later, use the returned draft.revision as expected_draft_revision.";
+    readonly description: "Save a TypeScript script as an editable draft for later reuse; this does not publish or start a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. The draft is a source string with a default-exported function, for example `export default async (input: {name: string}) => ({greeting: \"Hello, \" + input.name});`. Scripts provide praxis, call, invoke, console and codemode as module-scope bindings, not on globalThis, with no import needed: praxis.<domain>.<resource>.<method>(...) calls a platform API, call(\"ocr\", input) calls a built-in Action, and invoke(\"namespace/name\", input) starts a child run. Action IDs are strings (bare names for built-ins, namespace/name for your own Actions); praxis.ocr(...) does not exist. The return value is limited to 1 MiB: write large results to a file with call(\"write-file\", ...) and return the file ID. A call error carries errors[] (pointer, detail, hint); String(e) is only the summary. To test it, pass that source and language=ts to praxis.automation.runs.create without publishing. To publish later, use the returned draft.revision as expected_draft_revision.";
     readonly http: "POST";
     readonly path: "/automation/v1/scripts";
     readonly streaming: "no";
@@ -4454,6 +4474,80 @@ export declare const operations: readonly [{
         readonly required: false;
         readonly fields: readonly [];
     };
+}, {
+    readonly resource: "automation.scripts.vaults";
+    readonly method: "list";
+    readonly summary: "List script vault bindings";
+    readonly description: "Inspect the whole vaults attached to a saved script, including archived definitions, without reading secret values. Obtain ns and name from automation.scripts.list. Bindings belong to the definition rather than a published version. When vault or secret metadata cannot be read, the binding remains visible with secrets: [] and secrets_unavailable: true.";
+    readonly http: "GET";
+    readonly path: "/automation/v1/scripts/{ns}/{name}/vaults";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "ns";
+        readonly sdkName: "ns";
+        readonly description: "Namespace from automation.scripts.list or create; identifies the saved script, independently of versions.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Resource name from automation.scripts.list or create; combine with ns to identify the saved script.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "automation.scripts.vaults";
+    readonly method: "delete";
+    readonly summary: "Delete a script vault binding";
+    readonly description: "Remove the vault assignment from this saved script without deleting the vault or its secrets. Obtain aliases from automation.scripts.vaults.list. Repeating deletion of an absent alias on an existing definition succeeds. Bindings also disappear when the definition is permanently deleted, while archival retains them.";
+    readonly http: "DELETE";
+    readonly path: "/automation/v1/scripts/{ns}/{name}/vaults/{alias}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "ns";
+        readonly sdkName: "ns";
+        readonly description: "Namespace from automation.scripts.list or create; identifies the saved script, independently of versions.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Resource name from automation.scripts.list or create; combine with ns to identify the saved script.";
+    }, {
+        readonly name: "alias";
+        readonly sdkName: "alias";
+        readonly description: "Binding alias chosen by the caller: 1–40 lowercase letters, digits or hyphens, beginning with a letter.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "automation.scripts.vaults";
+    readonly method: "set";
+    readonly summary: "Set a script vault binding";
+    readonly description: "Attach an entire active vault in your organization to a saved script, or replace the vault at an existing alias. Obtain the vault ID or display name from praxis.vault.vaults.list; ambiguous names require an ID. Bindings are independent of published versions and survive archival. The same vault cannot be assigned to two aliases on one definition. Repeating the same assignment is idempotent. Example body: {\"vault\":\"Production\"}.";
+    readonly http: "PUT";
+    readonly path: "/automation/v1/scripts/{ns}/{name}/vaults/{alias}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "ns";
+        readonly sdkName: "ns";
+        readonly description: "Namespace from automation.scripts.list or create; identifies the saved script, independently of versions.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Resource name from automation.scripts.list or create; combine with ns to identify the saved script.";
+    }, {
+        readonly name: "alias";
+        readonly sdkName: "alias";
+        readonly description: "Binding alias chosen by the caller: 1–40 lowercase letters, digits or hyphens, beginning with a letter.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "vault";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Active vault ID or exact display name from praxis.vault.vaults.list in your organization. Use an ID if display names are duplicated.";
+        }];
+    };
 }, {
     readonly resource: "automation.scripts.versions";
     readonly method: "list";
@@ -5006,7 +5100,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.validate";
     readonly method: "create";
     readonly summary: "Validate a definition";
-    readonly description: "Check source without executing it when you need diagnostics, inferred schemas or references. This is optional before praxis.automation.runs.create, which also validates source before execution. Actions, scripts and workflows are supported; results include validity without saving. Invalid source is reported with valid=false. Script/action output schemas are inferred from return types: Promise unwrapping, Record, intersections and Date. Unknown types yield an empty schema and a warning in warnings. Source diagnostics use /source or /implementation/source with 1-based line/column. For kind=action the same admission checks as action creation apply (no external imports, platform operations only as direct call(praxis/<api>.<op>, input) calls, no agent or automation calls), so source that validates is not rejected at creation.";
+    readonly description: "Check source without executing it when you need diagnostics, inferred schemas or references. This is optional before praxis.automation.runs.create, which also validates source before execution. Actions, scripts and workflows are supported; results include validity without saving. Invalid source is reported with valid=false. Script/action output schemas are inferred from return types: Promise unwrapping, Record, intersections and Date. Unknown types yield an empty schema and a warning in warnings. Source diagnostics use /source or /implementation/source with 1-based line/column. For kind=action the same admission checks as action creation apply (no external imports, platform operations only as direct call(praxis/<api>.<op>, input) calls, no agent or automation calls), so source that validates is not rejected at creation. For kind=workflow the YAML needs document (dsl, namespace, name, version) and do; each problem is one entry in errors[] (pointer, detail, hint), so read the first one. A listen outside the supported subset (to.all, inside a fork) and emit are not reported here and fail with DEFINITION_INVALID only when a run is created. Workflow syntax reference: https://deepraxis.com/docs/developers/automation/reference/workflow-syntax.";
     readonly http: "POST";
     readonly path: "/automation/v1/validate";
     readonly streaming: "no";
@@ -5091,7 +5185,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.workflows";
     readonly method: "create";
     readonly summary: "Create a workflow";
-    readonly description: "Save a YAML workflow as an editable draft without publishing or starting a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. To test the draft, send its source and language=yaml to praxis.automation.runs.create. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.";
+    readonly description: "Workflow syntax reference: https://deepraxis.com/docs/developers/automation/reference/workflow-syntax. Save a YAML workflow as an editable draft; this does not validate, publish or run it, so check it with validate (kind=workflow) first. Minimal draft: document with dsl (\"1.0.3\"), namespace, name and version, plus a do list of steps, for example document: {dsl: \"1.0.3\", namespace: demo, name: add, version: \"1.0.0\"} and do: [{first: {call: demo/add-one, with: {n: \"${ .n }\"}}}]. call: <ns/name> calls an Action directly (bare name for built-ins such as ocr) and with is the Action input; the input contract is at current_revision.input_schema in the get-action response. run: starts a saved script or child workflow. The run input is . in the first step, and expressions are jq written as a whole ${ ... } string. Limits: Action 5 min (run-sandbox 6 h), workflow 24 h by default and 30 days at most, payload 1 MiB. Test the draft by sending its source and language=yaml to praxis.automation.runs.create. To pause for a person, call praxis/approval (it opens a human task; the step output is the decision); agents answer with praxis.automation.humanTasks.respond on behalf of their user. Guide: /docs/developers/automation/guides/approvals Guide: /docs/developers/automation/guides/write-workflow. Error details are in the errors[] of the response (pointer, detail, hint). Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.";
     readonly http: "POST";
     readonly path: "/automation/v1/workflows";
     readonly streaming: "no";
@@ -5150,7 +5244,7 @@ export declare const operations: readonly [{
     readonly resource: "automation.workflows";
     readonly method: "update";
     readonly summary: "Update a workflow draft";
-    readonly description: "Update description, labels or draft with the current draft revision in If-Match. Even metadata-only updates create a new draft revision.";
+    readonly description: "Update description, labels or draft with the current draft revision in If-Match, taken from draft.revision in the get-workflow response. Even metadata-only updates create a new draft revision. A mismatch returns 412 PRECONDITION_FAILED; read the draft again, merge and retry. The draft is not validated here, so check it with validate (kind=workflow) before publishing. Error details are in errors[]. See the workflow syntax reference at https://deepraxis.com/docs/developers/automation/reference/workflow-syntax.";
     readonly http: "PATCH";
     readonly path: "/automation/v1/workflows/{ns}/{name}";
     readonly streaming: "no";
@@ -5304,6 +5398,80 @@ export declare const operations: readonly [{
         readonly required: false;
         readonly fields: readonly [];
     };
+}, {
+    readonly resource: "automation.workflows.vaults";
+    readonly method: "list";
+    readonly summary: "List workflow vault bindings";
+    readonly description: "Inspect the whole vaults attached to a saved workflow, including archived definitions, without reading secret values. Obtain ns and name from automation.workflows.list. Bindings belong to the definition rather than a published version. When vault or secret metadata cannot be read, the binding remains visible with secrets: [] and secrets_unavailable: true.";
+    readonly http: "GET";
+    readonly path: "/automation/v1/workflows/{ns}/{name}/vaults";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "ns";
+        readonly sdkName: "ns";
+        readonly description: "Namespace from automation.workflows.list or create; identifies the saved workflow, independently of versions.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Resource name from automation.workflows.list or create; combine with ns to identify the saved workflow.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "automation.workflows.vaults";
+    readonly method: "delete";
+    readonly summary: "Delete a workflow vault binding";
+    readonly description: "Remove the vault assignment from this saved workflow without deleting the vault or its secrets. Obtain aliases from automation.workflows.vaults.list. Repeating deletion of an absent alias on an existing definition succeeds. Bindings also disappear when the definition is permanently deleted, while archival retains them.";
+    readonly http: "DELETE";
+    readonly path: "/automation/v1/workflows/{ns}/{name}/vaults/{alias}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "ns";
+        readonly sdkName: "ns";
+        readonly description: "Namespace from automation.workflows.list or create; identifies the saved workflow, independently of versions.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Resource name from automation.workflows.list or create; combine with ns to identify the saved workflow.";
+    }, {
+        readonly name: "alias";
+        readonly sdkName: "alias";
+        readonly description: "Binding alias chosen by the caller: 1–40 lowercase letters, digits or hyphens, beginning with a letter.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "automation.workflows.vaults";
+    readonly method: "set";
+    readonly summary: "Set a workflow vault binding";
+    readonly description: "Attach an entire active vault in your organization to a saved workflow, or replace the vault at an existing alias. Obtain the vault ID or display name from praxis.vault.vaults.list; ambiguous names require an ID. Bindings are independent of published versions and survive archival. The same vault cannot be assigned to two aliases on one definition. Repeating the same assignment is idempotent. Example body: {\"vault\":\"Production\"}.";
+    readonly http: "PUT";
+    readonly path: "/automation/v1/workflows/{ns}/{name}/vaults/{alias}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "ns";
+        readonly sdkName: "ns";
+        readonly description: "Namespace from automation.workflows.list or create; identifies the saved workflow, independently of versions.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Resource name from automation.workflows.list or create; combine with ns to identify the saved workflow.";
+    }, {
+        readonly name: "alias";
+        readonly sdkName: "alias";
+        readonly description: "Binding alias chosen by the caller: 1–40 lowercase letters, digits or hyphens, beginning with a letter.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "vault";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Active vault ID or exact display name from praxis.vault.vaults.list in your organization. Use an ID if display names are duplicated.";
+        }];
+    };
 }, {
     readonly resource: "automation.workflows.versions";
     readonly method: "list";
@@ -5344,7 +5512,7 @@ export declare const operations: readonly [{
     readonly method: "create";
     readonly aliases: readonly ["publish"];
     readonly summary: "Publish a workflow version";
-    readonly description: "Publish a saved definition from its draft or an ad hoc run as a reusable version for named runs or triggers, validating the definition and locking dependencies. To test unpublished code, use praxis.automation.runs.create with source and language instead. Use draft.revision from create or retrieve as expected_draft_revision. The draft must match expected_draft_revision; an ad hoc run requires from_run and expected_source_sha256. The same version and contents return the existing version; different contents return VERSION_EXISTS, prereleases require an explicit tag (not latest, URL-safe characters only, not a version or range; violations return TAG_REQUIRED or TAG_INVALID with the complete rules in hint), and invalid definitions return DEFINITION_INVALID. Stable releases automatically advance latest only above the highest existing stable version; workflows becoming latest synchronize their declared schedule. String and object run.workflow/run.script references share version resolution and dependency locking. Publishing removes +build metadata from the version number.";
+    readonly description: "Publish a saved definition from its draft or an ad hoc run as a reusable version for named runs or triggers, validating the definition and locking dependencies. To test unpublished code, use praxis.automation.runs.create with source and language instead. Use draft.revision from create or retrieve as expected_draft_revision. The draft must match expected_draft_revision; an ad hoc run requires from_run and expected_source_sha256. The same version and contents return the existing version; different contents return VERSION_EXISTS, prereleases require an explicit tag (not latest, URL-safe characters only, not a version or range; violations return TAG_REQUIRED or TAG_INVALID with the complete rules in hint), and invalid definitions return DEFINITION_INVALID. Stable releases automatically advance latest only above the highest existing stable version; workflows becoming latest synchronize their declared schedule. String and object run.workflow/run.script references share version resolution and dependency locking. Publishing removes +build metadata from the version number. For a workflow, document namespace, name and version must equal the publish target, otherwise DEFINITION_IDENTITY_MISMATCH; where a DEFINITION_INVALID failure sits is listed in errors[] (pointer, detail, hint).";
     readonly http: "POST";
     readonly path: "/automation/v1/workflows/{ns}/{name}/versions";
     readonly streaming: "no";
@@ -5718,187 +5886,1108 @@ export declare const operations: readonly [{
             readonly name: "name";
             readonly type: "string";
             readonly required: false;
-            readonly description: "会话名称；1–128 个 ASCII 字母、数字或 . _ : -，可用于筛选会话。";
+            readonly description: "会话名称；1–128 个 ASCII 字母、数字或 . _ : -，可用于筛选会话。";
+        }, {
+            readonly name: "labels";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "自定义字符串标签；最多 32 项，键最多 128 个 UTF-8 字节，值最多 1024 个 UTF-8 字节。";
+        }];
+    };
+}, {
+    readonly resource: "browser.sessions";
+    readonly method: "retrieve";
+    readonly summary: "读取浏览器会话";
+    readonly description: "读取当前账户的指定会话及其最新状态，sessionId 使用创建或列表返回的 id。expand=debug,events 可同时取得实时观看地址和事件首页；不存在或不属于当前账户时返回 404。";
+    readonly http: "GET";
+    readonly path: "/browser/v1/sessions/{sessionId}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [{
+        readonly name: "expand";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "逗号分隔的 debug、events；在同一响应中返回调试地址和事件。";
+    }];
+}, {
+    readonly resource: "browser.sessions";
+    readonly method: "update";
+    readonly summary: "关闭浏览器会话";
+    readonly description: "关闭指定浏览器会话，返回关闭后的会话对象。请求体为 {\"status\":\"REQUEST_RELEASE\"}；若返回 409 SESSION_INVALID_STATE，可再次读取会话确认状态；已结束的会话可重复请求关闭。";
+    readonly http: "POST";
+    readonly path: "/browser/v1/sessions/{sessionId}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "status";
+            readonly type: "string";
+            readonly enum: readonly ["REQUEST_RELEASE"];
+            readonly required: true;
+            readonly description: "会话操作指令；REQUEST_RELEASE 表示请求关闭浏览器并结束会话。";
+        }];
+    };
+}, {
+    readonly resource: "browser.sessions";
+    readonly method: "retrieveDebug";
+    readonly summary: "读取调试地址";
+    readonly description: "读取当前会话及各标签页的实时观看地址和 CDP 连接地址。直接使用返回的完整链接，保留查询凭证；会话不在运行状态时 pages 为空，返回地址不代表会话仍可连接。";
+    readonly http: "GET";
+    readonly path: "/browser/v1/sessions/{sessionId}/debug";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "browser.sessions.events";
+    readonly method: "list";
+    readonly summary: "列出会话事件";
+    readonly description: "按事件序号升序读取指定会话的事件账本，包含生命周期和接管等事件，不包含页面点击或输入内容。可按 types 筛选，并将 nextCursor 原样传入读取后续页。";
+    readonly http: "GET";
+    readonly path: "/browser/v1/sessions/{sessionId}/events";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [{
+        readonly name: "cursor";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "上一页返回的 nextCursor，表示已读到的事件序号；省略时从最早事件开始。";
+    }, {
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "每页最多返回的记录数量；默认 50，范围 1–200。";
+    }, {
+        readonly name: "types";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "逗号分隔的账本事件类型，仅返回匹配项；省略时不按类型筛选。";
+    }];
+}, {
+    readonly resource: "browser.sessions.handoff";
+    readonly method: "create";
+    readonly summary: "请求人工接管";
+    readonly description: "为运行中的会话发起人工接管请求，返回接管请求事件。请求尚未过期或完成时，CDP 客户端的 Input.* 指令会被拒绝；再次请求会替换已有的接管说明和到期时刻。";
+    readonly http: "POST";
+    readonly path: "/browser/v1/sessions/{sessionId}/handoff";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "message";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "交给人工操作者的接管说明，可为空字符串。";
+        }, {
+            readonly name: "timeoutMs";
+            readonly type: "number";
+            readonly required: false;
+            readonly description: "接管请求有效时长，单位为毫秒；必须大于 0，可含小数。";
+        }];
+    };
+}, {
+    readonly resource: "browser.sessions.handoff";
+    readonly method: "complete";
+    readonly summary: "完成人工接管";
+    readonly description: "完成运行中会话的待处理人工接管，清除接管请求并返回完成事件，客户端可恢复发送 Input.* 指令。没有请求或请求已过期时返回 409 HANDOFF_NOT_PENDING。";
+    readonly http: "POST";
+    readonly path: "/browser/v1/sessions/{sessionId}/handoff/complete";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "browser.sessions";
+    readonly method: "stream";
+    readonly summary: "订阅会话动态";
+    readonly description: "SSE：event 为 snapshot、session、pages、action、event 或 end，data 为对应 JSON。先发送 snapshot 快照，再推送实时变化和 ping 注释；end 后关闭。不支持按 Last-Event-ID 历史重放。";
+    readonly http: "GET";
+    readonly path: "/browser/v1/sessions/{sessionId}/stream";
+    readonly streaming: "always";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "browser.sessions.viewer";
+    readonly method: "create";
+    readonly summary: "更新查看者心跳";
+    readonly description: "登记运行中会话的观看者仍在线，以免无人连接时因空闲被释放。观看页面可见期间为同一观看者重复发送相同 viewerId；停止观看后停止发送，过期心跳不再计为在线。";
+    readonly http: "POST";
+    readonly path: "/browser/v1/sessions/{sessionId}/viewer";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "sessionId";
+        readonly sdkName: "sessionId";
+        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "viewerId";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "当前观看者的稳定标识；同一观看者重复心跳应使用相同值，长度为 1–128 个 UTF-16 代码单元。";
+        }];
+    };
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "list";
+    readonly summary: "List canvases";
+    readonly description: "Discover canvases in the API key's organization and obtain ids for retrieval or editing. Results are ordered by updated_at from newest to oldest. limit is 1–100 and defaults to 50; omit cursor for the first page, then copy next_cursor into the next request until it is null. Deleted canvases are unavailable.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/canvases";
+    readonly streaming: "no";
+    readonly pagination: true;
+    readonly pathParams: readonly [];
+    readonly query: readonly [{
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum canvases to return per page, from 1 to 100; defaults to 50 when omitted.";
+    }, {
+        readonly name: "cursor";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Opaque next_cursor from the preceding list response; omit for the first page and stop when next_cursor is null.";
+    }, {
+        readonly name: "collection_id";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Filter to a collection id from collections.list, or the literal none for uncategorized canvases. Omit to list all canvases; keep the same filter when following next_cursor.";
+    }];
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "create";
+    readonly summary: "Create canvas";
+    readonly description: "Create a blank design canvas in the API key's organization before drawing with praxis.canvas.canvases.execute. Send an optional name of at most 200 characters; omitting name uses Untitled. Each successful call creates a new canvas and returns its id and viewer_url with HTTP 201; save the id for subsequent reads, edits and deletion.";
+    readonly http: "POST";
+    readonly path: "/canvas/v1/canvases";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: false;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Display name for the new canvas, at most 200 characters; omission uses Untitled.";
+        }];
+    };
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "delete";
+    readonly summary: "Delete canvas";
+    readonly description: "Permanently delete a canvas and its design content when it is no longer needed. Obtain canvas_id from create or list and confirm the target before calling; deletion cannot be undone. HTTP 200 confirms deletion with deleted=true. Subsequent access returns CANVAS_NOT_FOUND, as it does for a missing canvas or one outside the API key's organization.";
+    readonly http: "DELETE";
+    readonly path: "/canvas/v1/canvases/{canvas_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "retrieve";
+    readonly summary: "Retrieve canvas";
+    readonly description: "Inspect the current canvas before editing, like Pencil get_app_state. The response adds top-level node summaries in canvas order and reusable component ids to the canvas metadata. Use these ids in nodes.list, images.list or an execute script; use the returned version as expected_version to detect concurrent edits. Read full node content with nodes.list rather than guessing fields from these summaries.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/canvases/{canvas_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "update";
+    readonly summary: "Update canvas";
+    readonly description: "Rename a canvas or move it to a collection without editing its design content. Use a canvas id from canvases.list and a collection id from collections.list. Send collection_id=null to make it uncategorized; omit either field to preserve its current value. A canvas belongs to at most one collection. The destination must belong to your organization. Renaming keeps the canvas version unchanged.";
+    readonly http: "PATCH";
+    readonly path: "/canvas/v1/canvases/{canvas_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "New canvas display name; surrounding whitespace is trimmed, blank names use Untitled, and omission preserves the current name.";
+        }, {
+            readonly name: "collection_id";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Move to this collection id from collections.list; null removes the canvas from its collection. Omission preserves the current assignment.";
+        }];
+    };
+}, {
+    readonly resource: "canvas.canvases.images";
+    readonly method: "list";
+    readonly summary: "Render canvas nodes";
+    readonly description: "Render 1–4 nodes to inspect the visual result of a design edit. Use ids from retrieve, execute.created or execute.screenshots; scale defaults to 1 and accepts 0.25–4, and png is the only supported format. Unlike Figma, images contains inline data:image/png;base64,... URLs, not hosted image URLs; a null entry means no image is available for that id. Use nodes.list for editable node content instead of pixels.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/canvases/{canvas_id}/images";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [{
+        readonly name: "version";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Decimal version from versions.list, or its earliest_restorable_version, for a read-only historical snapshot; omit to read current state. Unavailable versions return VERSION_NOT_FOUND.";
+    }, {
+        readonly name: "ids";
+        readonly type: "string";
+        readonly required: true;
+        readonly description: "Comma-separated list of 1–4 node ids to render, from retrieve, execute.created or execute.screenshots.";
+    }, {
+        readonly name: "scale";
+        readonly type: "number";
+        readonly required: false;
+        readonly description: "Output pixel scale relative to canvas dimensions, from 0.25 to 4 inclusive; defaults to 1 when omitted.";
+    }, {
+        readonly name: "format";
+        readonly type: "string";
+        readonly enum: readonly ["png"];
+        readonly required: false;
+        readonly description: "Image encoding; png produces a PNG data URL and is the only supported value. Omit to use png.";
+    }];
+}, {
+    readonly resource: "canvas.canvases.nodes";
+    readonly method: "list";
+    readonly summary: "Read canvas nodes";
+    readonly description: "Read node documents for inspection before changing individual nodes. Supply 1–100 comma-separated node ids from retrieve or execute, or instance paths such as a/b. depth is an integer at least 0; omit it for complete subtrees. Each requested id maps to a document wrapper or null if absent. Unlike Figma, document contains a Pencil .pen 2.21 node, not a Figma node. For top-level summaries use canvases.retrieve; for pixels use images.list.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/canvases/{canvas_id}/nodes";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [{
+        readonly name: "version";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Decimal version from versions.list, or its earliest_restorable_version, for a read-only historical snapshot; omit to read current state. Unavailable versions return VERSION_NOT_FOUND.";
+    }, {
+        readonly name: "ids";
+        readonly type: "string";
+        readonly required: true;
+        readonly description: "Comma-separated list of 1–100 node ids from retrieve or execute, or instance paths such as a/b; missing ids map to null.";
+    }, {
+        readonly name: "depth";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum child depth below each requested node, as an integer at least 0; 0 returns the node without descendants, and omission returns the complete subtree.";
+    }];
+}, {
+    readonly resource: "canvas.canvases.versions";
+    readonly method: "list";
+    readonly summary: "List canvas versions";
+    readonly description: "Inspect retained edits before restoring a canvas or reading historical nodes and images. Supply a canvas_id from canvases.list or create. Results include successful execute, import and restore commits since history was enabled, newest first. limit is 1–100 and defaults to 30; pass next_cursor as cursor until it is null. All versions from the last 30 days are retained unless the 256 MiB history budget requires pruning; the newest 100 versions are always retained regardless of age or size. earliest_restorable_version is the oldest readable and restorable version, including the state immediately before the first retained commit; null means no history has been recorded. Listing does not change the canvas.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/canvases/{canvas_id}/versions";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [{
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum commits to return, from 1 to 100 inclusive; omission uses 30.";
+    }, {
+        readonly name: "cursor";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Copy next_cursor from the preceding page to continue toward older commits; omit for the first page.";
+    }];
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "execute";
+    readonly summary: "Execute canvas script";
+    readonly description: "Draw or edit a canvas atomically with a synchronous Pencil execute script. First create a canvas with praxis.canvas.canvases.create and use its id as canvas_id; inspect an existing canvas with retrieve before modifying it. Send exactly one of script (new source) or edit_id (a failed script to patch using edits). Unlike Figma REST, :execute writes design content; nodes use Pencil .pen schema 2.21 (frame/group/rectangle/ellipse/polygon/path/text/icon/ref/note), not Figma node fields.\n\nThe root variable is document. Synchronous functions are Insert / Copy / Update / Replace / Move / Delete / SetVariables / Get / GetVariables / FindEmptySpace / Print / TakeScreenshot; globals persist for the next call. A first frame needs only this body.script:\n\n```js\nconst f = Insert(document, { type: \"frame\", name: \"Hero\", width: 1200, layout: \"vertical\", padding: 48, fill: \"#FFFFFF\" }); Insert(f, { type: \"text\", content: \"Hello\", fontSize: 32, fill: \"#111111\" }); Print(f)\n```\n\nInsert/Copy return the new node id; read the copy with Get(id) — copied descendants get new ids, so change them through Copy's third argument `descendants` keyed by the source node ids. To copy a page and change its title in the same script:\n\n```js canvas-example=\"copy-page\"\nconst page = Insert(document, {type:\"frame\",name:\"Original\",width:320,height:160,layout:\"vertical\",padding:16});\nconst title = Insert(page, {type:\"text\",name:\"Title\",content:\"Original\",fontSize:24});\nconst copy = Copy(page, document, {name:\"Copy\",x:360,descendants:{[title]:{content:\"Updated\"}}});\nPrint(copy); Print(Get(copy).children[0].content);\n```\n\nUse viewer_url to watch the result in Console. TakeScreenshot records node ids in screenshots; call images.list with those ids to fetch PNG data URLs. See the [Canvas execute reference](https://deepraxis.com/en/docs/api/native/canvas/execute) for request fields and results, and the [Canvas node reference](https://deepraxis.com/en/docs/developers/canvas/nodes) for node content.\n\nA successful write increments version by one. Optionally set expected_version to the version from retrieve or nodes.list; on 409 REVISION_CONFLICT read again, merge your intent and retry with the current version. Every script failure rolls back all writes. On 400 SCRIPT_ERROR, SCRIPT_LIMIT or OPS_REJECTED, use error.details.edit_id plus edits to repair and rerun the stored source without resending the entire script; details may include line, column and rejection. On 400 EDIT_EXPIRED the saved script is older than ten minutes: submit a corrected new script. On 429 CANVAS_BUSY, more than four calls are queued for this canvas: wait for pending calls before retrying.\n\nExecution errors include error.details.prints containing output printed before failure, with the same string-array shape and output limit as successful prints; rolled-back writes still create no version.\n";
+    readonly http: "POST";
+    readonly path: "/canvas/v1/canvases/{canvas_id}:execute";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "script";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "New synchronous Pencil execute source using document as the root; provide this or edit_id, never both. See the operation's first-frame example.";
+        }, {
+            readonly name: "edit_id";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Saved failed-script identifier from error.details.edit_id; use with edits instead of script within ten minutes of the failure.";
+        }, {
+            readonly name: "edits";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: false;
+            readonly description: "Text replacements applied to the source identified by edit_id before rerunning; use error line, column or rejection to choose the correction.";
+        }, {
+            readonly name: "expected_version";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Revision from retrieve, nodes.list or the previous execute response; omit for an unguarded write. A mismatch returns 409 REVISION_CONFLICT with details.version.";
+        }];
+    };
+}, {
+    readonly resource: "canvas.canvases";
+    readonly method: "restore";
+    readonly summary: "Restore canvas version";
+    readonly description: "Recover a canvas after an unwanted edit by restoring a retained version from versions.list or its earliest_restorable_version. This replaces current nodes, variables and themes with the target state and creates one new version; history remains available, so restoring can itself be undone with another restore. Restoring the current version succeeds without creating a version. Optionally guard the write with expected_version from retrieve or nodes.list; if it is stale, inspect current state and retry with the new value. Repeating an unguarded request after another edit can create another restore version. Versions from before history was enabled or outside retention cannot be recovered. Connected viewers resync after a successful restore.";
+    readonly http: "POST";
+    readonly path: "/canvas/v1/canvases/{canvas_id}:restore";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "canvas_id";
+        readonly sdkName: "canvas_id";
+        readonly description: "Canvas id returned by create or list, in the form cvs_ followed by 16 lowercase letters or digits; a display name is not accepted.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "version";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Historical target from versions.list or earliest_restorable_version; restoring the current version creates no new commit.";
+        }, {
+            readonly name: "expected_version";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Current version from retrieve or nodes.list to guard against concurrent edits; omission applies the restore to whichever version is current.";
+        }];
+    };
+}, {
+    readonly resource: "canvas.collections";
+    readonly method: "list";
+    readonly summary: "List collections";
+    readonly description: "Find collections and ids for filtering or moving canvases. All organization collections are returned in name order in one response; next_cursor is always null. canvas_count excludes deleted canvases. total_count counts all live canvases, rather than collections, and uncategorized_count counts live canvases without a collection. Use canvases.list with collection_id to read a collection or none to read uncategorized canvases.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/collections";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+}, {
+    readonly resource: "canvas.collections";
+    readonly method: "create";
+    readonly summary: "Create collection";
+    readonly description: "Organize canvases by creating a one-level collection in your organization. Send a name of 1–100 characters after trimming; duplicate names are allowed. Each call creates a new collection, initially containing no canvases. Use canvases.update with its id as collection_id to move existing canvases into it. Collections cannot be nested and an organization can have at most 200.";
+    readonly http: "POST";
+    readonly path: "/canvas/v1/collections";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Collection display name, 1–100 characters after trimming surrounding whitespace; duplicate names within the organization are allowed.";
+        }];
+    };
+}, {
+    readonly resource: "canvas.collections";
+    readonly method: "delete";
+    readonly summary: "Delete collection";
+    readonly description: "Remove a collection using an id from collections.list. All its canvases are preserved and become uncategorized, with collection_id set to null; read them using canvases.list with collection_id=none. The removed collection cannot be retrieved again, and repeating deletion returns COLLECTION_NOT_FOUND.";
+    readonly http: "DELETE";
+    readonly path: "/canvas/v1/collections/{collection_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "collection_id";
+        readonly sdkName: "collection_id";
+        readonly description: "Collection id from collections.create or collections.list, in the form col_ followed by 16 lowercase letters or digits; a display name is not an identifier.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "canvas.collections";
+    readonly method: "retrieve";
+    readonly summary: "Retrieve collection";
+    readonly description: "Inspect one collection and its current live canvas count using an id from collections.list or collections.create. The collection must belong to the API key organization. To read its canvases, pass the same id as collection_id to canvases.list; this response contains collection metadata only.";
+    readonly http: "GET";
+    readonly path: "/canvas/v1/collections/{collection_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "collection_id";
+        readonly sdkName: "collection_id";
+        readonly description: "Collection id from collections.create or collections.list, in the form col_ followed by 16 lowercase letters or digits; a display name is not an identifier.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "canvas.collections";
+    readonly method: "update";
+    readonly summary: "Rename collection";
+    readonly description: "Change the display name of a collection from collections.list without changing its id or canvas assignments. Names contain 1–100 characters after trimming and may match another collection name. This operation does not move canvases; use canvases.update with collection_id for that.";
+    readonly http: "PATCH";
+    readonly path: "/canvas/v1/collections/{collection_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "collection_id";
+        readonly sdkName: "collection_id";
+        readonly description: "Collection id from collections.create or collections.list, in the form col_ followed by 16 lowercase letters or digits; a display name is not an identifier.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Collection display name, 1–100 characters after trimming surrounding whitespace; duplicate names within the organization are allowed.";
+        }];
+    };
+}, {
+    readonly resource: "cut.exports";
+    readonly method: "retrieve";
+    readonly summary: "Retrieve video export";
+    readonly description: "Poll an export id returned by projects.exports.create or list to observe render progress. queued, fetching, rendering, stitching and saving are in progress; done provides asset in the target library, failed provides error, and canceled means the job stopped. Only done confirms a usable output asset.";
+    readonly http: "GET";
+    readonly path: "/cut/v1/exports/{export_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "export_id";
+        readonly sdkName: "export_id";
+        readonly description: "Export identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "cut.exports";
+    readonly method: "cancel";
+    readonly summary: "Cancel video export";
+    readonly description: "Request cancellation of an export obtained from projects.exports.create or list when its output is no longer needed. Read the returned job status and retrieve it to confirm the terminal outcome; do not interpret a cancellation request as successful rendering.";
+    readonly http: "POST";
+    readonly path: "/cut/v1/exports/{export_id}:cancel";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "export_id";
+        readonly sdkName: "export_id";
+        readonly description: "Export identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "cut.projects";
+    readonly method: "list";
+    readonly summary: "List projects";
+    readonly description: "Discover projects owned by the API key organization and obtain project_id values. Results default to active projects ordered by updateTime descending; use filter state = \"deleted\" to find retained deleted projects for undelete. Continue with next_page_token as page_token until the token is absent.";
+    readonly http: "GET";
+    readonly path: "/cut/v1/projects";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [{
+        readonly name: "page_size";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum resources in one page, from 1 to 100; defaults to 50.";
+    }, {
+        readonly name: "page_token";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Opaque next_page_token from the preceding page; omit on the first request.";
+    }, {
+        readonly name: "filter";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Optional resource filter; projects supports state = \"active\" or state = \"deleted\".";
+    }, {
+        readonly name: "order_by";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Optional ordering expression; projects supports updateTime desc.";
+    }];
+}, {
+    readonly resource: "cut.projects";
+    readonly method: "create";
+    readonly summary: "Create project";
+    readonly description: "Create a blank editing project in the API key organization before writing a script. First obtain accessible library ids from praxis.media; bindings must include exactly one read_write library with default_upload true. Each call creates a new project and returns HTTP 201; save its id for execute, state and timeline calls. All editing positions use seconds.";
+    readonly http: "POST";
+    readonly path: "/cut/v1/projects";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Human-readable project name; required and must contain non-whitespace text.";
+        }, {
+            readonly name: "labels";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "User-defined string labels for organizing projects; label keys retain their original spelling.";
+        }, {
+            readonly name: "settings";
+            readonly type: "object";
+            readonly required: true;
+            readonly description: "Dimensions and frame rate for a new editing project.";
+        }, {
+            readonly name: "bindings";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: true;
+            readonly description: "Accessible library bindings; exactly one read_write entry must have default_upload true.";
+        }];
+    };
+}, {
+    readonly resource: "cut.projects";
+    readonly method: "delete";
+    readonly summary: "Delete project";
+    readonly description: "Soft-delete a project selected from projects.list. The project is retained for seven days until purge_time and can be restored with undelete before that deadline. Deleted projects cannot be edited; list with filter state = \"deleted\" to locate retained projects.";
+    readonly http: "DELETE";
+    readonly path: "/cut/v1/projects/{project_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "cut.projects";
+    readonly method: "retrieve";
+    readonly summary: "Retrieve project";
+    readonly description: "Inspect project metadata, settings and library bindings before editing. Copy id from projects.create or list; expand=timeline,exports,versions includes selected related resources. The expanded timeline uses seconds and the returned revision can guard a later execute call with expected_revision.";
+    readonly http: "GET";
+    readonly path: "/cut/v1/projects/{project_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [{
+        readonly name: "expand";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Comma-separated expansions: timeline includes clips, exports includes render jobs, versions includes saved snapshots.";
+    }];
+}, {
+    readonly resource: "cut.projects";
+    readonly method: "update";
+    readonly summary: "Update project metadata";
+    readonly description: "Change the project display name or replace its labels by naming those fields in update_mask. Use execute for clip or track edits. Each successful update commits a new revision; labels are replaced as a whole when selected, so read and merge existing labels before overwriting them.";
+    readonly http: "PATCH";
+    readonly path: "/cut/v1/projects/{project_id}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Replacement display name when update_mask includes name.";
+        }, {
+            readonly name: "labels";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "User-defined string labels for organizing projects; label keys retain their original spelling.";
+        }, {
+            readonly name: "update_mask";
+            readonly type: "array";
+            readonly itemType: "string";
+            readonly enum: readonly ["name", "labels"];
+            readonly required: true;
+            readonly description: "Metadata fields to replace; name changes the display name and labels replaces all labels.";
+        }];
+    };
+}, {
+    readonly resource: "cut.projects.analysis";
+    readonly method: "create";
+    readonly summary: "Analyze project media";
+    readonly description: "Request silence, filler-word or scene analysis for selected bound assets before editing. Omit media to select project sources; ranges returned in segments use source seconds. A pending result is not completion: use retry_after_sec before checking again, and inspect failed or unsupported asset results before deciding which edits are possible.";
+    readonly http: "POST";
+    readonly path: "/cut/v1/projects/{project_id}/analysis";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "media";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: false;
+            readonly description: "Bound-library assets to analyze; omission selects project media.";
+        }, {
+            readonly name: "kinds";
+            readonly type: "array";
+            readonly itemType: "string";
+            readonly enum: readonly ["silence", "filler", "scenes"];
+            readonly required: true;
+            readonly description: "Analysis types to request for the selected source assets.";
+        }];
+    };
+}, {
+    readonly resource: "cut.projects.bindings";
+    readonly method: "list";
+    readonly summary: "List library bindings";
+    readonly description: "Discover the named media libraries available to this project before selecting source assets or an import/export destination. read bindings supply source assets; read_write bindings also accept uploads. Exactly one writable binding supplies the default upload destination.";
+    readonly http: "GET";
+    readonly path: "/cut/v1/projects/{project_id}/bindings";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "cut.projects.bindings";
+    readonly method: "create";
+    readonly summary: "Bind media library";
+    readonly description: "Attach an accessible media library to an existing project under a unique name. Obtain library_id from praxis.media and choose read for source-only access or read_write for imports and exports. The project must retain exactly one read_write binding with default_upload true after the change.";
+    readonly http: "POST";
+    readonly path: "/cut/v1/projects/{project_id}/bindings";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "binding";
+            readonly type: "object";
+            readonly required: true;
+            readonly description: "A named project link to a media library. Exactly one read_write binding must be default_upload.";
+        }];
+    };
+}, {
+    readonly resource: "cut.projects.bindings";
+    readonly method: "delete";
+    readonly summary: "Remove library binding";
+    readonly description: "Detach a library alias obtained from bindings.list after removing all timeline clips that reference its library. BINDING_IN_USE returns 409 while references remain; inspect timeline and edit those clips first. Removal must preserve the one writable default upload binding.";
+    readonly http: "DELETE";
+    readonly path: "/cut/v1/projects/{project_id}/bindings/{name}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }, {
+        readonly name: "name";
+        readonly sdkName: "name";
+        readonly description: "Project-local binding alias from bindings.list; detach only after removing all clips that reference its library.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "cut.projects.exports";
+    readonly method: "list";
+    readonly summary: "List project exports";
+    readonly description: "Find export jobs associated with this project before polling or canceling a render. Copy an export id into praxis.cut.exports.retrieve or cancel. Continue with next_page_token as page_token when present; queued or in-progress jobs have not produced a final media asset.";
+    readonly http: "GET";
+    readonly path: "/cut/v1/projects/{project_id}/exports";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [{
+        readonly name: "page_size";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum resources in one page, from 1 to 100; defaults to 50.";
+    }, {
+        readonly name: "page_token";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Opaque next_page_token from the preceding page; omit on the first request.";
+    }, {
+        readonly name: "filter";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Optional resource filter; projects supports state = \"active\" or state = \"deleted\".";
+    }, {
+        readonly name: "order_by";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Optional ordering expression; projects supports updateTime desc.";
+    }];
+}, {
+    readonly resource: "cut.projects.exports";
+    readonly method: "create";
+    readonly summary: "Create video export";
+    readonly description: "Start an asynchronous video export from the project into a writable bound media library. Choose binding from bindings.list or omit it for default_upload, and optionally select revision and output settings. HTTP 202 only accepts the job; poll praxis.cut.exports.retrieve using the returned id until status is done, failed or canceled. On done, asset identifies the video written back to praxis.media. Each call starts a job, so retrieve a known job before retrying a submission.";
+    readonly http: "POST";
+    readonly path: "/cut/v1/projects/{project_id}/exports";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "output";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "Rendering options for an exported video.";
+        }, {
+            readonly name: "binding";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Writable binding name used as the export destination; omission uses default_upload.";
         }, {
-            readonly name: "labels";
-            readonly type: "object";
+            readonly name: "revision";
+            readonly type: "integer";
             readonly required: false;
-            readonly description: "自定义字符串标签；最多 32 项，键最多 128 个 UTF-8 字节，值最多 1024 个 UTF-8 字节。";
+            readonly description: "Committed project revision from retrieve, state, timeline or execute; increases after each successful write.";
         }];
     };
 }, {
-    readonly resource: "browser.sessions";
-    readonly method: "retrieve";
-    readonly summary: "读取浏览器会话";
-    readonly description: "读取当前账户的指定会话及其最新状态，sessionId 使用创建或列表返回的 id。expand=debug,events 可同时取得实时观看地址和事件首页；不存在或不属于当前账户时返回 404。";
+    readonly resource: "cut.projects.frames";
+    readonly method: "list";
+    readonly summary: "Render preview frames";
+    readonly description: "Review the visual result at one or more project times without creating an export. Pass comma-separated seconds in at, such as 12,15.5; scale changes preview size and revision selects a committed project revision. Fetch the returned image URLs before expires_at; render again when they expire.";
     readonly http: "GET";
-    readonly path: "/browser/v1/sessions/{sessionId}";
+    readonly path: "/cut/v1/projects/{project_id}/frames";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [{
-        readonly name: "expand";
+        readonly name: "at";
         readonly type: "string";
+        readonly required: true;
+        readonly description: "Required comma-separated non-negative project times in seconds, for example 12,15.5.";
+    }, {
+        readonly name: "scale";
+        readonly type: "number";
         readonly required: false;
-        readonly description: "逗号分隔的 debug、events；在同一响应中返回调试地址和事件。";
+        readonly description: "Positive image size multiplier; 0.5 renders at half the project dimensions.";
+    }, {
+        readonly name: "revision";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Optional committed project revision from state or execute; omission selects the current revision.";
     }];
 }, {
-    readonly resource: "browser.sessions";
-    readonly method: "update";
-    readonly summary: "关闭浏览器会话";
-    readonly description: "关闭指定浏览器会话，返回关闭后的会话对象。请求体为 {\"status\":\"REQUEST_RELEASE\"}；若返回 409 SESSION_INVALID_STATE，可再次读取会话确认状态；已结束的会话可重复请求关闭。";
+    readonly resource: "cut.projects.media";
+    readonly method: "import";
+    readonly summary: "Import project media";
+    readonly description: "Import a URL, data URI or existing file into a writable project media library. Select binding from bindings.list or omit it to use default_upload. Save library_id and asset_id from the result and use them as libraryId and assetId inside execute script media references; overwrites follow the source asset latest version.";
     readonly http: "POST";
-    readonly path: "/browser/v1/sessions/{sessionId}";
+    readonly path: "/cut/v1/projects/{project_id}/media:import";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [];
     readonly body: {
         readonly required: true;
         readonly fields: readonly [{
-            readonly name: "status";
+            readonly name: "binding";
             readonly type: "string";
-            readonly enum: readonly ["REQUEST_RELEASE"];
+            readonly required: false;
+            readonly description: "Writable binding name from project bindings; omission uses default_upload.";
+        }, {
+            readonly name: "source";
+            readonly type: "object";
             readonly required: true;
-            readonly description: "会话操作指令；REQUEST_RELEASE 表示请求关闭浏览器并结束会话。";
+            readonly description: "Exactly one input source for the imported asset.";
+        }, {
+            readonly name: "display_name";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Optional human-readable display name for the new media asset.";
         }];
     };
 }, {
-    readonly resource: "browser.sessions";
-    readonly method: "retrieveDebug";
-    readonly summary: "读取调试地址";
-    readonly description: "读取当前会话及各标签页的实时观看地址和 CDP 连接地址。直接使用返回的完整链接，保留查询凭证；会话不在运行状态时 pages 为空，返回地址不代表会话仍可连接。";
+    readonly resource: "cut.projects";
+    readonly method: "retrieveState";
+    readonly summary: "Read editing state";
+    readonly description: "Read lightweight project context before composing an execute script. Returns current revision, rendering settings, track counts, library bindings and offline media count without individual clips. For complete clip documents or a selected time range, read timeline instead.";
     readonly http: "GET";
-    readonly path: "/browser/v1/sessions/{sessionId}/debug";
+    readonly path: "/cut/v1/projects/{project_id}/state";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [];
 }, {
-    readonly resource: "browser.sessions.events";
-    readonly method: "list";
-    readonly summary: "列出会话事件";
-    readonly description: "按事件序号升序读取指定会话的事件账本，包含生命周期和接管等事件，不包含页面点击或输入内容。可按 types 筛选，并将 nextCursor 原样传入读取后续页。";
+    readonly resource: "cut.projects";
+    readonly method: "retrieveTimeline";
+    readonly summary: "Read project timeline";
+    readonly description: "Inspect clips and markers in a selected project range before editing. view=full returns structured tracks with all timeline positions in seconds; view=compact returns compact text for script context. from and to are seconds and tracks limits the selection to comma-separated track ids from state. Concurrent changes while preparing a full timeline return 409; retrieve the latest state and try the read again.";
     readonly http: "GET";
-    readonly path: "/browser/v1/sessions/{sessionId}/events";
+    readonly path: "/cut/v1/projects/{project_id}/timeline";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [{
-        readonly name: "cursor";
+        readonly name: "view";
         readonly type: "string";
+        readonly enum: readonly ["full", "compact"];
         readonly required: false;
-        readonly description: "上一页返回的 nextCursor，表示已读到的事件序号；省略时从最早事件开始。";
+        readonly description: "full returns structured clips; compact returns compact textual editing context.";
     }, {
-        readonly name: "limit";
+        readonly name: "from";
+        readonly type: "number";
+        readonly required: false;
+        readonly description: "Optional start of the selected project range in seconds; omit for the beginning.";
+    }, {
+        readonly name: "to";
+        readonly type: "number";
+        readonly required: false;
+        readonly description: "Optional end of the selected project range in seconds; omit for the end.";
+    }, {
+        readonly name: "tracks";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Comma-separated track ids from state to include; omit to include every track.";
+    }];
+}, {
+    readonly resource: "cut.projects.versions";
+    readonly method: "list";
+    readonly summary: "List saved versions";
+    readonly description: "Find saved timeline snapshots for this project and obtain version_id values for restore. A saved version records its original revision; restoring it creates a new current revision rather than rewinding the revision counter. Continue with next_page_token as page_token until absent.";
+    readonly http: "GET";
+    readonly path: "/cut/v1/projects/{project_id}/versions";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
+    }];
+    readonly query: readonly [{
+        readonly name: "page_size";
         readonly type: "integer";
         readonly required: false;
-        readonly description: "每页最多返回的记录数量；默认 50，范围 1–200。";
+        readonly description: "Maximum resources in one page, from 1 to 100; defaults to 50.";
     }, {
-        readonly name: "types";
+        readonly name: "page_token";
         readonly type: "string";
         readonly required: false;
-        readonly description: "逗号分隔的账本事件类型，仅返回匹配项；省略时不按类型筛选。";
+        readonly description: "Opaque next_page_token from the preceding page; omit on the first request.";
+    }, {
+        readonly name: "filter";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Optional resource filter; projects supports state = \"active\" or state = \"deleted\".";
+    }, {
+        readonly name: "order_by";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Optional ordering expression; projects supports updateTime desc.";
     }];
 }, {
-    readonly resource: "browser.sessions.handoff";
+    readonly resource: "cut.projects.versions";
     readonly method: "create";
-    readonly summary: "请求人工接管";
-    readonly description: "为运行中的会话发起人工接管请求，返回接管请求事件。请求尚未过期或完成时，CDP 客户端的 Input.* 指令会被拒绝；再次请求会替换已有的接管说明和到期时刻。";
+    readonly summary: "Save project version";
+    readonly description: "Save the current project timeline as a named recovery point before a substantial edit. Supply an optional label or send an empty object; keep the returned version id for versions.restore. Saving a version does not publish a rendered asset; use projects.exports.create for video output.";
     readonly http: "POST";
-    readonly path: "/browser/v1/sessions/{sessionId}/handoff";
+    readonly path: "/cut/v1/projects/{project_id}/versions";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [];
     readonly body: {
         readonly required: true;
         readonly fields: readonly [{
-            readonly name: "message";
+            readonly name: "label";
             readonly type: "string";
-            readonly required: true;
-            readonly description: "交给人工操作者的接管说明，可为空字符串。";
-        }, {
-            readonly name: "timeoutMs";
-            readonly type: "number";
             readonly required: false;
-            readonly description: "接管请求有效时长，单位为毫秒；必须大于 0，可含小数。";
+            readonly description: "Human-readable snapshot label, such as Before captions.";
         }];
     };
 }, {
-    readonly resource: "browser.sessions.handoff";
-    readonly method: "complete";
-    readonly summary: "完成人工接管";
-    readonly description: "完成运行中会话的待处理人工接管，清除接管请求并返回完成事件，客户端可恢复发送 Input.* 指令。没有请求或请求已过期时返回 409 HANDOFF_NOT_PENDING。";
+    readonly resource: "cut.projects";
+    readonly method: "execute";
+    readonly summary: "Execute editing script";
+    readonly description: "Edit the current timeline atomically using synchronous JavaScript source. Read state or timeline first, then pass its revision as expected_revision to detect concurrent changes. Use AddTrack, Insert, Update, Delete, Split, Trim, Move, RippleDeleteRange, UpdateTrack, DeleteTrack, SetSettings, AddCaptionsFromTranscript and SetMarker for writes; GetTimeline, GetItem, FindItems, GetMedia, GetTranscript and GetAnalysis read editing context; Print emits text and Preview requests frame previews. All script times are seconds; script object fields use camelCase, for example `media: {libraryId, assetId}`. Unlike Shotstack, execute applies script edits to a persistent project in one transaction. Provide script or a saved edit_id with literal edits, never both; failures roll back writes. A revision conflict while preparing the response may follow a committed edit: retrieve state before retrying. Minimal script after creating a project:\n\n```js\nconst t = AddTrack(\"video\");\nInsert(t, {type: \"color\", color: \"#123456\", start: 0, length: 3});\nPrint(t);\n```";
     readonly http: "POST";
-    readonly path: "/browser/v1/sessions/{sessionId}/handoff/complete";
+    readonly path: "/cut/v1/projects/{project_id}:execute";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "script";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Synchronous editing source using Cut execute functions; submit this or edit_id, never both. Script source is opaque: function names and object fields inside JavaScript use their documented camelCase spelling.";
+        }, {
+            readonly name: "edit_id";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Saved failed script identifier from error.details.edit_id; valid for ten minutes.";
+        }, {
+            readonly name: "edits";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: false;
+            readonly description: "Literal replacements applied to the saved source before rerunning.";
+        }, {
+            readonly name: "expected_revision";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Committed project revision from retrieve, state, timeline or execute; increases after each successful write.";
+        }];
+    };
 }, {
-    readonly resource: "browser.sessions";
-    readonly method: "stream";
-    readonly summary: "订阅会话动态";
-    readonly description: "SSE：event 为 snapshot、session、pages、action、event 或 end，data 为对应 JSON。先发送 snapshot 快照，再推送实时变化和 ping 注释；end 后关闭。不支持按 Last-Event-ID 历史重放。";
-    readonly http: "GET";
-    readonly path: "/browser/v1/sessions/{sessionId}/stream";
-    readonly streaming: "always";
+    readonly resource: "cut.projects";
+    readonly method: "undelete";
+    readonly summary: "Restore deleted project";
+    readonly description: "Return a retained deleted project to active state before its purge_time. Obtain project_id from projects.list filtered to deleted projects. This restores the project, not an older timeline revision; use versions.restore when reverting editing content.";
+    readonly http: "POST";
+    readonly path: "/cut/v1/projects/{project_id}:undelete";
+    readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "project_id";
+        readonly sdkName: "project_id";
+        readonly description: "Project identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [];
 }, {
-    readonly resource: "browser.sessions.viewer";
-    readonly method: "create";
-    readonly summary: "更新查看者心跳";
-    readonly description: "登记运行中会话的观看者仍在线，以免无人连接时因空闲被释放。观看页面可见期间为同一观看者重复发送相同 viewerId；停止观看后停止发送，过期心跳不再计为在线。";
+    readonly resource: "cut.versions";
+    readonly method: "restore";
+    readonly summary: "Restore saved version";
+    readonly description: "Replace current editing content with a saved project snapshot selected from projects.versions.list. The restore commits a new transaction and revision while preserving the saved version for future use. Inspect the returned summary and timeline before further editing; a response revision conflict can follow a committed restore, so retrieve current state before retrying.";
     readonly http: "POST";
-    readonly path: "/browser/v1/sessions/{sessionId}/viewer";
+    readonly path: "/cut/v1/versions/{version_id}:restore";
     readonly streaming: "no";
     readonly pagination: false;
     readonly pathParams: readonly [{
-        readonly name: "sessionId";
-        readonly sdkName: "sessionId";
-        readonly description: "浏览器会话 ID；使用创建或列出会话返回的 id，以 bss_ 开头。";
+        readonly name: "version_id";
+        readonly sdkName: "version_id";
+        readonly description: "Version identifier returned by its create or list operation; use the id, not a display name.";
     }];
     readonly query: readonly [];
-    readonly body: {
-        readonly required: true;
-        readonly fields: readonly [{
-            readonly name: "viewerId";
-            readonly type: "string";
-            readonly required: true;
-            readonly description: "当前观看者的稳定标识；同一观看者重复心跳应使用相同值，长度为 1–128 个 UTF-16 代码单元。";
-        }];
-    };
 }, {
     readonly resource: "database.databases";
     readonly method: "list";
@@ -6729,7 +7818,7 @@ export declare const operations: readonly [{
     readonly resource: "file.files";
     readonly method: "create";
     readonly summary: "Upload file";
-    readonly description: "Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data, assistants and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File([\"Return within 23 days.\"], \"policy.txt\", { type: \"text/plain\" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–2592000), or praxis[expires_in_seconds] (3600–7776000), never both. Without expiry, the file persists until deleted.";
+    readonly description: "Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File([\"Return within 23 days.\"], \"policy.txt\", { type: \"text/plain\" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–7776000). Without expiry, the file persists until deleted.";
     readonly http: "POST";
     readonly path: "/file/v1/files";
     readonly streaming: "no";
@@ -6747,19 +7836,14 @@ export declare const operations: readonly [{
         }, {
             readonly name: "purpose";
             readonly type: "string";
-            readonly enum: readonly ["user_data", "assistants", "vision"];
+            readonly enum: readonly ["user_data", "vision"];
             readonly required: true;
-            readonly description: "Purpose label stored with the file: user_data, assistants or vision. The vision purpose accepts only PNG, JPEG, GIF and WebP images. Conversation image references require user_data.";
+            readonly description: "Purpose label stored with the file: user_data or vision. The vision purpose accepts only PNG, JPEG, GIF and WebP images. Conversation image references require user_data.";
         }, {
             readonly name: "expires_after";
             readonly type: "object";
             readonly required: false;
             readonly description: "Optional expiry relative to created_at. Files without an expiry persist until deleted.";
-        }, {
-            readonly name: "praxis";
-            readonly type: "object";
-            readonly required: false;
-            readonly description: "Own-face extensions. Use at most one expiry setting.";
         }];
     };
 }, {
@@ -6807,11 +7891,59 @@ export declare const operations: readonly [{
         readonly description: "ID of a tenant-owned live file, as returned by upload or list; starts with file-.";
     }];
     readonly query: readonly [];
+}, {
+    readonly resource: "file.files.contentLinks";
+    readonly method: "revoke";
+    readonly summary: "Revoke a file content link";
+    readonly description: "Stop a previously issued content link from reading a file. Obtain the link with files.contentUrl.create. Use file_id from file creation or listing and the token path component from a content URL (/c/<token>), not the complete URL. The caller must own the file and have write access; a read-only binding is refused. Revocation propagates through the capability deny list within 30 seconds; the file and other links remain available. Only current IAM capability tokens can be revoked; legacy content links expire at the migration deadline. Example body: {\"token\":\"<token from /c/>\"}.";
+    readonly http: "POST";
+    readonly path: "/file/v1/files/{file_id}/content_links:revoke";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "file_id";
+        readonly sdkName: "file_id";
+        readonly description: "Tenant-owned file identifier returned by file creation or listing; the token must name this same file.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "token";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Signed token taken from the /c/ path component of a previously issued file content URL, without the host or /c/ prefix.";
+        }];
+    };
+}, {
+    readonly resource: "file.files.contentUrl";
+    readonly method: "create";
+    readonly summary: "Create a download URL";
+    readonly description: "Download a file's bytes to a local disk from a coding agent without sending them through the model. Use file_id from file creation or listing, then run curl -fsSL -o <filename> '<url>' locally with the returned URL; GET needs no Authorization header. The link is reusable until expiry and supports a single byte Range (for example Range: bytes=0-9 returns 206). Revoke it with files.contentLinks.revoke, passing the token after /c/ in the URL. Expired, revoked, invalid or cross-organization URLs return 404. Lifetime defaults to 3600 seconds and is at most 604800 seconds. Issuance requires the same credential and file-read access as files.retrieveContent; a processing file returns 409 FILE_NOT_READY, so poll files.retrieve until active before retrying. A missing, expired or other-organization file returns 404. Each issuance creates a new link. OpenAI Files has no signed download URL; this follows S3 presigned GET semantics. Example body: {\"ttl_seconds\":3600}.";
+    readonly http: "POST";
+    readonly path: "/file/v1/files/{file_id}/content_url";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "file_id";
+        readonly sdkName: "file_id";
+        readonly description: "Tenant-owned live file identifier from file creation or listing; the file must be active to issue a download URL.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: false;
+        readonly fields: readonly [{
+            readonly name: "ttl_seconds";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Download link lifetime in seconds, from 1 through 604800; omitted means 3600. This does not change the file's own expiry.";
+        }];
+    };
 }, {
     readonly resource: "file.uploads";
     readonly method: "create";
     readonly summary: "Create an upload";
-    readonly description: "Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 2 GiB (2147483648 bytes) and only user_data, assistants and vision purposes. Add parts of at most 64000000 bytes and complete within one hour. Optional part_size enables fixed-size, retryable parts. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.";
+    readonly description: "Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 2 GiB (2147483648 bytes) and only user_data and vision purposes. Add parts of at most 64000000 bytes and complete within one hour. Optional part_size enables fixed-size, retryable parts. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.";
     readonly http: "POST";
     readonly path: "/file/v1/uploads";
     readonly streaming: "no";
@@ -6838,9 +7970,9 @@ export declare const operations: readonly [{
         }, {
             readonly name: "purpose";
             readonly type: "string";
-            readonly enum: readonly ["user_data", "assistants", "vision"];
+            readonly enum: readonly ["user_data", "vision"];
             readonly required: true;
-            readonly description: "Use user_data for conversation attachments, assistants for assistant files, or vision for PNG, JPEG, GIF and WebP images.";
+            readonly description: "Use user_data for conversation attachments, or vision for PNG, JPEG, GIF and WebP images.";
         }, {
             readonly name: "expires_after";
             readonly type: "object";
@@ -6853,6 +7985,52 @@ export declare const operations: readonly [{
             readonly description: "Optional fixed part size in bytes, 5242880–64000000. Requires part_number on every part; retries of identical bytes at the same number return the same part. Omit to use arbitrary-sized parts.";
         }];
     };
+}, {
+    readonly resource: "file.uploads";
+    readonly method: "createSigned";
+    readonly summary: "Create a one-time upload URL";
+    readonly description: "Upload a local file of up to 2 GiB from a coding agent without sending bytes through the model. Provide basename, exact byte count and MIME type. Up to 104857600 bytes, PUT the file to url with curl -T photo.png -H 'Content-Type: image/png' '<url>'; success returns 201 with the file object, and reuse returns 410 CAPABILITY_USED. Above that threshold, split the file into part_size chunks (default 64000000 bytes), PUT each chunk to its numbered parts[].url in any order, then POST complete_url without a body. Part PUTs return 200; completion returns 201 with the file object, including its state, or 400 if a part is missing. A processing file can be polled with files.retrieve until active. Identical part bytes may be retried; changed bytes at the same number return 400. Completion reuse returns 410 CAPABILITY_USED. Each PUT requires the exact signed Content-Length; single-PUT Content-Type must match content_type or be omitted. Expired, revoked, invalid, wrong-action or cross-organization URLs return 404. URL lifetime defaults to 900 seconds for single PUT or 3600 for multipart, at most 604800; all multipart URLs share an expiry. Multipart creation reserves storage quota. Issuance requires the same unscoped credential as direct file creation. Each issuance creates a new upload and is not idempotent. Example body: {\"filename\":\"photo.png\",\"bytes\":2048,\"content_type\":\"image/png\"}.";
+    readonly http: "POST";
+    readonly path: "/file/v1/uploads/signed";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "filename";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Stored basename, 1–255 UTF-8 bytes without control characters or path separators.";
+        }, {
+            readonly name: "bytes";
+            readonly type: "integer";
+            readonly required: true;
+            readonly description: "Exact local file size in bytes, from 1 through 2147483648 (2 GiB). Up to 104857600 bytes returns one PUT URL; larger files return numbered part URLs and a completion URL. Every PUT requires its exact signed Content-Length.";
+        }, {
+            readonly name: "content_type";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Declared MIME type, such as image/png. In single-PUT mode, send exactly this Content-Type or omit it. Stored file metadata is detected from the bytes in both modes.";
+        }, {
+            readonly name: "purpose";
+            readonly type: "string";
+            readonly enum: readonly ["user_data", "vision"];
+            readonly required: false;
+            readonly description: "user_data stores ordinary files and conversation images; vision accepts PNG, JPEG, GIF or WebP images only. Omitted means user_data.";
+        }, {
+            readonly name: "expires_in";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Lifetime in seconds, from 1 through 604800: defaults to 900 for single PUT or 3600 for multipart. All part URLs and the completion URL share one expiry. This does not set the resulting file's lifetime.";
+        }, {
+            readonly name: "part_size";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Fixed multipart chunk size in bytes, from 5242880 through 64000000; defaults to 64000000. Used only above 104857600 total bytes. The final part contains the remaining bytes; single-PUT mode keeps its existing response.";
+        }];
+    };
 }, {
     readonly resource: "file.uploads";
     readonly method: "cancel";
@@ -6970,7 +8148,7 @@ export declare const operations: readonly [{
     readonly resource: "knowledge.vectorStores";
     readonly method: "create";
     readonly summary: "Create knowledge base";
-    readonly description: "Create a knowledge base, optionally starting ingestion of uploaded file_ids in the same call; no separate attachment or batch is needed for those files. Use the returned id with vectorStores.files.retrieve to poll each attachment until completed, failed or cancelled; store status=completed alone does not mean every file succeeded. Unlike OpenAI vector stores, each file is limited to 100000000 bytes and each account to 100 active/nondeleted stores. Minimal body: {\"name\":\"Refund policies\"}.";
+    readonly description: "Create a knowledge base, optionally starting ingestion of uploaded file_ids in the same call; no separate attachment or batch is needed for those files. Use the returned id with vectorStores.files.retrieve to poll each attachment until completed, failed or cancelled; store status=completed alone does not mean every file succeeded. Each file accepts up to 52428800 bytes and 5000000 estimated tokens; each account holds up to 100 active/nondeleted stores. Minimal body: {\"name\":\"Refund policies\"}.";
     readonly http: "POST";
     readonly path: "/knowledge/v1/vector_stores";
     readonly streaming: "no";
@@ -7014,7 +8192,7 @@ export declare const operations: readonly [{
             readonly name: "models";
             readonly type: "object";
             readonly required: false;
-            readonly description: "Model roles to set. The model must exist in the model catalog and serve the role (embedding → openai.embeddings, rerank → cohere.rerank, query_rewrite → openai.chat.completions). The embedding model must output 1024-dimension vectors. Omitted roles stay unchanged; null restores all defaults. Unknown roles or empty IDs return 400 INVALID_PARAMS. The OpenAI-compatible API rejects this field with 400.";
+            readonly description: "Model roles to set. The model must exist in the model catalog and serve the role (embedding → openai.embeddings, rerank → cohere.rerank, query_rewrite → openai.chat.completions, ocr → mistral.ocr or pdf_input capability, vision → vision capability). The embedding model must output 1024-dimension vectors. Omitted roles stay unchanged; null restores all defaults. Unknown roles or empty IDs return 400 INVALID_PARAMS. The OpenAI-compatible API rejects this field with 400.";
         }];
     };
 }, {
@@ -7097,7 +8275,7 @@ export declare const operations: readonly [{
             readonly name: "models";
             readonly type: "object";
             readonly required: false;
-            readonly description: "Model roles to set. The model must exist in the model catalog and serve the role (embedding → openai.embeddings, rerank → cohere.rerank, query_rewrite → openai.chat.completions). The embedding model must output 1024-dimension vectors. Omitted roles stay unchanged; null restores all defaults. Unknown roles or empty IDs return 400 INVALID_PARAMS. The OpenAI-compatible API rejects this field with 400.";
+            readonly description: "Model roles to set. The model must exist in the model catalog and serve the role (embedding → openai.embeddings, rerank → cohere.rerank, query_rewrite → openai.chat.completions, ocr → mistral.ocr or pdf_input capability, vision → vision capability). The embedding model must output 1024-dimension vectors. Omitted roles stay unchanged; null restores all defaults. Unknown roles or empty IDs return 400 INVALID_PARAMS. The OpenAI-compatible API rejects this field with 400.";
         }];
     };
 }, {
@@ -7274,7 +8452,7 @@ export declare const operations: readonly [{
     readonly resource: "knowledge.vectorStores.files";
     readonly method: "create";
     readonly summary: "Add file";
-    readonly description: "Attach an uploaded File for asynchronous ingestion, then poll this attachment until status is completed, failed or cancelled before searching. Unlike OpenAI vector stores, the file limit is 100000000 bytes; chunk sizes use estimated tokens rather than a model tokenizer. Text, Markdown, CSV, JSON, HTML, PDF, DOCX, PPTX, XLSX and PNG/JPEG/GIF/WebP images can be extracted; audio and video uploads are not knowledge documents. Images may yield generated descriptions rather than verbatim OCR. auto chunking resolves to static 800/400; explicit sizes are 100–4096 with overlap at most half the size. Each store holds at most 10000 attached files. Reattaching the same file returns its existing record without applying new attributes or chunking; inspect last_error after failure.";
+    readonly description: "Attach an uploaded File for asynchronous ingestion, then poll this attachment until status is completed, failed or cancelled before searching. Each file accepts up to 52428800 bytes and 5000000 estimated tokens; chunk sizes use estimated tokens rather than a model tokenizer. Text, Markdown, CSV, JSON, HTML, PDF, DOCX, PPTX, XLSX and PNG/JPEG/GIF/WebP images can be extracted; audio and video uploads are not knowledge documents. Images may yield generated descriptions rather than verbatim OCR. auto chunking resolves to static 800/400; explicit sizes are 100–4096 with overlap at most half the size. Each store holds at most 10000 attached files. Reattaching the same file returns its existing record without applying new attributes or chunking; inspect last_error after failure.";
     readonly http: "POST";
     readonly path: "/knowledge/v1/vector_stores/{vector_store_id}/files";
     readonly streaming: "no";
@@ -7790,7 +8968,7 @@ export declare const operations: readonly [{
             readonly name: "overwrite";
             readonly type: "boolean";
             readonly required: false;
-            readonly description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. False returns the existing resource without replacing it; defaults to true.";
+            readonly description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. Only the latest version is deliverable; old version URLs return 404. Create a new public_id to retain old deliveries. False returns the existing resource without replacing it; defaults to true.";
         }, {
             readonly name: "tags";
             readonly type: "object";
@@ -7812,6 +8990,12 @@ export declare const operations: readonly [{
             readonly enum: readonly ["image", "video", "raw", "auto"];
             readonly required: false;
             readonly description: "Upload category: image for images, video for video or audio, raw for unprocessed files, or auto to detect the category. Defaults to auto.";
+        }, {
+            readonly name: "type";
+            readonly type: "string";
+            readonly enum: readonly ["upload", "authenticated"];
+            readonly required: false;
+            readonly description: "Asset delivery mode: upload is public; authenticated requires a signed URL or delivery token for originals and derivatives. private is unsupported.";
         }];
     };
 }, {
@@ -7835,6 +9019,7 @@ export declare const operations: readonly [{
             readonly name: "file_id";
             readonly type: "string";
             readonly required: true;
+            readonly description: "File ID to copy into this library instead of file bytes. This independent copy defaults to public delivery; set type=authenticated for private delivery. Deleting the source File does not delete this asset.";
         }, {
             readonly name: "public_id";
             readonly type: "string";
@@ -7879,7 +9064,7 @@ export declare const operations: readonly [{
             readonly name: "overwrite";
             readonly type: "boolean";
             readonly required: false;
-            readonly description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. False returns the existing resource without replacing it; defaults to true.";
+            readonly description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. Only the latest version is deliverable; old version URLs return 404. Create a new public_id to retain old deliveries. False returns the existing resource without replacing it; defaults to true.";
         }, {
             readonly name: "tags";
             readonly type: "object";
@@ -7901,6 +9086,12 @@ export declare const operations: readonly [{
             readonly enum: readonly ["image", "video", "raw", "auto"];
             readonly required: false;
             readonly description: "Upload category: image for images, video for video or audio, raw for unprocessed files, or auto to detect the category. Defaults to auto.";
+        }, {
+            readonly name: "type";
+            readonly type: "string";
+            readonly enum: readonly ["upload", "authenticated"];
+            readonly required: false;
+            readonly description: "Asset delivery mode: upload is public; authenticated requires a signed URL or delivery token for originals and derivatives. private is unsupported.";
         }];
     };
 }, {
@@ -8122,6 +9313,35 @@ export declare const operations: readonly [{
         readonly description: "Batch identifier returned by createBatch or batchAssets; resolved within this library.";
     }];
     readonly query: readonly [];
+}, {
+    readonly resource: "media.libraries.deliveryTokens";
+    readonly method: "create";
+    readonly summary: "Create delivery token";
+    readonly description: "Issue a time-limited bearer token for originals and transformed authenticated assets in an active library. Use library_id from library creation or listing; read access is sufficient. Append token as the __cld_token__ query parameter on a matching delivery URL. The default ACL covers this library and the default lifetime is 3600 seconds; narrow acl and expires_in before sharing. Anyone holding the token can read matching paths until expires_at.";
+    readonly http: "POST";
+    readonly path: "/media/v1/libraries/{library_id}/delivery_tokens";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "library_id";
+        readonly sdkName: "library_id";
+        readonly description: "Library ID returned by creation.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "acl";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Delivery path glob restricted to the library path prefix (a slash, library_id, then a slash). Defaults to that prefix followed by *; * matches any path text. Tildes and control characters are rejected.";
+        }, {
+            readonly name: "expires_in";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Token lifetime in seconds, from 1 to 604800 inclusive; defaults to 3600.";
+        }];
+    };
 }, {
     readonly resource: "media.libraries.events";
     readonly method: "list";
@@ -8288,7 +9508,7 @@ export declare const operations: readonly [{
             readonly name: "expression";
             readonly type: "string";
             readonly required: false;
-            readonly description: "Asset filter expression supporting field comparisons, AND, OR, NOT, parentheses and suffix wildcards. An empty expression matches all assets.";
+            readonly description: "Asset filter expression supporting field comparisons, AND, OR, NOT, parentheses and suffix wildcards. An empty expression matches all assets. For business metadata use context.sku=KETTLE-RED AND context.revision=2; request with_field: [\"context\"] to include context.";
         }, {
             readonly name: "sort_by";
             readonly type: "array";
@@ -8400,6 +9620,54 @@ export declare const operations: readonly [{
             readonly description: "Expression filter restricting eligible result assets.";
         }];
     };
+}, {
+    readonly resource: "meta.docs";
+    readonly method: "search";
+    readonly summary: "Search platform documentation";
+    readonly description: "Find guides and references by keyword before reading them with praxis.meta.docs.retrieve. Public; no API key required. Matches documentation titles, headings and page text without case sensitivity; all query words must occur. q is required; limit defaults to 20 and accepts 1–50. lang defaults to zh or use en for English. Returns paths, page titles, canonical URLs and short matching snippets; no matches returns an empty array.";
+    readonly http: "GET";
+    readonly path: "/meta/v1/docs/search";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [{
+        readonly name: "q";
+        readonly type: "string";
+        readonly required: true;
+        readonly description: "Keywords describing the syntax or guide needed, for example export or workflow.";
+    }, {
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum number of matching pages returned; integer 1–50, default 20.";
+    }, {
+        readonly name: "lang";
+        readonly type: "string";
+        readonly enum: readonly ["zh", "en"];
+        readonly required: false;
+        readonly description: "Documentation language: zh for Chinese (default), en for English.";
+    }];
+}, {
+    readonly resource: "meta.docs";
+    readonly method: "retrieve";
+    readonly summary: "Read documentation Markdown";
+    readonly description: "Read a platform guide or reference before implementing an unfamiliar capability. Public; no API key required. Take path from praxis.meta.docs.search, or use developers/automation/guides/write-workflow. Append #heading-id to path to read only that section, including its subsections. Encode the hash as %23 over HTTP; SDK callers pass it in the path string. lang defaults to zh; en selects the English page. Unknown pages or anchors return DOC_NOT_FOUND; search again for a valid path.";
+    readonly http: "GET";
+    readonly path: "/meta/v1/docs/{path}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "path";
+        readonly sdkName: "path";
+        readonly description: "Slash-separated documentation path from docs.search; optionally append #heading-id to select a section.";
+    }];
+    readonly query: readonly [{
+        readonly name: "lang";
+        readonly type: "string";
+        readonly enum: readonly ["zh", "en"];
+        readonly required: false;
+        readonly description: "Documentation language: zh for Chinese (default), en for English.";
+    }];
 }, {
     readonly resource: "meta.health";
     readonly method: "retrieve";
@@ -9479,7 +10747,7 @@ export declare const operations: readonly [{
         readonly name: "supported_api";
         readonly type: "array";
         readonly itemType: "string";
-        readonly enum: readonly ["anthropic.messages", "cohere.rerank", "google.generateContent", "mistral.ocr", "openai.audio.speech", "openai.audio.transcriptions", "openai.chat.completions", "openai.embeddings", "openai.images.edits", "openai.images.generations", "openai.responses", "openai.videos"];
+        readonly enum: readonly ["anthropic.messages", "cohere.rerank", "google.generateContent", "mistral.ocr", "openai.audio.speech", "openai.audio.transcriptions", "openai.chat.completions", "openai.embeddings", "openai.images.edits", "openai.images.generations", "openai.responses", "openai.videos", "typesafe.systemone"];
         readonly required: false;
         readonly description: "Match any comma-separated declared protocol ID; omitted or empty includes all models. Combined with type and output_modalities using AND. Invalid IDs return 400 with all legal values.";
     }, {
@@ -9937,6 +11205,41 @@ export declare const operations: readonly [{
         readonly description: "Id of the stored response, the `id` returned by createResponse (it looks like resp_...). An unknown id, a response created with store false, an expired response and another tenant's response all answer 404.";
     }];
     readonly query: readonly [];
+}, {
+    readonly resource: "model.systemone";
+    readonly method: "create";
+    readonly summary: "Ask structured decision questions";
+    readonly description: "Ask typed questions about a state and get calibrated probabilities instead of generated text. Same request and response as TypeSafe System One. Use model ids from model.models.list declaring typesafe.systemone. Send one or more noul, choice or score questions; answers use the same question ids. Input tokens are charged at the catalog input price; output tokens are free. usage.cost and X-Praxis-Cost-Usd expose the same customer charge in USD. box questions and assets are unsupported and return 400: images are not supported. Unknown top-level fields pass unchanged to the native upstream.";
+    readonly http: "POST";
+    readonly path: "/model/v1/systemone";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "model";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Published model id from model.models.list with supported_apis containing typesafe.systemone; returned unchanged in the response.";
+        }, {
+            readonly name: "state";
+            readonly type: "object";
+            readonly required: true;
+            readonly description: "Shared content evaluated by every question, supplied as text, a JSON object or an array.";
+        }, {
+            readonly name: "questions";
+            readonly type: "object";
+            readonly required: true;
+            readonly description: "Non-empty map of caller-chosen question ids to typed questions; answers preserve these ids. noul evaluates yes/no, choice selects a named option, score rates ordered levels. box is unsupported.";
+        }, {
+            readonly name: "assets";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "Unsupported image assets. Supplying this field, including null or an empty collection, returns 400: images are not supported.";
+        }];
+    };
 }, {
     readonly resource: "model.videos";
     readonly method: "list";
@@ -10982,7 +12285,7 @@ export declare const operations: readonly [{
     readonly resource: "sandbox.sandboxes.commands";
     readonly method: "run";
     readonly summary: "Run a command in the sandbox";
-    readonly description: "Execute a shell command and wait for stdout, stderr and exitCode. Supply cmd, optional cwd and envs, and timeoutMs (1–60000 milliseconds, default 60000). Unlike E2B, this endpoint is synchronous only: no background mode, callbacks or unlimited timeout; output is bounded to 1 MiB including stream framing. Nonzero exit codes return 200 with the result. A timeout returns COMMAND_TIMEOUT (504); transport timeout does not confirm process termination, so do not blindly retry commands with side effects. Example body: {\"cmd\":\"echo hi\"}.";
+    readonly description: "Execute a shell command and wait for stdout, stderr and exitCode. Supply cmd, optional cwd and envs, and timeoutMs (1–3600000 milliseconds, default 600000, that is 10 minutes; E2B defaults to 60000). Unlike E2B, this endpoint is synchronous only: no background mode, callbacks or unlimited timeout (timeoutMs 0); output is bounded to 1 MiB including stream framing. Nonzero exit codes return 200 with the result. A timeout returns COMMAND_TIMEOUT (504); transport timeout does not confirm process termination, so do not blindly retry commands with side effects. Example body: {\"cmd\":\"echo hi\"}.";
     readonly http: "POST";
     readonly path: "/sandbox/v1/sandboxes/{sandbox_id}/commands";
     readonly streaming: "no";
@@ -11000,6 +12303,11 @@ export declare const operations: readonly [{
             readonly type: "string";
             readonly required: true;
             readonly description: "Shell command to execute, for example echo hi.";
+        }, {
+            readonly name: "background";
+            readonly type: "boolean";
+            readonly required: false;
+            readonly description: "When true, return 202 with the pid as soon as the process starts; it keeps running after the request ends. Read its status and output with GET /sandbox/v1/sandboxes/{sandbox_id}/commands/{pid}, stop it with DELETE. Same idea as E2B background commands.";
         }, {
             readonly name: "cwd";
             readonly type: "string";
@@ -11014,7 +12322,7 @@ export declare const operations: readonly [{
             readonly name: "timeoutMs";
             readonly type: "integer";
             readonly required: false;
-            readonly description: "Execution timeout in milliseconds, from 1 to 60000; defaults to 60000.";
+            readonly description: "Execution timeout in milliseconds, from 1 to 3600000 (1 hour); defaults to 600000 (10 minutes). In background mode this limits process runtime; expiry records exit code 124.";
         }];
     };
 }, {
@@ -11176,7 +12484,7 @@ export declare const operations: readonly [{
     readonly resource: "sandbox.templates";
     readonly method: "list";
     readonly summary: "List templates (v2)";
-    readonly description: "List the templates you can create sandboxes from. Use it to pick the template id or alias for createSandbox. `base` is the default template that createSandbox uses when templateID is omitted. limit is 1 to 100 (default 100); send the cursor from the response back as nextToken to continue.";
+    readonly description: "List official templates and all your custom templates, including waiting, building, ready and error builds. Custom templates appear first; each custom row describes its latest build, not necessarily the current ready build. Use templateID for build management and a ready template name when creating a sandbox. Own-face official distinguishes public catalog entries; sourceKind is omitted until a source is submitted and on official templates. Other organizations' templates are invisible.";
     readonly http: "GET";
     readonly path: "/sandbox/v1/templates";
     readonly streaming: "no";
@@ -11186,8 +12494,171 @@ export declare const operations: readonly [{
         readonly name: "teamID";
         readonly type: "string";
         readonly required: false;
-        readonly description: "Id of the team whose templates to list. Omit it to list the templates of your own team; a team you do not belong to answers 403.";
+        readonly description: "Upstream team selector; Praxis always lists the authenticated organization's templates.";
+    }, {
+        readonly name: "nextToken";
+        readonly type: "string";
+        readonly required: false;
+        readonly description: "Cursor to start the list from";
     }, {
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum number of items to return per page";
+    }];
+}, {
+    readonly resource: "sandbox.templates";
+    readonly method: "create";
+    readonly summary: "Create template (v3)";
+    readonly description: "Reserve a waiting build before submitting its source. Reusing a name in your organization allocates a new build on the same template. Returns templateID and buildID; start it with templates.builds.update, then poll templates.builds.status.list. A name:tag suffix and tags are assigned after successful publication. Example: {\"name\":\"my-template\",\"cpuCount\":2,\"memoryMB\":2048}. The own face also accepts diskGb, a positive integer defaulting to 10 GiB.";
+    readonly http: "POST";
+    readonly path: "/sandbox/v1/templates";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Name of the template. Can include a tag with colon separator (e.g. \"my-template\" or \"my-template:v1\"). If tag is included, it will be treated as if the tag was provided in the tags array.";
+        }, {
+            readonly name: "tags";
+            readonly type: "array";
+            readonly itemType: "string";
+            readonly required: false;
+            readonly description: "Tags to assign to the template build";
+        }, {
+            readonly name: "alias";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Alias of the template. Deprecated, use name instead.";
+        }, {
+            readonly name: "teamID";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Identifier of the team";
+        }, {
+            readonly name: "cpuCount";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Requested virtual CPU count; a positive integer, default 2 for template builds.";
+        }, {
+            readonly name: "memoryMB";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Requested build memory in MiB; a positive integer, default 1024.";
+        }, {
+            readonly name: "minFreeDiskMb";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Upstream minimum free disk request in MiB; use the native diskGb field to set the build disk size.";
+        }, {
+            readonly name: "diskGb";
+            readonly type: "integer";
+            readonly required: false;
+            readonly description: "Build disk size in GiB, a positive safe integer. Defaults to 10; available only on the own face.";
+        }];
+    };
+}, {
+    readonly resource: "sandbox.templates.aliases";
+    readonly method: "retrieve";
+    readonly summary: "Check template alias";
+    readonly description: "Resolve a name within your organization to its templateID before reading or managing builds. Use the bare template name, without a :tag suffix. Unknown and other-organization names return 404. The response public field is false for your private templates.";
+    readonly http: "GET";
+    readonly path: "/sandbox/v1/templates/aliases/{alias}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "alias";
+        readonly sdkName: "alias";
+        readonly description: "Bare template name belonging to your organization, without a tag or provider namespace.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "sandbox.templates.tags";
+    readonly method: "delete";
+    readonly summary: "Delete template tags";
+    readonly description: "Remove the specified tag labels from your template by name, for example {\"name\":\"my-template\",\"tags\":[\"stable\"]}. Builds remain available. Removing default means untagged sandbox creation no longer resolves this template. Unknown or other-organization names return 404. b<number> names are reserved read-only build aliases and cannot be assigned or deleted as tags.";
+    readonly http: "DELETE";
+    readonly path: "/sandbox/v1/templates/tags";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "name";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Name of the template";
+        }, {
+            readonly name: "tags";
+            readonly type: "array";
+            readonly itemType: "string";
+            readonly required: true;
+            readonly description: "Tags to delete";
+        }];
+    };
+}, {
+    readonly resource: "sandbox.templates.tags";
+    readonly method: "create";
+    readonly summary: "Assign template tags";
+    readonly description: "Assign tags to the ready build selected by target in name:tag format, for example {\"target\":\"my-template:default\",\"tags\":[\"stable\"]}. Names belong to your organization. Tags move an existing label to this build without rebuilding. Obtain available names from templates.list and tags from templates.tags.list. b<number> names are reserved read-only build aliases and cannot be assigned or deleted as tags. target also accepts name:b<number> to select a ready build by number, for example my-template:b1.";
+    readonly http: "POST";
+    readonly path: "/sandbox/v1/templates/tags";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "target";
+            readonly type: "string";
+            readonly required: true;
+            readonly description: "Target template in \"name:tag\" format";
+        }, {
+            readonly name: "tags";
+            readonly type: "array";
+            readonly itemType: "string";
+            readonly required: true;
+            readonly description: "Tags to assign to the template";
+        }];
+    };
+}, {
+    readonly resource: "sandbox.templates";
+    readonly method: "delete";
+    readonly summary: "Delete template";
+    readonly description: "Permanently remove your template, its builds and tag assignments using templateID from templates.create. Active instances prevent deletion with 409; terminate them first. Unknown or other-organization IDs return 404. Snapshot IDs use snapshots.delete instead.";
+    readonly http: "DELETE";
+    readonly path: "/sandbox/v1/templates/{templateID}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "templateID";
+        readonly sdkName: "templateID";
+        readonly description: "Template identifier from templates.create or templates.list. Use your organization's templateID, not a provider handle.";
+    }];
+    readonly query: readonly [];
+}, {
+    readonly resource: "sandbox.templates";
+    readonly method: "retrieve";
+    readonly summary: "List template builds";
+    readonly description: "Inspect your template and its newest builds using templateID from templates.create. Build states are waiting, building, ready or error. Use limit and the returned x-next-token header to page builds. Unknown or other-organization templates return 404.";
+    readonly http: "GET";
+    readonly path: "/sandbox/v1/templates/{templateID}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "templateID";
+        readonly sdkName: "templateID";
+        readonly description: "Template identifier from templates.create or templates.list. Use your organization's templateID, not a provider handle.";
+    }];
+    readonly query: readonly [{
         readonly name: "nextToken";
         readonly type: "string";
         readonly required: false;
@@ -11198,6 +12669,120 @@ export declare const operations: readonly [{
         readonly required: false;
         readonly description: "Maximum number of items to return per page";
     }];
+}, {
+    readonly resource: "sandbox.templates.builds";
+    readonly method: "update";
+    readonly summary: "Start template build (v2)";
+    readonly description: "Submit source for a waiting build returned by templates.create; returns 202 after queueing, not after successful publication. Unlike E2B, COPY is rejected (use RUN curl or git clone), fromTemplate accepts official catalog names only, and plaintext registry credentials are rejected. The own face also accepts dockerfile, mutually exclusive with fromImage/fromTemplate/steps, and fromImageRegistry vault references for nonofficial images. Poll templates.builds.status.list until ready or error. Example: {\"fromImage\":\"node:22\",\"steps\":[{\"type\":\"RUN\",\"args\":[\"echo hello\"]}]}.";
+    readonly http: "POST";
+    readonly path: "/sandbox/v1/templates/{templateID}/builds/{buildID}";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "templateID";
+        readonly sdkName: "templateID";
+        readonly description: "Template identifier from templates.create or templates.list. Use your organization's templateID, not a provider handle.";
+    }, {
+        readonly name: "buildID";
+        readonly sdkName: "buildID";
+        readonly description: "Build identifier returned by templates.create. It must belong to the selected template in your organization.";
+    }];
+    readonly query: readonly [];
+    readonly body: {
+        readonly required: true;
+        readonly fields: readonly [{
+            readonly name: "fromImage";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Image to use as a base for the template build";
+        }, {
+            readonly name: "fromTemplate";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Template to use as a base for the template build";
+        }, {
+            readonly name: "fromImageRegistry";
+            readonly type: "object";
+            readonly required: false;
+            readonly description: "Registry authentication. Unlike E2B, only the vault reference variant is accepted; plaintext aws, gcp and registry variants return 400. Cannot be used with official templates.";
+        }, {
+            readonly name: "force";
+            readonly type: "boolean";
+            readonly required: false;
+            readonly description: "Whether the whole build should be forced to run regardless of the cache";
+        }, {
+            readonly name: "steps";
+            readonly type: "array";
+            readonly itemType: "object";
+            readonly required: false;
+            readonly description: "List of steps to execute in the template build";
+        }, {
+            readonly name: "startCmd";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Start command to execute in the template after the build";
+        }, {
+            readonly name: "readyCmd";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Ready check command to execute in the template after the build";
+        }, {
+            readonly name: "dockerfile";
+            readonly type: "string";
+            readonly required: false;
+            readonly description: "Dockerfile text, at most 64 KiB UTF-8. Mutually exclusive with fromImage, fromTemplate and steps. COPY/ADD are rejected; fetch remote content using RUN. Registry credentials require a nonofficial image in the first FROM.";
+        }];
+    };
+}, {
+    readonly resource: "sandbox.templates.builds.status";
+    readonly method: "list";
+    readonly summary: "Template build status";
+    readonly description: "Poll a build using templateID and buildID from templates.create. waiting means source has not been submitted; building includes queued work; ready permits sandbox creation; error is terminal, with reason when available. logsOffset counts previously read log entries, starting at zero; add logEntries.length after each response. limit is 0–100, default 100. level selects one log level; offsets then count entries at that level. Drain logs until an empty page, including after a terminal status.";
+    readonly http: "GET";
+    readonly path: "/sandbox/v1/templates/{templateID}/builds/{buildID}/status";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "templateID";
+        readonly sdkName: "templateID";
+        readonly description: "Template identifier from templates.create or templates.list. Use your organization's templateID, not a provider handle.";
+    }, {
+        readonly name: "buildID";
+        readonly sdkName: "buildID";
+        readonly description: "Build identifier returned by templates.create. It must belong to the selected template in your organization.";
+    }];
+    readonly query: readonly [{
+        readonly name: "logsOffset";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Index of the starting build log that should be returned with the template";
+    }, {
+        readonly name: "limit";
+        readonly type: "integer";
+        readonly required: false;
+        readonly description: "Maximum number of logs that should be returned";
+    }, {
+        readonly name: "level";
+        readonly type: "string";
+        readonly enum: readonly ["debug", "info", "warn", "error"];
+        readonly required: false;
+        readonly description: "Select one exact log severity: debug for diagnostics, info for progress, warn for warnings, error for failures. Offsets count matching entries.";
+    }];
+}, {
+    readonly resource: "sandbox.templates.tags";
+    readonly method: "list";
+    readonly summary: "List template tags";
+    readonly description: "Read the tag-to-build assignments for your template using templateID from templates.create. Only ready builds acquire tags. Use a returned tag with the template name as name:tag when creating a sandbox or assigning additional tags. Foreign IDs return 404.";
+    readonly http: "GET";
+    readonly path: "/sandbox/v1/templates/{templateID}/tags";
+    readonly streaming: "no";
+    readonly pagination: false;
+    readonly pathParams: readonly [{
+        readonly name: "templateID";
+        readonly sdkName: "templateID";
+        readonly description: "Template identifier from templates.create or templates.list. Use your organization's templateID, not a provider handle.";
+    }];
+    readonly query: readonly [];
 }, {
     readonly resource: "sandbox.volumes";
     readonly method: "list";
@@ -11992,7 +13577,7 @@ export declare const operations: readonly [{
     readonly resource: "ticket.milestones";
     readonly method: "create";
     readonly summary: "Create or add milestones";
-    readonly description: "Create or add milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.";
+    readonly description: "Create or add milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.";
     readonly http: "POST";
     readonly path: "/ticket/v1/milestones";
     readonly streaming: "no";
@@ -12033,7 +13618,7 @@ export declare const operations: readonly [{
     readonly resource: "ticket.milestones";
     readonly method: "delete";
     readonly summary: "Remove milestones";
-    readonly description: "Remove milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.";
+    readonly description: "Remove milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.";
     readonly http: "DELETE";
     readonly path: "/ticket/v1/milestones/{number}";
     readonly streaming: "no";
@@ -12075,7 +13660,7 @@ export declare const operations: readonly [{
     readonly resource: "ticket.milestones";
     readonly method: "update";
     readonly summary: "Update milestones";
-    readonly description: "Update milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.";
+    readonly description: "Update milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.";
     readonly http: "PATCH";
     readonly path: "/ticket/v1/milestones/{number}";
     readonly streaming: "no";
@@ -13220,7 +14805,7 @@ export declare const operations: readonly [{
     readonly resource: "vault.vaults.secrets";
     readonly method: "create";
     readonly summary: "Create secret";
-    readonly description: "Store a manually supplied token in an active vault for use on requests to its allowed_hosts. Unlike Anthropic credentials, this native operation takes name, value and allowed_hosts directly and creates only static secrets; use praxis.vault.authorizations.create for OAuth. Its name must be unused by any non-archived secret in that vault; the response contains metadata but never the supplied value. Application praxis_vault_ref bindings declare vault_id and secret (the secret name), but currently return 501; do not copy the value into a plain-text binding or metadata as a substitute.";
+    readonly description: "Store a manually supplied token in an active vault. Omit allowed_hosts for name-based resolution only; host-based redemption never matches an empty host list. Unlike Anthropic credentials, this native operation takes name and value directly, with optional allowed_hosts and creates only static secrets; use praxis.vault.authorizations.create for OAuth. Its name must be unused by any non-archived secret in that vault; the response contains metadata but never the supplied value. Application praxis_vault_ref bindings declare vault_id and secret (the secret name), but currently return 501; do not copy the value into a plain-text binding or metadata as a substitute.";
     readonly http: "POST";
     readonly path: "/vault/v1/vaults/{vault_id}/secrets";
     readonly streaming: "no";
@@ -13247,8 +14832,8 @@ export declare const operations: readonly [{
             readonly name: "allowed_hosts";
             readonly type: "array";
             readonly itemType: "string";
-            readonly required: true;
-            readonly description: "Allowed destinations for the secret. Unlike Anthropic's unrestricted networking option, an explicit allowlist is required. Supply 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed.";
+            readonly required: false;
+            readonly description: "Allowed destinations for the secret. Omitting allowed_hosts on creation stores an empty list for name-based resolution only: host-based redemption never matches. When supplied, list 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed.";
         }, {
             readonly name: "description";
             readonly type: "string";
@@ -13264,7 +14849,7 @@ export declare const operations: readonly [{
             readonly type: "string";
             readonly enum: readonly ["github", "openai", "anthropic", "stripe"];
             readonly required: false;
-            readonly description: "Static template ID from List templates. Records metadata.template; name, value and allowed_hosts must still be supplied explicitly.";
+            readonly description: "Static template ID from List templates. Records metadata.template; name and value must still be supplied explicitly; allowed_hosts is optional.";
         }, {
             readonly name: "kind";
             readonly type: "string";
@@ -13342,7 +14927,7 @@ export declare const operations: readonly [{
             readonly type: "array";
             readonly itemType: "string";
             readonly required: false;
-            readonly description: "Allowed destinations for the secret. Unlike Anthropic's unrestricted networking option, an explicit allowlist is required. Supply 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed.";
+            readonly description: "Allowed destinations for the secret. Omitting allowed_hosts on creation stores an empty list for name-based resolution only: host-based redemption never matches. When supplied, list 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed.";
         }, {
             readonly name: "description";
             readonly type: "string";
@@ -13426,7 +15011,7 @@ export declare const operations: readonly [{
     readonly resource: "vault.vaults.secrets";
     readonly method: "import";
     readonly summary: "Import secrets";
-    readonly description: "Import lines or dotenv text into an active vault, reporting success or failure for each entry. Existing names have their values replaced; their hosts change only when that line supplies allowed_hosts. Shared hosts apply only to newly created secrets.";
+    readonly description: "Import lines or dotenv text into an active vault, reporting success or failure for each entry. Existing names have their values replaced; their hosts change only when that line supplies allowed_hosts. Shared hosts apply only to newly created secrets; if neither shared nor per-line hosts are supplied, new secrets use an empty host list for name-based resolution only.";
     readonly http: "POST";
     readonly path: "/vault/v1/vaults/{vault_id}/secrets:import";
     readonly streaming: "no";