@deepraxis/sdk 0.1.1-dev.d25d171 → 0.1.1-dev.ed5af3e

package/dist/operations.generated.js

@@ -106,7 +106,7 @@ export const operations = [
                     "name": "multiagent",
                     "type": "object",
                     "required": false,
-                    "description": "A coordinator topology: the session's primary thread orchestrates\nwork by spawning session threads, each running an agent drawn from the `agents`\nroster."
+                    "description": "Coordinator roster. A bare string agent id is equivalent to {type: \"agent\", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: \"self\"} refers to this agent. Specify a concrete version to pin it explicitly."
                 },
                 {
                     "name": "skills",
@@ -133,7 +133,7 @@ export const operations = [
                     "type": "array",
                     "itemType": "object",
                     "required": false,
-                    "description": "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings."
+                    "description": "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings. Saving checks added or changed database, vector_store, media_library and file bindings in the organization: unknown or deleted ids return 400. If an owner is unavailable or takes more than 3 seconds, saving succeeds with verified=false for the affected bindings. Unchanged bindings keep their previous verification result and are not rechecked. workflow and script ids are not verified at save time."
                 },
                 {
                     "name": "kind",
@@ -157,6 +157,12 @@ export const operations = [
                     "required": false,
                     "description": "Praxis extension: default subagent model ID, pinned in the agent revision. Call model overrides this; otherwise it overrides the roster member model or the parent model for built-ins. Null clears the default. /agent/v1 only."
                 },
+                {
+                    "name": "image_model",
+                    "type": "string",
+                    "required": false,
+                    "description": "Model used by the imagine image tool; defaults to gpt-image-2 when unset. Only models that can generate images are accepted. Omit to preserve; null clears the configured model. /agent/v1 only."
+                },
                 {
                     "name": "subagents",
                     "type": "array",
@@ -220,7 +226,7 @@ export const operations = [
         "resource": "agent.agents",
         "method": "retrieve",
         "summary": "Get agent",
-        "description": "Read one agent by id. The top level is the latest saved version, the editable head whose version you send back for optimistic concurrency; after a save with apply false it differs from active_version, and new sessions use active_version, which you read with version=active. With version, read a specific saved version. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so it can be sent back unchanged to agents.update. Use agents.versions.list to enumerate versions.",
+        "description": "Read the agent configuration currently effective for new sessions. By default, version equals active_version and latest_version identifies the newest saved version, including an unapplied save. Use latest_version for optimistic concurrency when updating. Pass version as a positive integer to read that saved version; version=active is equivalent to omission. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so tools can be sent back unchanged to agents.update. Use agents.versions.list to enumerate saved versions.",
         "http": "GET",
         "path": "/agent/v1/agents/{agent_id}",
         "streaming": "no",
@@ -237,7 +243,7 @@ export const operations = [
                 "name": "version",
                 "type": "number",
                 "required": false,
-                "description": "Agent version to read; omit for the latest saved version. An integer of at least 1 (versions are listed by agents.versions.list), or the string active for the version new sessions use."
+                "description": "Agent version to read. Omit, or send active, for the currently effective version used by new sessions. Send an integer of at least 1 from agents.versions.list to read that saved version. The default response also includes latest_version, the newest saved version number."
             }
         ]
     },
@@ -245,7 +251,7 @@ export const operations = [
         "resource": "agent.agents",
         "method": "update",
         "summary": "Update agent",
-        "description": "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version. apply defaults to true and moves active_version to the new version, or to the latest when configuration is unchanged; apply false saves without applying. version_note optionally records up to 280 characters on a newly created version; null means no note, and a note sent when the request changes nothing else returns 400 because a note is stored only with a new version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400.",
+        "description": "Save configuration changes as a new immutable version. Send latest_version from a default retrieve or update response as the request version for optimistic concurrency; a stale value returns 409. apply defaults to true and makes the new version effective; apply false saves without changing active_version. The response contains the effective configuration, with version equal to active_version and latest_version naming the newest saved version. An unchanged configuration, including a note-only update, is a no-op returning 200 and the current effective version without creating or activating a version. version_note records up to 280 characters only when a configuration change creates a new version; null is equivalent to omission. Use agents.versions.apply to activate an existing saved version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400.",
         "http": "POST",
         "path": "/agent/v1/agents/{agent_id}",
         "streaming": "no",
@@ -290,7 +296,7 @@ export const operations = [
                     "name": "multiagent",
                     "type": "object",
                     "required": false,
-                    "description": "A coordinator topology: the session's primary thread orchestrates\nwork by spawning session threads, each running an agent drawn from the `agents`\nroster."
+                    "description": "Coordinator roster. A bare string agent id is equivalent to {type: \"agent\", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: \"self\"} refers to this agent. Specify a concrete version to pin it explicitly."
                 },
                 {
                     "name": "name",
@@ -322,19 +328,19 @@ export const operations = [
                     "name": "version",
                     "type": "number",
                     "required": false,
-                    "description": "The agent's current version, used to prevent concurrent overwrites.\nObtain this value from a create or retrieve response. Must be at least 1 if\nspecified. When supplied, the request fails if it does not match the server's\ncurrent version; omit to apply the update unconditionally."
+                    "description": "Newest saved version used for optimistic concurrency. Obtain latest_version from the default retrieve or update response, or version from versions.list. A stale value returns 409; omit for an unconditional update."
                 },
                 {
                     "name": "apply",
                     "type": "boolean",
                     "required": false,
-                    "description": "Defaults to true: apply the newly saved version, or the latest version when configuration is unchanged. Set false to save without changing active_version. Unlike Managed Agents, saving and applying can be separate."
+                    "description": "Defaults to true: apply a newly saved configuration version. Set false to save without changing active_version. An unchanged configuration is a no-op, including note-only updates; use versions.apply to activate a saved version."
                 },
                 {
                     "name": "version_note",
                     "type": "string",
                     "required": false,
-                    "description": "Optional change explanation stored as note on the new immutable version, up to 280 characters. Omission or null stores no note. A note sent when nothing else changes returns 400 (nothing to save), because a note is stored only with a new version."
+                    "description": "Optional change explanation, at most 280 characters. Recorded only when a configuration change creates a new immutable version. A note-only update is a no-op returning 200 and the current effective version. Null is equivalent to omission."
                 },
                 {
                     "name": "bindings",
@@ -365,6 +371,12 @@ export const operations = [
                     "required": false,
                     "description": "Praxis extension: default subagent model ID, pinned in the agent revision. Call model overrides this; otherwise it overrides the roster member model or the parent model for built-ins. Null clears the default. /agent/v1 only."
                 },
+                {
+                    "name": "image_model",
+                    "type": "string",
+                    "required": false,
+                    "description": "Model used by the imagine image tool; defaults to gpt-image-2 when unset. Only models that can generate images are accepted. Omit to preserve; null clears the configured model. /agent/v1 only."
+                },
                 {
                     "name": "subagents",
                     "type": "array",
@@ -424,6 +436,24 @@ export const operations = [
             ]
         }
     },
+    {
+        "resource": "agent.agents",
+        "method": "retrieveAppearance",
+        "summary": "Get agent appearance",
+        "description": "Read the saved chat appearance of a service agent.\n\nAgent Kit calls this from the page with a customer access token of this agent; your API key and console members can read it too. A token of another agent returns 404. The body is the same as the embed appearance read; a missing appearance returns the agent's own name and avatar only. Responses are private and cacheable for 60 seconds.",
+        "http": "GET",
+        "path": "/agent/v1/agents/{agent_id}/appearance",
+        "streaming": "no",
+        "pagination": false,
+        "pathParams": [
+            {
+                "name": "agent_id",
+                "sdkName": "agent_id",
+                "description": "Service agent id from agent creation or listing; with a customer access token, the agent the token was issued for."
+            }
+        ],
+        "query": []
+    },
     {
         "resource": "agent.agents",
         "method": "archive",
@@ -442,6 +472,59 @@ export const operations = [
         ],
         "query": []
     },
+    {
+        "resource": "agent.agents.customers",
+        "method": "list",
+        "summary": "List customers",
+        "description": "List the customers of a service agent, identified and anonymous, most recently seen first.\n\nCall this from your backend with your API key, or from the console. Customers follow Shopify Admin customers (list, retrieve, block, sign-out and data deletion of the people who use your storefront), so that experience applies. The list includes customers who signed in but have not started a session yet, and customers recorded under your own ids by embed tokens before customer sign-in existed; an id first seen that way is identified unless it starts with anon_. Unlike Shopify, a customer can be anonymous: a visitor admitted with the publishable key gets an anon_ id, and when it later signs in with anonymous_access_token it is merged: merged_into names the identified customer, and its sessions count toward that customer. Filter with q (a case-sensitive customer id prefix), type (identified or anonymous) and blocked (true or false). limit is 1 to 100, default 20; reuse next_page with the same filters and limit. A customer access token gets 404. Example: GET /agent/v1/agents/agent_example/customers?type=identified&blocked=false&limit=50.",
+        "http": "GET",
+        "path": "/agent/v1/agents/{agent_id}/customers",
+        "streaming": "no",
+        "pagination": false,
+        "pathParams": [
+            {
+                "name": "agent_id",
+                "sdkName": "agent_id",
+                "description": "Active service agent id from agent creation or listing."
+            }
+        ],
+        "query": [
+            {
+                "name": "limit",
+                "type": "integer",
+                "required": false,
+                "description": "Maximum customers per page, 1 to 100; defaults to 20."
+            },
+            {
+                "name": "page",
+                "type": "string",
+                "required": false,
+                "description": "next_page from the previous response with the same q, type, blocked and limit."
+            },
+            {
+                "name": "q",
+                "type": "string",
+                "required": false,
+                "description": "Case-sensitive literal prefix of the customer id; omit for all customers."
+            },
+            {
+                "name": "type",
+                "type": "string",
+                "enum": [
+                    "identified",
+                    "anonymous"
+                ],
+                "required": false,
+                "description": "Only identified or only anonymous customers; omit for both."
+            },
+            {
+                "name": "blocked",
+                "type": "boolean",
+                "required": false,
+                "description": "true for blocked customers only, false for customers who are not blocked; omit for both."
+            }
+        ]
+    },
     {
         "resource": "agent.agents.customers.auth.accessTokens",
         "method": "create",
@@ -591,61 +674,24 @@ export const operations = [
         }
     },
     {
-        "resource": "agent.agents.endUsers",
-        "method": "list",
-        "summary": "List End Users",
-        "description": "List users who have sessions or token issuance history on a service agent.\n\nOrdered by last_active_at and external_user_id descending. q is a case-sensitive literal prefix, including underscores. limit is 1–100, default 20. Reuse next_page with the same organization, agent, q and limit. Preemptively blocked users without history do not appear. End-user credentials and inaccessible or personal agents return 404.",
-        "http": "GET",
-        "path": "/agent/v1/agents/{agent_id}/end_users",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [
-            {
-                "name": "agent_id",
-                "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
-            }
-        ],
-        "query": [
-            {
-                "name": "limit",
-                "type": "integer",
-                "required": false,
-                "description": "Maximum users per page; defaults to 20."
-            },
-            {
-                "name": "page",
-                "type": "string",
-                "required": false,
-                "description": "next_page from the previous response with the same agent, q and limit."
-            },
-            {
-                "name": "q",
-                "type": "string",
-                "required": false,
-                "description": "Case-sensitive literal prefix of external_user_id; omit or use an empty string for all users."
-            }
-        ]
-    },
-    {
-        "resource": "agent.agents.endUsers",
+        "resource": "agent.agents.customers",
         "method": "delete",
-        "summary": "Delete end-user data",
-        "description": "Delete a host application's end-user data from one service agent after explicit confirmation.\n\nDevelop only. Set confirm to the exact external_user_id; missing or mismatched confirmation returns 400. Returns 202 with a pending task id, not completion. Poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the user is blocked before a seven-day recovery snapshot is verified. Sessions including child sessions, conversation data, grants and feedback are then removed. A pre-existing block remains; a temporary block is removed on success. Attachment metadata is recorded and File attachments are retained. No charge is introduced by this operation. Example: DELETE /agent/v1/agents/agent_example/end_users/customer_123?confirm=customer_123.",
+        "summary": "Delete customer data",
+        "description": "Delete a customer's data from one service agent after explicit confirmation.\n\nDevelop only. Set confirm to the exact customer id; a missing or different confirm returns 400 naming the value to send. Returns 202 with a pending task id; poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the customer is blocked before a seven-day recovery snapshot is verified; sessions including child sessions, conversation data, grants and feedback are then removed. A block that existed before stays; a temporary block is removed on success. File attachments are retained. Example: DELETE /agent/v1/agents/agent_example/customers/cus_8f2a91?confirm=cus_8f2a91.",
         "http": "DELETE",
-        "path": "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+        "path": "/agent/v1/agents/{agent_id}/customers/{customer_id}",
         "streaming": "no",
         "pagination": false,
         "pathParams": [
             {
                 "name": "agent_id",
                 "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
+                "description": "Active service agent id from agent creation or listing."
             },
             {
-                "name": "external_user_id",
-                "sdkName": "external_user_id",
-                "description": "Host user identifier supplied at issuance or from end-user listing."
+                "name": "customer_id",
+                "sdkName": "customer_id",
+                "description": "Customer id from customer listing, or your own customer_id."
             }
         ],
         "query": [
@@ -653,121 +699,121 @@ export const operations = [
                 "name": "confirm",
                 "type": "string",
                 "required": true,
-                "description": "Must exactly equal the external_user_id path parameter to confirm destructive deletion."
+                "description": "Must equal the customer_id path parameter exactly, confirming the destructive deletion."
             }
         ]
     },
     {
-        "resource": "agent.agents.endUsers",
+        "resource": "agent.agents.customers",
         "method": "retrieve",
-        "summary": "Get End User",
-        "description": "Inspect one end user and their twenty most recently updated sessions.\n\nUse external_user_id from listing or your host application. Users without session or issuance history return 404, including preemptively blocked users. End-user credentials and inaccessible or personal agents return 404.",
+        "summary": "Get customer",
+        "description": "Retrieve one customer of a service agent with its twenty most recently updated sessions.\n\nUse the customer id from the list or your own customer_id. An unknown customer returns 404 CUSTOMER_NOT_FOUND, and so does a customer access token. Unlike Shopify, an identified customer's session_count, cost and recent_sessions include the sessions of anonymous customers merged into it; the merged anonymous customer still shows its own sessions and its merged_into.",
         "http": "GET",
-        "path": "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+        "path": "/agent/v1/agents/{agent_id}/customers/{customer_id}",
         "streaming": "no",
         "pagination": false,
         "pathParams": [
             {
                 "name": "agent_id",
                 "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
+                "description": "Active service agent id from agent creation or listing."
             },
             {
-                "name": "external_user_id",
-                "sdkName": "external_user_id",
-                "description": "Host user identifier supplied at issuance or from end-user listing."
+                "name": "customer_id",
+                "sdkName": "customer_id",
+                "description": "Customer id from customer listing, or your own customer_id."
             }
         ],
         "query": []
     },
     {
-        "resource": "agent.agents.endUsers.block",
+        "resource": "agent.agents.customers.block",
         "method": "create",
-        "summary": "Block End User",
-        "description": "Block token issuance and session creation, then revoke existing tokens for an end user.\n\nMay block a user before any history exists; timestamps are then null and counts and cost are zero. Requires an embed policy, otherwise returns 409 with setup guidance. Deduplicates the policy blocklist and retains its 1000-user maximum. If revocation returns 502, the user remains blocked; retry to finish revocation. Repeats keep the user blocked and revoke any remaining grants. End-user credentials and inaccessible or personal agents return 404.",
+        "summary": "Block customer",
+        "description": "Block a customer and end every sign-in it has on this agent.\n\nBlocks the customer, then ends every live sign-in the way logout does: each access token is revoked and its open event streams close. From then on grant_codes, access_tokens, renew and new sessions for this customer return CUSTOMER_BLOCKED until you unblock it. Idempotent: a repeat keeps the first block time and revokes whatever is still live. If credential revocation fails the request returns 502 and the customer stays blocked; retry to finish. An unknown customer returns 404 CUSTOMER_NOT_FOUND.",
         "http": "POST",
-        "path": "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
+        "path": "/agent/v1/agents/{agent_id}/customers/{customer_id}/block",
         "streaming": "no",
         "pagination": false,
         "pathParams": [
             {
                 "name": "agent_id",
                 "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
+                "description": "Active service agent id from agent creation or listing."
             },
             {
-                "name": "external_user_id",
-                "sdkName": "external_user_id",
-                "description": "Host user identifier supplied at issuance or from end-user listing."
+                "name": "customer_id",
+                "sdkName": "customer_id",
+                "description": "Customer id from customer listing, or your own customer_id."
             }
         ],
         "query": []
     },
     {
-        "resource": "agent.agents.endUsers",
+        "resource": "agent.agents.customers",
         "method": "retrieveDeletion",
-        "summary": "Get end-user deletion",
-        "description": "Poll the latest deletion task for an end user, including after the user data has been removed.\n\nUse the same agent_id and external_user_id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. A failed task remains blocked and resumes when DELETE is retried with matching confirmation. snapshot_key is an operator recovery reference retained for seven days, not a public download URL. End-user credentials, inaccessible or personal agents, and missing tasks return 404. This read does not create a task or charge usage.",
+        "summary": "Get customer deletion",
+        "description": "Poll the latest deletion task of a customer, including after its data has been removed.\n\nUse the same agent_id and customer id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. snapshot_key is an operator recovery reference retained for seven days, not a download URL. A customer access token and a missing task return 404.",
         "http": "GET",
-        "path": "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
+        "path": "/agent/v1/agents/{agent_id}/customers/{customer_id}/deletion",
         "streaming": "no",
         "pagination": false,
         "pathParams": [
             {
                 "name": "agent_id",
                 "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
+                "description": "Active service agent id from agent creation or listing."
             },
             {
-                "name": "external_user_id",
-                "sdkName": "external_user_id",
-                "description": "Host user identifier supplied at issuance or from end-user listing."
+                "name": "customer_id",
+                "sdkName": "customer_id",
+                "description": "Customer id from customer listing, or your own customer_id."
             }
         ],
         "query": []
     },
     {
-        "resource": "agent.agents.endUsers.revokeTokens",
+        "resource": "agent.agents.customers.revokeTokens",
         "method": "create",
-        "summary": "Revoke End User Tokens",
-        "description": "Revoke all issued tokens for an end user and terminate their open embed streams.\n\nRevokes credentials before marking grants revoked. Upstream failure returns 502 without changing grant revocation timestamps. Returns the count of newly revoked grants; a repeat without new grants returns zero. Does not block future issuance. End-user credentials and inaccessible or personal agents return 404.",
+        "summary": "Revoke customer tokens",
+        "description": "Sign a customer out everywhere without blocking it.\n\nEnds every live sign-in of the customer, revoking each access token and closing its open event streams; the customer can sign in again right away. Returns the number of access tokens this request revoked; a repeat returns 0. Credential revocation failure returns 502; retry to finish. An unknown customer returns 404 CUSTOMER_NOT_FOUND.",
         "http": "POST",
-        "path": "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
+        "path": "/agent/v1/agents/{agent_id}/customers/{customer_id}/revoke_tokens",
         "streaming": "no",
         "pagination": false,
         "pathParams": [
             {
                 "name": "agent_id",
                 "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
+                "description": "Active service agent id from agent creation or listing."
             },
             {
-                "name": "external_user_id",
-                "sdkName": "external_user_id",
-                "description": "Host user identifier supplied at issuance or from end-user listing."
+                "name": "customer_id",
+                "sdkName": "customer_id",
+                "description": "Customer id from customer listing, or your own customer_id."
             }
         ],
         "query": []
     },
     {
-        "resource": "agent.agents.endUsers.unblock",
+        "resource": "agent.agents.customers.unblock",
         "method": "create",
-        "summary": "Unblock End User",
-        "description": "Allow an end user to receive new tokens and create new sessions again.\n\nRemoves the user from the blocklist; previously revoked tokens stay revoked. Idempotent. Requires an embed policy, otherwise returns 409 with setup guidance. Returns null timestamps and zero counts and cost when no session or issuance history exists. End-user credentials and inaccessible or personal agents return 404.",
+        "summary": "Unblock customer",
+        "description": "Allow a blocked customer to sign in and start sessions again.\n\nIdempotent. Access tokens revoked while the customer was blocked stay revoked; sign the customer in again with a new grant code. An unknown customer returns 404 CUSTOMER_NOT_FOUND.",
         "http": "POST",
-        "path": "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
+        "path": "/agent/v1/agents/{agent_id}/customers/{customer_id}/unblock",
         "streaming": "no",
         "pagination": false,
         "pathParams": [
             {
                 "name": "agent_id",
                 "sdkName": "agent_id",
-                "description": "Active service agent identifier from agent creation or listing."
+                "description": "Active service agent id from agent creation or listing."
             },
             {
-                "name": "external_user_id",
-                "sdkName": "external_user_id",
-                "description": "Host user identifier supplied at issuance or from end-user listing."
+                "name": "customer_id",
+                "sdkName": "customer_id",
+                "description": "Customer id from customer listing, or your own customer_id."
             }
         ],
         "query": []
@@ -794,7 +840,7 @@ export const operations = [
         "resource": "agent.agents.versions",
         "method": "list",
         "summary": "List agent versions",
-        "description": "List the saved versions of one agent, in pages of at most 100 (default 20). Each item is the full agent definition at that version, so you can compare what changed between versions. active is true only for the item that new sessions use; active_version on each item is the agent-level value, kept for compatibility. Use agents.retrieve with version to read a single one; agent_id comes from agents.list or agents.create.",
+        "description": "List the saved versions of one agent in ascending version number, oldest first, in pages of at most 100 (default 20). Each item is the full agent definition at that saved version, so you can compare configurations. active is true only for the item new sessions use. active_version on every item is the same agent-level currently effective version; it is not that item's version. Use agents.retrieve with version to read a single saved version; agent_id comes from agents.list or agents.create. Pass next_page as page to continue.",
         "http": "GET",
         "path": "/agent/v1/agents/{agent_id}/versions",
         "streaming": "no",
@@ -825,7 +871,7 @@ export const operations = [
         "resource": "agent.agents.versions",
         "method": "apply",
         "summary": "Apply Agent Version",
-        "description": "Apply a version from agents.versions.list by its version number. This idempotent operation changes active_version without creating a version; existing sessions and tokens keep their version. The response is the latest saved agent with its current active_version. Missing versions return 404 Agent version not found; archived agents return 409 Agent is archived. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.",
+        "description": "Apply a saved version from agents.versions.list for new sessions and newly issued tokens, without creating a version. Existing sessions and tokens retain their version. The response contains the effective configuration with version equal to active_version and latest_version naming the newest saved version. Missing versions return 404; archived agents return 409. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.",
         "http": "POST",
         "path": "/agent/v1/agents/{agent_id}/versions/{version}/apply",
         "streaming": "no",
@@ -1564,204 +1610,6 @@ export const operations = [
         ],
         "query": []
     },
-    {
-        "resource": "agent.embed",
-        "method": "retrieveAppearance",
-        "summary": "Read chat appearance",
-        "description": "Load saved appearance for an iframe or Hosted chat page. Supply an end-user embed token as Bearer authorization, or a console-issued publishable key in Praxis-Publishable-Key before anonymous token issuance. The credential selects the agent; identity_number and agent_id query parameters are rejected with 400. Missing appearance returns an empty object. Kit option names retain camelCase. Responses are private and cacheable for 60 seconds. Component hosts configure Kit in their own code instead.",
-        "http": "GET",
-        "path": "/agent/v1/embed/appearance",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [],
-        "query": []
-    },
-    {
-        "resource": "agent.embed.exchange",
-        "method": "create",
-        "summary": "Exchange Hosted Code",
-        "description": "Redeem a single-use hosted link credential for an end-user token.\n\nRead code from the c fragment parameter of hosted_url returned by embed token creation with hosted true, then remove the fragment before exchanging. No Authorization header is required; the code authenticates this request. The code expires after 60 seconds and is consumed atomically on exchange, so concurrent attempts have only one winner. Expired, used and unknown codes return the same 404 body. Keep the token in memory and return to the host website for a fresh link when it expires; exchange cannot refresh it. Requests are IP limited per minute using the anonymous entrypoint budget (default 20). Example body is {\"code\":\"<code from hosted_url>\"}.",
-        "http": "POST",
-        "path": "/agent/v1/embed/exchange",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [],
-        "query": [],
-        "body": {
-            "required": true,
-            "fields": [
-                {
-                    "name": "code",
-                    "type": "string",
-                    "required": true,
-                    "description": "Single-use credential from the c fragment parameter of hosted_url returned by embed token creation. Valid for 60 seconds."
-                }
-            ]
-        }
-    },
-    {
-        "resource": "agent.embedTokens",
-        "method": "list",
-        "summary": "List Embed Tokens",
-        "description": "List embed token issuance records in your organization.\n\nIncludes expired and revoked grants; returns neither token nor token_id. Sorts by created_at, then grant id, both descending. agent_id accepts agent_ or agt_; external_user_id matches exactly. limit is 1–100 (default 20). Reuse next_page as page with the same filters and organization; a mismatch returns 400. End-user credentials return 404.",
-        "http": "GET",
-        "path": "/agent/v1/embed_tokens",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [],
-        "query": [
-            {
-                "name": "agent_id",
-                "type": "string",
-                "required": false,
-                "description": "Filter by service agent identifier (agent_ or agt_ prefix)."
-            },
-            {
-                "name": "external_user_id",
-                "type": "string",
-                "required": false,
-                "description": "Exact host user identifier supplied at issuance."
-            },
-            {
-                "name": "limit",
-                "type": "integer",
-                "required": false,
-                "description": "Maximum records per page; defaults to 20."
-            },
-            {
-                "name": "page",
-                "type": "string",
-                "required": false,
-                "description": "next_page from a previous response with the same filters."
-            }
-        ]
-    },
-    {
-        "resource": "agent.embedTokens",
-        "method": "create",
-        "summary": "Create Embed Token",
-        "description": "Issue a short-lived credential on your backend for an end user of a service agent.\n\nRequires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. Set hosted to true to also receive hosted_url; redirect the user there within 60 seconds. The agent must have an identity_number. The URL fragment contains a single-use exchange credential, not the token. Omit hosted or set false for ordinary token issuance.",
-        "http": "POST",
-        "path": "/agent/v1/embed_tokens",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [],
-        "query": [],
-        "body": {
-            "required": true,
-            "fields": [
-                {
-                    "name": "hosted",
-                    "type": "boolean",
-                    "required": false,
-                    "description": "Set true to also return a hosted chat URL with a single-use credential valid for 60 seconds. Defaults to false; the agent must have an identity_number."
-                },
-                {
-                    "name": "agent",
-                    "type": "string",
-                    "required": true,
-                    "description": "Service agent ID or identity_number from agent retrieval; it must belong to your organization and be active."
-                },
-                {
-                    "name": "version",
-                    "type": "integer",
-                    "required": false,
-                    "description": "Existing agent version to pin. Omit to pin the latest version at issuance."
-                },
-                {
-                    "name": "external_user_id",
-                    "type": "string",
-                    "required": true,
-                    "description": "Your application's stable end-user identifier, scoped to this organization and agent."
-                },
-                {
-                    "name": "ttl_seconds",
-                    "type": "integer",
-                    "required": false,
-                    "description": "Token lifetime in seconds. Defaults to the embed policy TTL and cannot exceed its maximum or 3600 seconds."
-                },
-                {
-                    "name": "budget_cents",
-                    "type": "integer",
-                    "required": false,
-                    "description": "Session budget in cents. Defaults to the embed policy session budget and cannot exceed its maximum."
-                },
-                {
-                    "name": "system_message",
-                    "type": "array",
-                    "itemType": "object",
-                    "required": false,
-                    "description": "Optional host context as text blocks, limited to 8192 UTF-8 bytes in total."
-                },
-                {
-                    "name": "agent_override",
-                    "type": "object",
-                    "required": false,
-                    "description": "Optional system prompt override, accepted only when the embed policy allows agent overrides."
-                },
-                {
-                    "name": "allowed_origins",
-                    "type": "array",
-                    "itemType": "string",
-                    "required": false,
-                    "description": "Optional subset of the policy origin entries, compared exactly. Omit to snapshot every policy origin."
-                },
-                {
-                    "name": "metadata",
-                    "type": "object",
-                    "required": false,
-                    "description": "Host metadata preserved verbatim; at most 16 keys of 1–64 characters and string values of at most 512 characters. Defaults to an empty object."
-                }
-            ]
-        }
-    },
-    {
-        "resource": "agent.embedTokens.anonymous",
-        "method": "create",
-        "summary": "Issue anonymous visitor token",
-        "description": "Obtain a short-lived embedding token for a visitor without an account using the agent owner's publishable key.\n\nNo Authorization header is required. Send the browser Origin allowed by the agent policy. Save a returned visitor_secret and reuse it for refreshes; only new visitors receive one. Unknown secrets create new visitors, and extra fields including visitor_id return 400. Issuance uses the key creator's organization membership, the key session budget and the smaller of the policy TTL maximum and 3600 seconds. IP requests are limited per minute (default 20); UTC daily session and spending caps are checked across the key's primary sessions created that day. Token issuance itself does not create a session or charge usage; subsequent sessions bill the host organization. Example body: {\"publishable_key\":\"pk_praxis_example\"}.",
-        "http": "POST",
-        "path": "/agent/v1/embed_tokens/anonymous",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [],
-        "query": [],
-        "body": {
-            "required": true,
-            "fields": [
-                {
-                    "name": "publishable_key",
-                    "type": "string",
-                    "required": true,
-                    "description": "Public key created by the service agent owner; safe to include in browser code."
-                },
-                {
-                    "name": "visitor_secret",
-                    "type": "string",
-                    "required": false,
-                    "description": "Secret returned by a previous anonymous issuance for this key. Omit for a new visitor; an unknown secret creates a new visitor."
-                }
-            ]
-        }
-    },
-    {
-        "resource": "agent.embedTokens.revoke",
-        "method": "create",
-        "summary": "Revoke Embed Token",
-        "description": "Revoke an embed token and close its open event streams.\n\nUse an id from issuance or listing. Revokes the credential before setting revoked_at; upstream failure leaves it unset. Streams receive session.error (EMBED_TOKEN_REVOKED), then close immediately; other credentials are unaffected. Idempotent; repeats return the original revoked record without another revocation or audit. Missing or foreign grants and end-user credentials return 404.",
-        "http": "POST",
-        "path": "/agent/v1/embed_tokens/{id}/revoke",
-        "streaming": "no",
-        "pagination": false,
-        "pathParams": [
-            {
-                "name": "id",
-                "sdkName": "id",
-                "description": "Grant id returned by issuance or listing."
-            }
-        ],
-        "query": []
-    },
     {
         "resource": "agent.environments",
         "method": "list",
@@ -2050,7 +1898,7 @@ export const operations = [
         "resource": "agent.sessions",
         "method": "create",
         "summary": "Create session",
-        "description": "Create a session: one conversation with an agent. Pass agent as an agent id or {type:\"agent\", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:\"agent_with_overrides\", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:\"limit\", max_list_cost:{amount, currency:\"USD\"}} where amount is a positive integer string of US cents (\"2000\" is USD 20.00); omitted budget defaults to \"2000\" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.",
+        "description": "Create a session: one conversation with an agent. Pass agent as an agent id or {type:\"agent\", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:\"agent_with_overrides\", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:\"limit\", max_list_cost:{amount, currency:\"USD\"}} where amount is a positive decimal string of US dollars with at most 2 decimal places (\"20.00\" is USD 20.00); omitted budget defaults to \"20.00\" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.",
         "http": "POST",
         "path": "/agent/v1/sessions",
         "streaming": "no",
@@ -2603,9 +2451,9 @@ export const operations = [
         "query": [
             {
                 "name": "limit",
-                "type": "number",
+                "type": "integer",
                 "required": false,
-                "description": "Number of items per page."
+                "description": "Number of resources per page, from 1 to 100; defaults to 100."
             },
             {
                 "name": "page",
@@ -3965,7 +3813,7 @@ export const operations = [
         "resource": "automation.actions",
         "method": "list",
         "summary": "List actions",
-        "description": "Discover callable Actions and their ns/name references without executing them. Combine each returned namespace and name as ns/name; Action calls use the current revision and do not accept @version or @tag. Filter by name or description; results include seven-day statistics and revision summaries without implementation source. Archived actions are excluded by default.",
+        "description": "Discover callable Actions and their ns/name references without executing them. Combine each returned namespace and name as ns/name; Action calls use the current revision and do not accept @version or @tag. Filter by name or description; results include seven-day statistics and revision summaries without implementation source. Archived actions are excluded by default. List items carry no input contract: get the action and read current_revision.input_schema. Call it with call(\"ns/name\", input) in a script or call: ns/name with with: in a workflow.",
         "http": "GET",
         "path": "/automation/v1/actions",
         "streaming": "no",
@@ -4134,7 +3982,7 @@ export const operations = [
         "resource": "automation.actions",
         "method": "retrieve",
         "summary": "Get an Action with its current input and output JSON Schemas",
-        "description": "Read the Action and its full current implementation, with input and output JSON Schemas at current_revision.input_schema and current_revision.output_schema. To read a built-in Action, use ns=praxis and name=<bare name>, for example name=ocr; invoke it in a script with call(\"ocr\", input). The response ETag is the current revision ID for conditional updates.",
+        "description": "Read the Action and its full current implementation, with input and output JSON Schemas at current_revision.input_schema and current_revision.output_schema. To read a built-in Action, use ns=praxis and name=<bare name>, for example name=ocr; invoke it in a script with call(\"ocr\", input) or in a workflow step with call: ocr and with:. Input that breaks the contract returns INPUT_INVALID, with the fields in errors[]. The response ETag is the current revision ID for conditional updates.",
         "http": "GET",
         "path": "/automation/v1/actions/{ns}/{name}",
         "streaming": "no",
@@ -4550,6 +4398,177 @@ export const operations = [
             "fields": []
         }
     },
+    {
+        "resource": "automation.humanTasks",
+        "method": "list",
+        "summary": "List human tasks",
+        "description": "List the human tasks that praxis/approval workflow steps opened, newest first. By default it returns only open tasks assigned to the caller: their approval inbox. scope=all lists every task of the organization, and status and run_id narrow the list. Use a returned id with retrieve for details and respond to decide. Read-only: listing never changes a task.",
+        "http": "GET",
+        "path": "/automation/v1/human-tasks",
+        "streaming": "no",
+        "pagination": true,
+        "pathParams": [],
+        "query": [
+            {
+                "name": "limit",
+                "type": "integer",
+                "required": false,
+                "description": "Page size, 1–100, default 50."
+            },
+            {
+                "name": "cursor",
+                "type": "string",
+                "required": false,
+                "description": "The next_cursor of the previous page; omit for the first page."
+            },
+            {
+                "name": "status",
+                "type": "array",
+                "itemType": "string",
+                "enum": [
+                    "open",
+                    "completed",
+                    "expired",
+                    "cancelled"
+                ],
+                "required": false,
+                "description": "Filter by status, comma-separated: open, completed, expired, cancelled. Defaults to open."
+            },
+            {
+                "name": "run_id",
+                "type": "string",
+                "required": false,
+                "description": "Only tasks opened by this run (run_)."
+            },
+            {
+                "name": "scope",
+                "type": "string",
+                "enum": [
+                    "assigned",
+                    "all"
+                ],
+                "required": false,
+                "description": "assigned (default) lists only tasks assigned to the caller; all lists every task of the organization."
+            }
+        ]
+    },
+    {
+        "resource": "automation.humanTasks",
+        "method": "retrieve",
+        "summary": "Retrieve a human task",
+        "description": "Read one human task - title, Markdown body, context, actions, form, assignees, mode, due time, responses and outcome - so an assignee can choose an action and fill the form. Read-only; the Console approval page /automation/tasks/{id} reads the same resource.",
+        "http": "GET",
+        "path": "/automation/v1/human-tasks/{id}",
+        "streaming": "no",
+        "pagination": false,
+        "pathParams": [
+            {
+                "name": "id",
+                "sdkName": "id",
+                "description": "Human task ID (htask_), from the list or the run's waits."
+            }
+        ],
+        "query": []
+    },
+    {
+        "resource": "automation.humanTasks",
+        "method": "cancel",
+        "summary": "Cancel a human task",
+        "description": "Cancel an open human task; only the person who started the run or an organization API key may cancel. The task becomes cancelled and the waiting workflow step raises a runtime error with code HUMAN_TASK_CANCELLED, which try/catch can catch. Open tasks are cancelled automatically when their run ends, so this call is not needed then.",
+        "http": "POST",
+        "path": "/automation/v1/human-tasks/{id}/cancel",
+        "streaming": "no",
+        "pagination": false,
+        "pathParams": [
+            {
+                "name": "id",
+                "sdkName": "id",
+                "description": "Human task ID (htask_)."
+            }
+        ],
+        "query": [],
+        "body": {
+            "required": false,
+            "fields": [
+                {
+                    "name": "reason",
+                    "type": "string",
+                    "required": false,
+                    "description": "Optional cancellation reason, at most 500 characters."
+                }
+            ]
+        }
+    },
+    {
+        "resource": "automation.humanTasks",
+        "method": "delegate",
+        "summary": "Delegate a human task",
+        "description": "An assignee who has not responded hands their place to another user (to_user), replacing their entry in assignees.users in place, so sequential order is kept. The new user cannot already be an assignee, nor the initiator unless self-approval is allowed. The task must still be open.",
+        "http": "POST",
+        "path": "/automation/v1/human-tasks/{id}/delegate",
+        "streaming": "no",
+        "pagination": false,
+        "pathParams": [
+            {
+                "name": "id",
+                "sdkName": "id",
+                "description": "Human task ID (htask_)."
+            }
+        ],
+        "query": [],
+        "body": {
+            "required": true,
+            "fields": [
+                {
+                    "name": "to_user",
+                    "type": "string",
+                    "required": true,
+                    "description": "User ID taking over; cannot already be an assignee, nor the initiator unless self-approval is allowed."
+                }
+            ]
+        }
+    },
+    {
+        "resource": "automation.humanTasks",
+        "method": "respond",
+        "summary": "Respond to a human task",
+        "description": "Submit an action (action_id), form values (values) and a comment as the calling user. Depending on the task's mode the response either decides it (status becomes completed, outcome is set, and the waiting workflow resumes with outcome as the step output) or is recorded while other assignees are awaited. When two assignees respond at once, exactly one decides and the other gets TASK_CLOSED. An agent may respond only if the workflow set allow_agent_decision. Send an Idempotency-Key to retry safely.",
+        "http": "POST",
+        "path": "/automation/v1/human-tasks/{id}/respond",
+        "streaming": "no",
+        "pagination": false,
+        "pathParams": [
+            {
+                "name": "id",
+                "sdkName": "id",
+                "description": "Human task ID (htask_)."
+            }
+        ],
+        "query": [],
+        "body": {
+            "required": true,
+            "fields": [
+                {
+                    "name": "action_id",
+                    "type": "string",
+                    "required": true,
+                    "description": "The chosen action ID from the task's actions, for example approve."
+                },
+                {
+                    "name": "values",
+                    "type": "object",
+                    "required": false,
+                    "description": "Any JSON object whose keys are strings and whose values are any JSON value."
+                },
+                {
+                    "name": "comment",
+                    "type": "string",
+                    "required": false,
+                    "description": "Comment of at most 4000 characters; required when the action has require_comment true."
+                }
+            ]
+        }
+    },
     {
         "resource": "automation.resolve",
         "method": "retrieve",
@@ -4730,7 +4749,7 @@ export const operations = [
         "resource": "automation.runs",
         "method": "create",
         "summary": "Run a published target or execute draft source",
-        "description": "Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call(\"ocr\", { document: { type: \"file\", file_id } }); return result; }`; send it as source with language=\"ts\", input={\"file_id\":\"<uploaded file ID>\"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: \"glm-ocr\", document: { type: \"file\", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke(\"namespace/name\", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 7 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.",
+        "description": "Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call(\"ocr\", { document: { type: \"file\", file_id } }); return result; }`; send it as source with language=\"ts\", input={\"file_id\":\"<uploaded file ID>\"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: \"glm-ocr\", document: { type: \"file\", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke(\"namespace/name\", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 30 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. With language=yaml, source is a workflow YAML: the run input is . in the first step, and the shape is described in create workflow. Error details are in errors[] (pointer, detail, hint). New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.",
         "http": "POST",
         "path": "/automation/v1/runs",
         "streaming": "no",
@@ -5222,7 +5241,7 @@ export const operations = [
         "resource": "automation.scripts",
         "method": "create",
         "summary": "Create a script",
-        "description": "Save a TypeScript script as an editable draft for later reuse; this does not publish or start a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. The draft is a source string with a default-exported function, for example `export default async (input: {name: string}) => ({greeting: \"Hello, \" + input.name});`. Scripts provide praxis, call, invoke, console and codemode as module-scope bindings, not on globalThis, with no import needed: praxis.<domain>.<resource>.<method>(...) calls a platform API, call(\"ocr\", input) calls a built-in Action, and invoke(\"namespace/name\", input) starts a child run. Action IDs are strings (bare names for built-ins, namespace/name for your own Actions); praxis.ocr(...) does not exist. To test it, pass that source and language=ts to praxis.automation.runs.create without publishing. To publish later, use the returned draft.revision as expected_draft_revision.",
+        "description": "Save a TypeScript script as an editable draft for later reuse; this does not publish or start a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. The draft is a source string with a default-exported function, for example `export default async (input: {name: string}) => ({greeting: \"Hello, \" + input.name});`. Scripts provide praxis, call, invoke, console and codemode as module-scope bindings, not on globalThis, with no import needed: praxis.<domain>.<resource>.<method>(...) calls a platform API, call(\"ocr\", input) calls a built-in Action, and invoke(\"namespace/name\", input) starts a child run. Action IDs are strings (bare names for built-ins, namespace/name for your own Actions); praxis.ocr(...) does not exist. The return value is limited to 1 MiB: write large results to a file with call(\"write-file\", ...) and return the file ID. A call error carries errors[] (pointer, detail, hint); String(e) is only the summary. To test it, pass that source and language=ts to praxis.automation.runs.create without publishing. To publish later, use the returned draft.revision as expected_draft_revision.",
         "http": "POST",
         "path": "/automation/v1/scripts",
         "streaming": "no",
@@ -6171,7 +6190,7 @@ export const operations = [
         "resource": "automation.validate",
         "method": "create",
         "summary": "Validate a definition",
-        "description": "Check source without executing it when you need diagnostics, inferred schemas or references. This is optional before praxis.automation.runs.create, which also validates source before execution. Actions, scripts and workflows are supported; results include validity without saving. Invalid source is reported with valid=false. Script/action output schemas are inferred from return types: Promise unwrapping, Record, intersections and Date. Unknown types yield an empty schema and a warning in warnings. Source diagnostics use /source or /implementation/source with 1-based line/column. For kind=action the same admission checks as action creation apply (no external imports, platform operations only as direct call(praxis/<api>.<op>, input) calls, no agent or automation calls), so source that validates is not rejected at creation.",
+        "description": "Check source without executing it when you need diagnostics, inferred schemas or references. This is optional before praxis.automation.runs.create, which also validates source before execution. Actions, scripts and workflows are supported; results include validity without saving. Invalid source is reported with valid=false. Script/action output schemas are inferred from return types: Promise unwrapping, Record, intersections and Date. Unknown types yield an empty schema and a warning in warnings. Source diagnostics use /source or /implementation/source with 1-based line/column. For kind=action the same admission checks as action creation apply (no external imports, platform operations only as direct call(praxis/<api>.<op>, input) calls, no agent or automation calls), so source that validates is not rejected at creation. For kind=workflow the YAML needs document (dsl, namespace, name, version) and do; each problem is one entry in errors[] (pointer, detail, hint), so read the first one. A listen outside the supported subset (to.all, inside a fork) and emit are not reported here and fail with DEFINITION_INVALID only when a run is created.",
         "http": "POST",
         "path": "/automation/v1/validate",
         "streaming": "no",
@@ -6278,7 +6297,7 @@ export const operations = [
         "resource": "automation.workflows",
         "method": "create",
         "summary": "Create a workflow",
-        "description": "Save a YAML workflow as an editable draft without publishing or starting a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. To test the draft, send its source and language=yaml to praxis.automation.runs.create. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.",
+        "description": "Save a YAML workflow as an editable draft; this does not validate, publish or run it, so check it with validate (kind=workflow) first. Minimal draft: document with dsl (\"1.0.3\"), namespace, name and version, plus a do list of steps, for example document: {dsl: \"1.0.3\", namespace: demo, name: add, version: \"1.0.0\"} and do: [{first: {call: demo/add-one, with: {n: \"${ .n }\"}}}]. call: <ns/name> calls an Action directly (bare name for built-ins such as ocr) and with is the Action input; the input contract is at current_revision.input_schema in the get-action response. run: starts a saved script or child workflow. The run input is . in the first step, and expressions are jq written as a whole ${ ... } string. Limits: Action 30 s (run-sandbox 10 min), workflow 24 h by default and 30 days at most, payload 1 MiB. Test the draft by sending its source and language=yaml to praxis.automation.runs.create. Guide: /docs/developers/automation/guides/write-workflow. Error details are in the errors[] of the response (pointer, detail, hint). Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.",
         "http": "POST",
         "path": "/automation/v1/workflows",
         "streaming": "no",
@@ -6348,7 +6367,7 @@ export const operations = [
         "resource": "automation.workflows",
         "method": "update",
         "summary": "Update a workflow draft",
-        "description": "Update description, labels or draft with the current draft revision in If-Match. Even metadata-only updates create a new draft revision.",
+        "description": "Update description, labels or draft with the current draft revision in If-Match, taken from draft.revision in the get-workflow response. Even metadata-only updates create a new draft revision. A mismatch returns 412 PRECONDITION_FAILED; read the draft again, merge and retry. The draft is not validated here, so check it with validate (kind=workflow) before publishing. Error details are in errors[].",
         "http": "PATCH",
         "path": "/automation/v1/workflows/{ns}/{name}",
         "streaming": "no",
@@ -6586,7 +6605,7 @@ export const operations = [
             "publish"
         ],
         "summary": "Publish a workflow version",
-        "description": "Publish a saved definition from its draft or an ad hoc run as a reusable version for named runs or triggers, validating the definition and locking dependencies. To test unpublished code, use praxis.automation.runs.create with source and language instead. Use draft.revision from create or retrieve as expected_draft_revision. The draft must match expected_draft_revision; an ad hoc run requires from_run and expected_source_sha256. The same version and contents return the existing version; different contents return VERSION_EXISTS, prereleases require an explicit tag (not latest, URL-safe characters only, not a version or range; violations return TAG_REQUIRED or TAG_INVALID with the complete rules in hint), and invalid definitions return DEFINITION_INVALID. Stable releases automatically advance latest only above the highest existing stable version; workflows becoming latest synchronize their declared schedule. String and object run.workflow/run.script references share version resolution and dependency locking. Publishing removes +build metadata from the version number.",
+        "description": "Publish a saved definition from its draft or an ad hoc run as a reusable version for named runs or triggers, validating the definition and locking dependencies. To test unpublished code, use praxis.automation.runs.create with source and language instead. Use draft.revision from create or retrieve as expected_draft_revision. The draft must match expected_draft_revision; an ad hoc run requires from_run and expected_source_sha256. The same version and contents return the existing version; different contents return VERSION_EXISTS, prereleases require an explicit tag (not latest, URL-safe characters only, not a version or range; violations return TAG_REQUIRED or TAG_INVALID with the complete rules in hint), and invalid definitions return DEFINITION_INVALID. Stable releases automatically advance latest only above the highest existing stable version; workflows becoming latest synchronize their declared schedule. String and object run.workflow/run.script references share version resolution and dependency locking. Publishing removes +build metadata from the version number. For a workflow, document namespace, name and version must equal the publish target, otherwise DEFINITION_IDENTITY_MISMATCH; where a DEFINITION_INVALID failure sits is listed in errors[] (pointer, detail, hint).",
         "http": "POST",
         "path": "/automation/v1/workflows/{ns}/{name}/versions",
         "streaming": "no",
@@ -9646,7 +9665,8 @@ export const operations = [
                 {
                     "name": "file_id",
                     "type": "string",
-                    "required": true
+                    "required": true,
+                    "description": "File ID to copy into this library; passed as the upload source instead of file bytes."
                 },
                 {
                     "name": "public_id",