@deepraxis/sdk 0.1.1-dev.d775f1e → 0.1.1-dev.ed5af3e

package/dist/generated/types.gen.d.ts

@@ -534,7 +534,7 @@ export type BrowserError = {
     statusCode: number;
     error: string;
     message: string;
-    code: 'INVALID_PARAMS' | 'UNAUTHENTICATED' | 'CONNECT_SIGNATURE_INVALID' | 'SESSION_NOT_FOUND' | 'SESSION_ENDED' | 'SESSION_INVALID_STATE' | 'CONTEXT_NOT_FOUND' | 'CONTEXT_LOCKED' | 'HANDOFF_NOT_PENDING' | 'CONCURRENCY_LIMIT' | 'RATE_LIMITED' | 'INSUFFICIENT_BALANCE' | 'PROVIDER_UNSUPPORTED' | 'PROVIDER_CAPACITY' | 'PROVIDER_FAILED';
+    code: 'INVALID_PARAMS' | 'PERMISSION_DENIED' | 'NOT_IMPLEMENTED' | 'INTERNAL' | 'UNAUTHENTICATED' | 'CONNECT_SIGNATURE_INVALID' | 'SESSION_NOT_FOUND' | 'SESSION_ENDED' | 'SESSION_INVALID_STATE' | 'CONTEXT_NOT_FOUND' | 'CONTEXT_LOCKED' | 'HANDOFF_NOT_PENDING' | 'CONCURRENCY_LIMIT' | 'RATE_LIMITED' | 'INSUFFICIENT_BALANCE' | 'QUOTA_EXHAUSTED' | 'ACCOUNT_SUSPENDED' | 'PROVIDER_UNSUPPORTED' | 'PROVIDER_CAPACITY' | 'PROVIDER_FAILED' | 'SERVICE_UNAVAILABLE' | 'PARENT_NOT_FOUND' | 'INVALID_FILTER' | 'INVALID_PAGE_TOKEN';
 };
 export type BrowserSession = {
     /**
@@ -903,9 +903,21 @@ export type BrowserContextCreateResult = {
      * 当前登录态写入租约的持有者标识；无有效租约时省略。
      */
     lockedBy?: string;
+    /**
+     * UTC timestamp when a session last started with this context; absent if it has never been used.
+     */
     lastUsedAt?: string;
+    /**
+     * Empty compatibility field; context encryption keys are held by the server.
+     */
     publicKey: string;
+    /**
+     * Compatibility encryption algorithm name; creation returns AES-256-CBC.
+     */
     cipherAlgorithm: 'AES-256-CBC';
+    /**
+     * Compatibility initialization-vector size in bytes; creation returns 16.
+     */
     initializationVectorSize: number;
 };
 export type BrowserContext = {
@@ -951,6 +963,9 @@ export type BrowserContext = {
      * 当前登录态写入租约的持有者标识；无有效租约时省略。
      */
     lockedBy?: string;
+    /**
+     * UTC timestamp when a session last started with this context; absent if it has never been used.
+     */
     lastUsedAt?: string;
 };
 export type BrowserStreamMessage = {
@@ -986,6 +1001,9 @@ export type BrowserStreamMessage = {
         url?: string;
         x?: number;
         y?: number;
+        /**
+         * UTC timestamp when a session last started with this context; absent if it has never been used.
+         */
         at: string;
         actor: 'client' | 'human';
     };
@@ -4414,7 +4432,7 @@ export type AgentManaged179 = {
      */
     input_tokens?: number;
     /**
-     * A monetary amount in a specific currency.
+     * Session total list-price cost in USD as a decimal string with exactly 6 decimals. Includes models, runtime and all other charged products attributed to this session; child-thread model cost is already included. The budget reads the same total. In-flight work may finish after the limit is reached.
      */
     list_cost?: null | AgentManaged77;
     /**
@@ -4426,18 +4444,15 @@ export type AgentManaged179 = {
      */
     server_tool_use?: null | AgentManaged181;
     /**
-     * Praxis extension: priced runtime of this session (the time it was running), billed separately from list_cost and not counted against the budget. amount is in US dollars as a decimal string with exactly 6 decimals, e.g. "0.000280". Each thread's runtime is reported on that thread. /agent/v1 only.
+     * USD list-price cost by product, as decimal strings with exactly 6 decimals. Values sum to list_cost.amount. router.llm is the larger of the live model meter and charged model facts; all other products use charged facts only.
      */
-    runtime_cost?: {
-        /**
-         * Runtime cost in US dollars, decimal string with exactly 6 decimals.
-         */
-        amount: string;
-        /**
-         * Always USD.
-         */
-        currency: 'USD';
+    cost_by_product?: {
+        [key: string]: string;
     };
+    /**
+     * Child-thread model cost in integer micro-USD, already included in list_cost. This is a subset, not an additional charge; it excludes child-thread runtime.
+     */
+    subagent_cost_micro_usd?: number;
 };
 export type AgentManaged183 = {
     [key: string]: null | string;
@@ -4864,7 +4879,11 @@ export type AgentManaged186 = {
      */
     session_thread_id?: null | string;
 };
-export type AgentManaged187 = {
+export type AgentManaged187 = unknown & {
+    /**
+     * With result=allow and full_access_available=true, switch this session to full access before allowing this call. Other values or ineligible active requests return 400. Repeated or late replies are successful no-ops.
+     */
+    permission_mode?: 'yolo';
     /**
      * Unique identifier for this event.
      */
@@ -4885,10 +4904,9 @@ export type AgentManaged187 = {
      */
     type: 'user.tool_confirmation';
     /**
-     * Optional message providing context for a 'deny' decision. Only allowed when
-     * result is 'deny'.
+     * Feedback for a deny result, at most 4000 characters. Appended to the model-visible refusal and persisted on the confirmation; ExitPlanMode keeps its plan-feedback flow. Omit when no feedback is needed.
      */
-    deny_message?: null | string;
+    deny_message?: string;
     /**
      * A timestamp in RFC 3339 format
      */
@@ -5614,7 +5632,11 @@ export type AgentManaged250 = {
      */
     session_thread_id?: null | string;
 };
-export type AgentManaged251 = {
+export type AgentManaged251 = unknown & {
+    /**
+     * With result=allow and full_access_available=true, switch this session to full access before allowing this call. Other values or ineligible active requests return 400. Repeated or late replies are successful no-ops.
+     */
+    permission_mode?: 'yolo';
     /**
      * UserToolConfirmationResult enum
      */
@@ -5631,10 +5653,39 @@ export type AgentManaged251 = {
      */
     type: 'user.tool_confirmation';
     /**
-     * Optional message providing context for a 'deny' decision. Only allowed when
-     * result is 'deny'.
+     * Feedback for a deny result, at most 4000 characters. Appended to the model-visible refusal and persisted on the confirmation; ExitPlanMode keeps its plan-feedback flow. Omit when no feedback is needed.
      */
-    deny_message?: null | string;
+    deny_message?: string;
+    /**
+     * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+     */
+    updated_permissions?: Array<{
+        /**
+         * add_rules adds the offered allow rules.
+         */
+        type: 'add_rules';
+        /**
+         * allow grants permission for matching calls.
+         */
+        behavior: 'allow';
+        /**
+         * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+         */
+        destination: 'agent' | 'session';
+        /**
+         * The complete set of rules from one offered suggestion, without changes.
+         */
+        rules: Array<{
+            /**
+             * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+             */
+            tool_name: string;
+            /**
+             * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+             */
+            rule_content: string;
+        }>;
+    }>;
 };
 export type AgentManaged252 = {
     /**
@@ -6098,6 +6149,18 @@ export type AgentSseEvent = ({
      * Decoded JSON payload of this frame; its shape is selected by the event name.
      */
     data?: {
+        /**
+         * Monotone permission-mode version, incremented once per mode update.
+         */
+        permission_mode_version?: number;
+        /**
+         * The permission mode before this change, or null when none was selected.
+         */
+        previous_permission_mode?: string | null;
+        /**
+         * The new native session permission mode; null restores configured tool policies.
+         */
+        permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
         /**
          * Unique identifier for this event.
          */
@@ -6270,6 +6333,10 @@ export type AgentSseEvent = ({
      * Decoded JSON payload of this frame; its shape is selected by the event name.
      */
     data?: {
+        /**
+         * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+         */
+        full_access_available?: boolean;
         /**
          * Unique identifier for this event.
          */
@@ -6312,6 +6379,44 @@ export type AgentSseEvent = ({
          * Run that produced this event; null when no run identity was recorded.
          */
         run_id: string | null;
+        /**
+         * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+         */
+        user_once?: true;
+        /**
+         * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+         */
+        guarded_rule?: string;
+        /**
+         * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+         */
+        permission_suggestions?: Array<{
+            /**
+             * add_rules adds the offered allow rules.
+             */
+            type: 'add_rules';
+            /**
+             * allow grants permission for matching calls.
+             */
+            behavior: 'allow';
+            /**
+             * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+             */
+            destination: 'agent' | 'session';
+            /**
+             * The complete set of rules from one offered suggestion, without changes.
+             */
+            rules: Array<{
+                /**
+                 * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+                 */
+                tool_name: string;
+                /**
+                 * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+                 */
+                rule_content: string;
+            }>;
+        }>;
     };
 } | {
     /**
@@ -6360,6 +6465,10 @@ export type AgentSseEvent = ({
      * Decoded JSON payload of this frame; its shape is selected by the event name.
      */
     data?: {
+        /**
+         * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+         */
+        full_access_available?: boolean;
         /**
          * Unique identifier for this event.
          */
@@ -6438,6 +6547,44 @@ export type AgentSseEvent = ({
          * Praxis extension (MCP Apps, SEP-1865): present when `source` is `codemode`; the id of the codemode tool use whose program made this call. Absent otherwise.
          */
         parent_tool_use_id?: string;
+        /**
+         * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+         */
+        user_once?: true;
+        /**
+         * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+         */
+        guarded_rule?: string;
+        /**
+         * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+         */
+        permission_suggestions?: Array<{
+            /**
+             * add_rules adds the offered allow rules.
+             */
+            type: 'add_rules';
+            /**
+             * allow grants permission for matching calls.
+             */
+            behavior: 'allow';
+            /**
+             * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+             */
+            destination: 'agent' | 'session';
+            /**
+             * The complete set of rules from one offered suggestion, without changes.
+             */
+            rules: Array<{
+                /**
+                 * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+                 */
+                tool_name: string;
+                /**
+                 * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+                 */
+                rule_content: string;
+            }>;
+        }>;
         /**
          * Human-readable tool name from MCP 2025-06-18 Tool.title, falling back to annotations.title. Trimmed and truncated to 200 characters; omitted when blank or absent. Present only for model-initiated calls on /agent/v1; use name when absent.
          */
@@ -8579,7 +8726,7 @@ export type AutomationAutomationProblemDetails = {
     title: string;
     status: number;
     detail: string;
-    code: 'METHOD_NOT_ALLOWED' | 'TRIGGER_NOT_FOUND' | 'SCHEDULE_INVALID' | 'TIMEZONE_INVALID' | 'INTERVAL_TOO_SHORT' | 'TRIGGER_MANAGED' | 'TRIGGER_PAUSED' | 'TRIGGER_LIMIT' | 'ACTION_NOT_FOUND' | 'TARGET_NOT_FOUND' | 'VERSION_NOT_FOUND' | 'RUN_NOT_FOUND' | 'WAIT_NOT_FOUND' | 'NAME_TAKEN' | 'VERSION_EXISTS' | 'RUN_INVALID_STATE' | 'IDEMPOTENCY_IN_FLIGHT' | 'TARGET_ARCHIVED' | 'OPERATION_NOT_SUPPORTED' | 'WAIT_ALREADY_RESOLVED' | 'WAIT_EXPIRED' | 'PRECONDITION_FAILED' | 'PAYLOAD_TOO_LARGE' | 'SCHEMA_INCOMPATIBLE' | 'IDEMPOTENCY_KEY_MISMATCH' | 'NO_MATCHING_VERSION' | 'CYCLE_DETECTED' | 'DEFINITION_IDENTITY_MISMATCH' | 'DEFINITION_INVALID' | 'INPUT_INVALID' | 'TAG_INVALID' | 'TAG_REQUIRED' | 'INVALID_PARAMS' | 'NAMESPACE_FORBIDDEN' | 'OWNER_SUSPENDED' | 'RATE_LIMITED' | 'QUOTA_EXCEEDED' | 'SCRIPT_ERROR' | 'OUTPUT_INVALID' | 'CPU_LIMIT_EXCEEDED' | 'NOT_IMPLEMENTED';
+    code: 'METHOD_NOT_ALLOWED' | 'TRIGGER_NOT_FOUND' | 'SCHEDULE_INVALID' | 'TIMEZONE_INVALID' | 'INTERVAL_TOO_SHORT' | 'TRIGGER_MANAGED' | 'TRIGGER_PAUSED' | 'TRIGGER_LIMIT' | 'ACTION_NOT_FOUND' | 'TARGET_NOT_FOUND' | 'VERSION_NOT_FOUND' | 'RUN_NOT_FOUND' | 'WAIT_NOT_FOUND' | 'NAME_TAKEN' | 'VERSION_EXISTS' | 'RUN_INVALID_STATE' | 'IDEMPOTENCY_IN_FLIGHT' | 'TARGET_ARCHIVED' | 'OPERATION_NOT_SUPPORTED' | 'WAIT_ALREADY_RESOLVED' | 'WAIT_EXPIRED' | 'PRECONDITION_FAILED' | 'PAYLOAD_TOO_LARGE' | 'SCHEMA_INCOMPATIBLE' | 'IDEMPOTENCY_KEY_MISMATCH' | 'NO_MATCHING_VERSION' | 'CYCLE_DETECTED' | 'DEFINITION_IDENTITY_MISMATCH' | 'DEFINITION_INVALID' | 'INPUT_INVALID' | 'TAG_INVALID' | 'TAG_REQUIRED' | 'INVALID_PARAMS' | 'NAMESPACE_FORBIDDEN' | 'OWNER_SUSPENDED' | 'RATE_LIMITED' | 'QUOTA_EXCEEDED' | 'SCRIPT_ERROR' | 'OUTPUT_INVALID' | 'CPU_LIMIT_EXCEEDED' | 'NOT_IMPLEMENTED' | 'HUMAN_TASK_NOT_FOUND' | 'TASK_CLOSED' | 'ALREADY_RESPONDED' | 'NOT_ASSIGNED' | 'SELF_APPROVAL' | 'AGENT_NOT_ALLOWED' | 'COMMENT_REQUIRED' | 'INVALID_ACTION' | 'INVALID_VALUES' | 'HUMAN_TASK_CANCELLED';
     errors: Array<AutomationDiagnostic>;
     issues: Array<AutomationCompatIssue>;
     hint: string | null;
@@ -9451,7 +9598,7 @@ export type AutomationRun = {
      */
     attach: null | 'wait' | 'detach';
     /**
-     * Deadline of the run (RFC 3339 UTC): creation time plus deadline_seconds (scripts default to and are capped at 300 seconds; workflows default to 86400 and are capped at 604800), and an awaited child ends at least 1 second before its parent's deadline.
+     * Deadline of the run (RFC 3339 UTC): creation time plus deadline_seconds (scripts default to and are capped at 300 seconds; workflows default to 86400 and are capped at 2592000 (30 days)), and an awaited child ends at least 1 second before its parent's deadline.
      */
     deadline_at: string;
     /**
@@ -9645,7 +9792,7 @@ export type AutomationExpandedRun = {
      */
     attach: null | 'wait' | 'detach';
     /**
-     * Deadline of the run (RFC 3339 UTC): creation time plus deadline_seconds (scripts default to and are capped at 300 seconds; workflows default to 86400 and are capped at 604800), and an awaited child ends at least 1 second before its parent's deadline.
+     * Deadline of the run (RFC 3339 UTC): creation time plus deadline_seconds (scripts default to and are capped at 300 seconds; workflows default to 86400 and are capped at 2592000 (30 days)), and an awaited child ends at least 1 second before its parent's deadline.
      */
     deadline_at: string;
     /**
@@ -10596,6 +10743,183 @@ export type AutomationTriggerPreview = {
      */
     next_fire_times: Array<string>;
 };
+export type AutomationHumanTaskStatus = 'open' | 'completed' | 'expired' | 'cancelled';
+export type AutomationHumanTask = {
+    /**
+     * Human task ID (htask_), derived deterministically from the run and step; use it with retrieve, respond, cancel and delegate. The Console page is /automation/tasks/{id}.
+     */
+    id: string;
+    /**
+     * ID of the organization that owns the task.
+     */
+    owner: string;
+    /**
+     * ID of the workflow run (run_) that opened the task; the run continues once the task closes.
+     */
+    run_id: string;
+    /**
+     * The published workflow of the run; null for an ad hoc run.
+     */
+    workflow: {
+        /**
+         * Workflow namespace.
+         */
+        namespace: string;
+        /**
+         * Workflow name.
+         */
+        name: string;
+    } | null;
+    /**
+     * JSON Pointer of the approval step in the workflow source, for example /do/1/approveRefund.
+     */
+    task_reference: string;
+    /**
+     * ID of the run's wait (wait_htask_); it closes only through respond, never through the run wait completion endpoint.
+     */
+    wait_id: string;
+    /**
+     * Task kind; currently only approval.
+     */
+    kind: 'approval';
+    /**
+     * Approval title, at most 200 characters.
+     */
+    title: string;
+    /**
+     * Markdown details for the assignees, up to 16 KiB; empty string when not given.
+     */
+    body: string;
+    /**
+     * JSON context the workflow attached (for example the order), up to 32 KiB; null when not given.
+     */
+    context: AutomationJsonValue;
+    /**
+     * The 1–6 buttons an assignee chooses from; defaults to approve and reject.
+     */
+    actions: Array<AutomationHumanTaskAction>;
+    /**
+     * The form an assignee fills in (a JSON Schema subset - an object with at most 30 string, number, integer, boolean or enum fields); null when there is no form.
+     */
+    form_schema: AutomationJsonObject | null;
+    /**
+     * The assignees.
+     */
+    assignees: {
+        /**
+         * Assignee user IDs, 1–20; sequential mode follows this order. Delegation replaces an entry in place.
+         */
+        users: Array<string>;
+        /**
+         * Group assignment; not supported yet, always an empty array.
+         */
+        groups: Array<string>;
+    };
+    /**
+     * Decision rule. any: the first response decides. all: everyone must respond and any rejection rejects at once. quorum: quorum approvals approve, and it rejects once that many approvals are no longer possible. sequential: assignees respond in users order; any rejection rejects at once and the last approval approves.
+     */
+    mode: 'any' | 'all' | 'quorum' | 'sequential';
+    /**
+     * Number of approvals required in quorum mode; null in other modes.
+     */
+    quorum: number | null;
+    /**
+     * When true, the person who started the run may respond to their own request; false by default.
+     */
+    allow_self_approval: boolean;
+    /**
+     * When true, an agent (agent session or run token) may respond; false by default.
+     */
+    allow_agent_decision: boolean;
+    /**
+     * The subject that started the run.
+     */
+    initiator: {
+        /**
+         * Initiator type: user, api_key, agent, run (a parent run) or trigger.
+         */
+        type: 'user' | 'api_key' | 'agent' | 'run' | 'trigger';
+        /**
+         * Initiator ID.
+         */
+        id: string;
+        /**
+         * The user behind the initiator (the owner of an API key or trigger), null when unknown; the self-approval rule uses it.
+         */
+        user_id: string | null;
+    };
+    /**
+     * Due time (RFC 3339); defaults to 3 days after creation, at most 30 days and never later than the run's deadline. on_timeout applies when it passes.
+     */
+    due_at: string;
+    /**
+     * What happens at due_at.
+     */
+    on_timeout: {
+        /**
+         * reject: the workflow receives decision timeout:reject. approve: it receives timeout:approve. fault (default): the step raises a timeout error that try/catch can catch.
+         */
+        action: 'reject' | 'approve' | 'fault';
+    };
+    /**
+     * Reminder intervals (ISO 8601 durations, up to 3); stored, not yet sent in this version.
+     */
+    remind: Array<string>;
+    /**
+     * Notification channels: console or email; stored, delivery is not wired yet.
+     */
+    channels: Array<'console' | 'email'>;
+    /**
+     * An agent's proposal (any JSON up to 32 KiB) for the assignees to consider; null when not given.
+     */
+    proposal: AutomationJsonValue;
+    /**
+     * open: awaiting responses. completed: decided. expired: due_at passed. cancelled: withdrawn, including automatically when the run ended.
+     */
+    status: AutomationHumanTaskStatus;
+    /**
+     * Responses submitted so far, in order.
+     */
+    responses: Array<AutomationHumanTaskResponse>;
+    /**
+     * The decision, which is also the workflow step's output; null while open, and after a fault timeout or cancellation.
+     */
+    outcome: AutomationHumanTaskOutcome | null;
+    /**
+     * Creation time (RFC 3339).
+     */
+    created_at: string;
+    /**
+     * Last change time (RFC 3339).
+     */
+    updated_at: string;
+};
+export type AutomationHumanTaskRespondInput = {
+    /**
+     * The chosen action ID from the task's actions, for example approve.
+     */
+    action_id: string;
+    /**
+     * Form values matching the task's form_schema; omit or pass {} when there is no form.
+     */
+    values?: AutomationJsonObject;
+    /**
+     * Comment of at most 4000 characters; required when the action has require_comment true.
+     */
+    comment?: string;
+};
+export type AutomationHumanTaskCancelInput = {
+    /**
+     * Optional cancellation reason, at most 500 characters.
+     */
+    reason?: string;
+};
+export type AutomationHumanTaskDelegateInput = {
+    /**
+     * User ID taking over; cannot already be an assignee, nor the initiator unless self-approval is allowed.
+     */
+    to_user: string;
+};
 export type DatabaseCreateDatabaseInput = {
     /**
      * Display name for the database: 1–64 visible characters after trimming; control characters are rejected. It is not an identifier, so later calls still use the returned id.
@@ -11541,7 +11865,7 @@ export type MediaLibrary = {
 };
 export type MediaMediaError = {
     error: {
-        code: 'LIBRARY_NOT_FOUND' | 'ASSET_NOT_FOUND' | 'JOB_NOT_FOUND' | 'UNDERSTANDING_NOT_FOUND' | 'LIBRARY_INVALID_STATE' | 'INVALID_PARAMS' | 'INVALID_EXPRESSION' | 'UNSUPPORTED' | 'NOT_IMPLEMENTED' | 'FILE_TOO_LARGE' | 'FILE_EMPTY' | 'UNSUPPORTED_MEDIA' | 'FETCH_FAILED' | 'LIMIT_EXCEEDED' | 'CHUNK_INVALID' | 'RATE_LIMITED' | 'CAPACITY' | 'UPSTREAM_FAILED';
+        code: 'LIBRARY_NOT_FOUND' | 'ASSET_NOT_FOUND' | 'JOB_NOT_FOUND' | 'UNDERSTANDING_NOT_FOUND' | 'LIBRARY_INVALID_STATE' | 'INVALID_PARAMS' | 'INVALID_EXPRESSION' | 'UNSUPPORTED' | 'NOT_IMPLEMENTED' | 'FILE_TOO_LARGE' | 'FILE_EMPTY' | 'UNSUPPORTED_MEDIA' | 'FETCH_FAILED' | 'LIMIT_EXCEEDED' | 'CHUNK_INVALID' | 'RATE_LIMITED' | 'CAPACITY' | 'UPSTREAM_FAILED' | 'BINDING_READ_ONLY';
         message: string;
         details: string | null;
     };
@@ -11674,6 +11998,9 @@ export type MediaAsset = {
      * Source audio or video duration in seconds, when known.
      */
     duration?: number;
+    /**
+     * Number of pages recorded for the asset; omitted when no page count is stored.
+     */
     pages?: number;
     /**
      * True for audio-only media, which uses resource_type video.
@@ -11714,6 +12041,9 @@ export type MediaAsset = {
      * False because this response represents stored source content.
      */
     placeholder: false;
+    /**
+     * True when overwrite is false and the public_id already exists; the existing resource is returned.
+     */
     existing?: boolean;
     /**
      * Progress of understanding and embedding tasks for the asset.
@@ -18799,7 +19129,7 @@ export type AgentManaged249 = {
      */
     input_tokens?: number;
     /**
-     * A monetary amount in a specific currency.
+     * Session total list-price cost in USD as a decimal string with exactly 6 decimals. Includes models, runtime and all other charged products attributed to this session; child-thread model cost is already included. The budget reads the same total. In-flight work may finish after the limit is reached.
      */
     list_cost?: AgentManaged77;
     /**
@@ -19127,6 +19457,18 @@ export type AgentSseData = {
      */
     stopped: boolean;
 } | {
+    /**
+     * Monotone permission-mode version, incremented once per mode update.
+     */
+    permission_mode_version?: number;
+    /**
+     * The permission mode before this change, or null when none was selected.
+     */
+    previous_permission_mode?: string | null;
+    /**
+     * The new native session permission mode; null restores configured tool policies.
+     */
+    permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
     /**
      * Unique identifier for this event.
      */
@@ -19254,6 +19596,10 @@ export type AgentSseData = {
      */
     type: 'span.model_request_end';
 } | {
+    /**
+     * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+     */
+    full_access_available?: boolean;
     /**
      * Unique identifier for this event.
      */
@@ -19296,6 +19642,44 @@ export type AgentSseData = {
      * Run that produced this event; null when no run identity was recorded.
      */
     run_id: string | null;
+    /**
+     * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+     */
+    user_once?: true;
+    /**
+     * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+     */
+    guarded_rule?: string;
+    /**
+     * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+     */
+    permission_suggestions?: Array<{
+        /**
+         * add_rules adds the offered allow rules.
+         */
+        type: 'add_rules';
+        /**
+         * allow grants permission for matching calls.
+         */
+        behavior: 'allow';
+        /**
+         * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+         */
+        destination: 'agent' | 'session';
+        /**
+         * The complete set of rules from one offered suggestion, without changes.
+         */
+        rules: Array<{
+            /**
+             * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+             */
+            tool_name: string;
+            /**
+             * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+             */
+            rule_content: string;
+        }>;
+    }>;
 } | {
     /**
      * Unique identifier for this event.
@@ -19326,6 +19710,10 @@ export type AgentSseData = {
      */
     run_id: string | null;
 } | {
+    /**
+     * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+     */
+    full_access_available?: boolean;
     /**
      * Unique identifier for this event.
      */
@@ -19404,6 +19792,44 @@ export type AgentSseData = {
      * Praxis extension (MCP Apps, SEP-1865): present when `source` is `codemode`; the id of the codemode tool use whose program made this call. Absent otherwise.
      */
     parent_tool_use_id?: string;
+    /**
+     * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+     */
+    user_once?: true;
+    /**
+     * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+     */
+    guarded_rule?: string;
+    /**
+     * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+     */
+    permission_suggestions?: Array<{
+        /**
+         * add_rules adds the offered allow rules.
+         */
+        type: 'add_rules';
+        /**
+         * allow grants permission for matching calls.
+         */
+        behavior: 'allow';
+        /**
+         * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+         */
+        destination: 'agent' | 'session';
+        /**
+         * The complete set of rules from one offered suggestion, without changes.
+         */
+        rules: Array<{
+            /**
+             * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+             */
+            tool_name: string;
+            /**
+             * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+             */
+            rule_content: string;
+        }>;
+    }>;
     /**
      * Human-readable tool name from MCP 2025-06-18 Tool.title, falling back to annotations.title. Trimmed and truncated to 200 characters; omitted when blank or absent. Present only for model-initiated calls on /agent/v1; use name when absent.
      */
@@ -21083,6 +21509,72 @@ export type AutomationAttributedUsage = {
      */
     pending_events: number;
 };
+export type AutomationHumanTaskAction = {
+    /**
+     * Action ID to pass as action_id to respond; starts with a lowercase letter, at most 32 characters.
+     */
+    id: string;
+    /**
+     * Button label.
+     */
+    label: string;
+    /**
+     * primary: the main button. danger: a destructive button, which is the rejection in all, quorum and sequential modes. default: a plain button.
+     */
+    style: 'primary' | 'danger' | 'default';
+    /**
+     * When true, choosing this action requires a comment.
+     */
+    require_comment: boolean;
+};
+export type AutomationHumanTaskResponse = {
+    /**
+     * Who responded.
+     */
+    actor: AutomationHumanTaskActor;
+    /**
+     * The chosen action ID.
+     */
+    action_id: string;
+    /**
+     * Submitted form values; an empty object when there is no form.
+     */
+    values: AutomationJsonObject;
+    /**
+     * Comment; null when none.
+     */
+    comment: string | null;
+    /**
+     * Where it came from: console, api (the public API) or agent.
+     */
+    via: 'console' | 'api' | 'agent';
+    /**
+     * Submission time (RFC 3339).
+     */
+    at: string;
+};
+export type AutomationHumanTaskOutcome = {
+    /**
+     * The deciding action ID, or timeout:reject / timeout:approve when on_timeout decided.
+     */
+    decision: string;
+    /**
+     * Form values of the deciding response; an empty object on timeout.
+     */
+    values: AutomationJsonObject;
+    /**
+     * Comment of the deciding response; null on timeout.
+     */
+    comment: string | null;
+    /**
+     * Who decided; null on timeout.
+     */
+    decided_by: AutomationHumanTaskActor | null;
+    /**
+     * All responses at the time the task closed.
+     */
+    responses: Array<AutomationHumanTaskResponse>;
+};
 export type DatabaseField = {
     /**
      * Field identifier, prefixed fld_. Stable across renames; accepted wherever a field path parameter takes an id or name.
@@ -21595,6 +22087,9 @@ export type MediaCloudinaryResource = {
      * Source audio or video duration in seconds, when known.
      */
     duration?: number;
+    /**
+     * Number of pages recorded for the asset; omitted when no page count is stored.
+     */
     pages?: number;
     /**
      * True for audio-only media, which uses resource_type video.
@@ -21732,6 +22227,9 @@ export type MediaUnderstanding = {
      * Producer model identifier; a failure may use the configured model when no model response is available.
      */
     producer: string;
+    /**
+     * Version of the producer that generated this understanding result.
+     */
     producer_version: string;
     /**
      * Source-media time range for a frame or transcript segment; null for results without a segment.
@@ -21749,6 +22247,9 @@ export type MediaUnderstanding = {
      * Structured producer output, such as recognized labels or frame details; null when absent.
      */
     data: unknown | null;
+    /**
+     * Confidence value recorded by the producer; null when no confidence value is recorded.
+     */
     confidence: number | null;
     /**
      * Failure code and message, or null for a successful result.
@@ -21832,6 +22333,9 @@ export type MediaSearchAsset = {
      * Source audio or video duration in seconds, when known.
      */
     duration?: number;
+    /**
+     * Number of pages recorded for the asset; omitted when no page count is stored.
+     */
     pages?: number;
     /**
      * True for audio-only media, which uses resource_type video.
@@ -21872,6 +22376,9 @@ export type MediaSearchAsset = {
      * False because this response represents stored source content.
      */
     placeholder: false;
+    /**
+     * True when overwrite is false and the public_id already exists; the existing resource is returned.
+     */
     existing?: boolean;
     /**
      * Progress of understanding and embedding tasks for the asset.
@@ -21932,7 +22439,7 @@ export type MediaSemanticHit = {
  * Identifier returned when a batch job is created.
  */
 export type MediaJobId = string;
-export type MediaMediaErrorCode = 'LIBRARY_NOT_FOUND' | 'ASSET_NOT_FOUND' | 'JOB_NOT_FOUND' | 'UNDERSTANDING_NOT_FOUND' | 'LIBRARY_INVALID_STATE' | 'INVALID_PARAMS' | 'INVALID_EXPRESSION' | 'UNSUPPORTED' | 'NOT_IMPLEMENTED' | 'FILE_TOO_LARGE' | 'FILE_EMPTY' | 'UNSUPPORTED_MEDIA' | 'FETCH_FAILED' | 'LIMIT_EXCEEDED' | 'CHUNK_INVALID' | 'RATE_LIMITED' | 'CAPACITY' | 'UPSTREAM_FAILED';
+export type MediaMediaErrorCode = 'LIBRARY_NOT_FOUND' | 'ASSET_NOT_FOUND' | 'JOB_NOT_FOUND' | 'UNDERSTANDING_NOT_FOUND' | 'LIBRARY_INVALID_STATE' | 'INVALID_PARAMS' | 'INVALID_EXPRESSION' | 'UNSUPPORTED' | 'NOT_IMPLEMENTED' | 'FILE_TOO_LARGE' | 'FILE_EMPTY' | 'UNSUPPORTED_MEDIA' | 'FETCH_FAILED' | 'LIMIT_EXCEEDED' | 'CHUNK_INVALID' | 'RATE_LIMITED' | 'CAPACITY' | 'UPSTREAM_FAILED' | 'BINDING_READ_ONLY';
 /**
  * A recorded library event with a monotonically increasing sequence within that library.
  */
@@ -25946,6 +26453,20 @@ export type AgentManaged141 = {
      */
     type?: 'packages';
 };
+export type AutomationHumanTaskActor = {
+    /**
+     * The responder's user ID (for an agent, the user it acts for).
+     */
+    id: string;
+    /**
+     * human: the person responded. agent: an agent responded on their behalf.
+     */
+    kind: 'human' | 'agent';
+    /**
+     * Display name; this service does not resolve names, so it is null and the Console resolves it from the user ID.
+     */
+    display_name: string | null;
+};
 export type KnowledgeStaticChunking = {
     /**
      * static selects explicit chunk-size and overlap settings.
@@ -26002,6 +26523,9 @@ export type KnowledgeSearchExplain = {
      */
     matched_terms: Array<string>;
 };
+/**
+ * Aggregate processing state across the asset processing tasks.
+ */
 export type MediaProcessingState = 'pending' | 'processing' | 'ready' | 'partial' | 'failed';
 /**
  * Task state: pending awaits execution; running is executing; ready succeeded; failed terminated unsuccessfully; unsupported cannot process this input; skipped was disabled or does not apply.
@@ -28076,7 +28600,7 @@ export type UnarchiveAgentResponses = {
             };
         };
         /**
-         * Resolved coordinator topology with a concrete agent roster.
+         * Coordinator roster. A bare string agent id is equivalent to {type: "agent", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: "self"} refers to this agent. Specify a concrete version to pin it explicitly.
          */
         multiagent: null | {
             /**
@@ -28600,12 +29124,15 @@ export type UnarchiveAgentResponses = {
          */
         updated_at: string;
         /**
-         * The agent's current version. Starts at 1 and increments when the agent is
-         * modified.
+         * Version of this returned configuration. Default retrieve returns the effective version; an explicit version query or a version-history item returns that saved version.
          */
         version: number;
         /**
-         * Version used by new sessions and newly issued embed tokens when no version is specified. Starts at 1; saving with apply false leaves it unchanged. Existing sessions and tokens keep their version.
+         * Newest saved version number, including an unapplied save. Returned by default retrieve, update and apply; use it for optimistic concurrency when updating.
+         */
+        latest_version?: number;
+        /**
+         * Agent-level currently effective version used by new sessions and newly issued embed tokens. This same value appears on every history item; it is not that item's version. Saving with apply false leaves it unchanged. Existing sessions and tokens retain their version.
          */
         active_version: number;
         /**
@@ -35432,7 +35959,7 @@ export type ForkSessionResponses = {
              */
             input_tokens?: number;
             /**
-             * A monetary amount in a specific currency.
+             * Session total list-price cost in USD as a decimal string with exactly 6 decimals. Includes models, runtime and all other charged products attributed to this session; child-thread model cost is already included. The budget reads the same total. In-flight work may finish after the limit is reached.
              */
             list_cost?: null | {
                 /**
@@ -35466,18 +35993,15 @@ export type ForkSessionResponses = {
                 web_search_requests?: number;
             };
             /**
-             * Praxis extension: priced runtime of this session (the time it was running), billed separately from list_cost and not counted against the budget. amount is in US dollars as a decimal string with exactly 6 decimals, e.g. "0.000280". Each thread's runtime is reported on that thread. /agent/v1 only.
+             * USD list-price cost by product, as decimal strings with exactly 6 decimals. Values sum to list_cost.amount. router.llm is the larger of the live model meter and charged model facts; all other products use charged facts only.
              */
-            runtime_cost?: {
-                /**
-                 * Runtime cost in US dollars, decimal string with exactly 6 decimals.
-                 */
-                amount: string;
-                /**
-                 * Always USD.
-                 */
-                currency: 'USD';
+            cost_by_product?: {
+                [key: string]: string;
             };
+            /**
+             * Child-thread model cost in integer micro-USD, already included in list_cost. This is a subset, not an additional charge; it excludes child-thread runtime.
+             */
+            subagent_cost_micro_usd?: number;
         };
         /**
          * Vault IDs attached to the session at creation. Empty when no vaults were
@@ -36193,7 +36717,7 @@ export type BrowserListSessionsData = {
 };
 export type BrowserListSessionsErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36201,11 +36725,15 @@ export type BrowserListSessionsErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36217,13 +36745,21 @@ export type BrowserListSessionsErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserListSessionsError = BrowserListSessionsErrors[keyof BrowserListSessionsErrors];
 export type BrowserListSessionsResponses = {
@@ -36250,7 +36786,7 @@ export type BrowserCreateSessionData = {
 };
 export type BrowserCreateSessionErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36258,11 +36794,15 @@ export type BrowserCreateSessionErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36274,13 +36814,21 @@ export type BrowserCreateSessionErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserCreateSessionError = BrowserCreateSessionErrors[keyof BrowserCreateSessionErrors];
 export type BrowserCreateSessionResponses = {
@@ -36308,7 +36856,7 @@ export type BrowserGetSessionData = {
 };
 export type BrowserGetSessionErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36316,11 +36864,15 @@ export type BrowserGetSessionErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36332,13 +36884,21 @@ export type BrowserGetSessionErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserGetSessionError = BrowserGetSessionErrors[keyof BrowserGetSessionErrors];
 export type BrowserGetSessionResponses = {
@@ -36366,7 +36926,7 @@ export type BrowserCloseSessionData = {
 };
 export type BrowserCloseSessionErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36374,11 +36934,15 @@ export type BrowserCloseSessionErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36390,13 +36954,21 @@ export type BrowserCloseSessionErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserCloseSessionError = BrowserCloseSessionErrors[keyof BrowserCloseSessionErrors];
 export type BrowserCloseSessionResponses = {
@@ -36419,7 +36991,7 @@ export type BrowserGetDebugData = {
 };
 export type BrowserGetDebugErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36427,11 +36999,15 @@ export type BrowserGetDebugErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36443,13 +37019,21 @@ export type BrowserGetDebugErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserGetDebugError = BrowserGetDebugErrors[keyof BrowserGetDebugErrors];
 export type BrowserGetDebugResponses = {
@@ -36485,7 +37069,7 @@ export type BrowserListEventsData = {
 };
 export type BrowserListEventsErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36493,11 +37077,15 @@ export type BrowserListEventsErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36509,13 +37097,21 @@ export type BrowserListEventsErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserListEventsError = BrowserListEventsErrors[keyof BrowserListEventsErrors];
 export type BrowserListEventsResponses = {
@@ -36556,7 +37152,7 @@ export type BrowserRequestHandoffData = {
 };
 export type BrowserRequestHandoffErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36564,11 +37160,15 @@ export type BrowserRequestHandoffErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36580,20 +37180,28 @@ export type BrowserRequestHandoffErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserRequestHandoffError = BrowserRequestHandoffErrors[keyof BrowserRequestHandoffErrors];
 export type BrowserRequestHandoffResponses = {
     /**
      * 请求成功。
      */
-    200: BrowserEventRecord;
+    201: BrowserEventRecord;
 };
 export type BrowserRequestHandoffResponse = BrowserRequestHandoffResponses[keyof BrowserRequestHandoffResponses];
 export type BrowserCompleteHandoffData = {
@@ -36609,7 +37217,7 @@ export type BrowserCompleteHandoffData = {
 };
 export type BrowserCompleteHandoffErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36617,11 +37225,15 @@ export type BrowserCompleteHandoffErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36633,13 +37245,21 @@ export type BrowserCompleteHandoffErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserCompleteHandoffError = BrowserCompleteHandoffErrors[keyof BrowserCompleteHandoffErrors];
 export type BrowserCompleteHandoffResponses = {
@@ -36667,7 +37287,7 @@ export type BrowserViewerHeartbeatData = {
 };
 export type BrowserViewerHeartbeatErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36675,11 +37295,15 @@ export type BrowserViewerHeartbeatErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36691,13 +37315,21 @@ export type BrowserViewerHeartbeatErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserViewerHeartbeatError = BrowserViewerHeartbeatErrors[keyof BrowserViewerHeartbeatErrors];
 export type BrowserViewerHeartbeatResponses = {
@@ -36729,7 +37361,7 @@ export type BrowserListContextsData = {
 };
 export type BrowserListContextsErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36737,11 +37369,15 @@ export type BrowserListContextsErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36753,13 +37389,21 @@ export type BrowserListContextsErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserListContextsError = BrowserListContextsErrors[keyof BrowserListContextsErrors];
 export type BrowserListContextsResponses = {
@@ -36801,7 +37445,7 @@ export type BrowserCreateContextData = {
 };
 export type BrowserCreateContextErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36809,11 +37453,15 @@ export type BrowserCreateContextErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36825,13 +37473,21 @@ export type BrowserCreateContextErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserCreateContextError = BrowserCreateContextErrors[keyof BrowserCreateContextErrors];
 export type BrowserCreateContextResponses = {
@@ -36854,7 +37510,7 @@ export type BrowserDeleteContextData = {
 };
 export type BrowserDeleteContextErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36862,11 +37518,15 @@ export type BrowserDeleteContextErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36878,13 +37538,21 @@ export type BrowserDeleteContextErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserDeleteContextError = BrowserDeleteContextErrors[keyof BrowserDeleteContextErrors];
 export type BrowserDeleteContextResponses = {
@@ -36912,7 +37580,7 @@ export type BrowserGetContextData = {
 };
 export type BrowserGetContextErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36920,11 +37588,15 @@ export type BrowserGetContextErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -36936,13 +37608,21 @@ export type BrowserGetContextErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserGetContextError = BrowserGetContextErrors[keyof BrowserGetContextErrors];
 export type BrowserGetContextResponses = {
@@ -36976,7 +37656,7 @@ export type BrowserUpdateContextData = {
 };
 export type BrowserUpdateContextErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -36984,11 +37664,15 @@ export type BrowserUpdateContextErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -37000,13 +37684,21 @@ export type BrowserUpdateContextErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserUpdateContextError = BrowserUpdateContextErrors[keyof BrowserUpdateContextErrors];
 export type BrowserUpdateContextResponses = {
@@ -37061,7 +37753,7 @@ export type BrowserConnectData = {
 };
 export type BrowserConnectErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -37069,11 +37761,15 @@ export type BrowserConnectErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -37085,13 +37781,21 @@ export type BrowserConnectErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserConnectError = BrowserConnectErrors[keyof BrowserConnectErrors];
 export type BrowserLiveViewData = {
@@ -37116,7 +37820,7 @@ export type BrowserLiveViewData = {
 };
 export type BrowserLiveViewErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -37124,11 +37828,15 @@ export type BrowserLiveViewErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -37140,13 +37848,21 @@ export type BrowserLiveViewErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserLiveViewError = BrowserLiveViewErrors[keyof BrowserLiveViewErrors];
 export type BrowserStreamSessionData = {
@@ -37162,7 +37878,7 @@ export type BrowserStreamSessionData = {
 };
 export type BrowserStreamSessionErrors = {
     /**
-     * INVALID_PARAMS
+     * INVALID_PARAMS / INVALID_FILTER / INVALID_PAGE_TOKEN
      */
     400: BrowserError;
     /**
@@ -37170,11 +37886,15 @@ export type BrowserStreamSessionErrors = {
      */
     401: BrowserError;
     /**
-     * INSUFFICIENT_BALANCE
+     * INSUFFICIENT_BALANCE / QUOTA_EXHAUSTED
      */
     402: BrowserError;
     /**
-     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND
+     * PERMISSION_DENIED / ACCOUNT_SUSPENDED
+     */
+    403: BrowserError;
+    /**
+     * SESSION_NOT_FOUND / CONTEXT_NOT_FOUND / PARENT_NOT_FOUND
      */
     404: BrowserError;
     /**
@@ -37186,13 +37906,21 @@ export type BrowserStreamSessionErrors = {
      */
     429: BrowserError;
     /**
-     * PROVIDER_UNSUPPORTED
+     * INTERNAL
+     */
+    500: BrowserError;
+    /**
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
     /**
      * PROVIDER_FAILED
      */
     502: BrowserError;
+    /**
+     * SERVICE_UNAVAILABLE
+     */
+    503: BrowserError;
 };
 export type BrowserStreamSessionError = BrowserStreamSessionErrors[keyof BrowserStreamSessionErrors];
 export type BrowserStreamSessionResponses = {
@@ -37210,7 +37938,7 @@ export type BrowserSeleniumUnsupportedData = {
 };
 export type BrowserSeleniumUnsupportedErrors = {
     /**
-     * PROVIDER_UNSUPPORTED
+     * NOT_IMPLEMENTED / PROVIDER_UNSUPPORTED
      */
     501: BrowserError;
 };
@@ -49904,6 +50632,10 @@ export type SessionsEventsListResponses = {
              */
             message_id?: string;
         } | {
+            /**
+             * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+             */
+            full_access_available?: boolean;
             /**
              * Unique identifier for this event.
              */
@@ -49982,6 +50714,44 @@ export type SessionsEventsListResponses = {
              * Praxis extension (MCP Apps, SEP-1865): present when `source` is `codemode`; the id of the codemode tool use whose program made this call. Absent otherwise.
              */
             parent_tool_use_id?: string;
+            /**
+             * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+             */
+            user_once?: true;
+            /**
+             * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+             */
+            guarded_rule?: string;
+            /**
+             * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+             */
+            permission_suggestions?: Array<{
+                /**
+                 * add_rules adds the offered allow rules.
+                 */
+                type: 'add_rules';
+                /**
+                 * allow grants permission for matching calls.
+                 */
+                behavior: 'allow';
+                /**
+                 * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+                 */
+                destination: 'agent' | 'session';
+                /**
+                 * The complete set of rules from one offered suggestion, without changes.
+                 */
+                rules: Array<{
+                    /**
+                     * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+                     */
+                    tool_name: string;
+                    /**
+                     * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+                     */
+                    rule_content: string;
+                }>;
+            }>;
             /**
              * Human-readable tool name from MCP 2025-06-18 Tool.title, falling back to annotations.title. Trimmed and truncated to 200 characters; omitted when blank or absent. Present only for model-initiated calls on /agent/v1; use name when absent.
              */
@@ -50036,6 +50806,10 @@ export type SessionsEventsListResponses = {
              */
             source?: 'app' | 'codemode';
         } | {
+            /**
+             * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+             */
+            full_access_available?: boolean;
             /**
              * Unique identifier for this event.
              */
@@ -50078,6 +50852,44 @@ export type SessionsEventsListResponses = {
              * Run that produced this event; null when no run identity was recorded.
              */
             run_id: string | null;
+            /**
+             * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+             */
+            user_once?: true;
+            /**
+             * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+             */
+            guarded_rule?: string;
+            /**
+             * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+             */
+            permission_suggestions?: Array<{
+                /**
+                 * add_rules adds the offered allow rules.
+                 */
+                type: 'add_rules';
+                /**
+                 * allow grants permission for matching calls.
+                 */
+                behavior: 'allow';
+                /**
+                 * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+                 */
+                destination: 'agent' | 'session';
+                /**
+                 * The complete set of rules from one offered suggestion, without changes.
+                 */
+                rules: Array<{
+                    /**
+                     * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+                     */
+                    tool_name: string;
+                    /**
+                     * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+                     */
+                    rule_content: string;
+                }>;
+            }>;
         } | {
             /**
              * Unique identifier for this event.
@@ -50146,6 +50958,18 @@ export type SessionsEventsListResponses = {
              */
             run_id: string | null;
         } | AgentManaged230 | AgentManaged231 | AgentManaged232 | AgentManaged233 | AgentManaged235 | AgentManaged236 | AgentManaged237 | AgentManaged238 | AgentManaged239 | AgentManaged240 | AgentManaged241 | AgentManaged242 | AgentManaged243 | AgentManaged244 | {
+            /**
+             * Monotone permission-mode version, incremented once per mode update.
+             */
+            permission_mode_version?: number;
+            /**
+             * The permission mode before this change, or null when none was selected.
+             */
+            previous_permission_mode?: string | null;
+            /**
+             * The new native session permission mode; null restores configured tool policies.
+             */
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Unique identifier for this event.
              */
@@ -51021,6 +51845,10 @@ export type SessionsThreadsEventsListResponses = {
              */
             message_id?: string;
         } | {
+            /**
+             * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+             */
+            full_access_available?: boolean;
             /**
              * Unique identifier for this event.
              */
@@ -51099,6 +51927,44 @@ export type SessionsThreadsEventsListResponses = {
              * Praxis extension (MCP Apps, SEP-1865): `app` when the call was made by an MCP Apps view, `codemode` when a program run by the codemode tool called an MCP tool that declares a view (the event pair exists so a client can render that view; the model already has the result in the codemode tool result); absent for the model's own calls.
              */
             source?: 'app' | 'codemode';
+            /**
+             * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+             */
+            user_once?: true;
+            /**
+             * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+             */
+            guarded_rule?: string;
+            /**
+             * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+             */
+            permission_suggestions?: Array<{
+                /**
+                 * add_rules adds the offered allow rules.
+                 */
+                type: 'add_rules';
+                /**
+                 * allow grants permission for matching calls.
+                 */
+                behavior: 'allow';
+                /**
+                 * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+                 */
+                destination: 'agent' | 'session';
+                /**
+                 * The complete set of rules from one offered suggestion, without changes.
+                 */
+                rules: Array<{
+                    /**
+                     * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+                     */
+                    tool_name: string;
+                    /**
+                     * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+                     */
+                    rule_content: string;
+                }>;
+            }>;
             /**
              * Human-readable tool name from MCP 2025-06-18 Tool.title, falling back to annotations.title. Trimmed and truncated to 200 characters; omitted when blank or absent. Present only for model-initiated calls on /agent/v1; use name when absent.
              */
@@ -51153,6 +52019,10 @@ export type SessionsThreadsEventsListResponses = {
              */
             source?: 'app' | 'codemode';
         } | {
+            /**
+             * True only for a native primary-session approval in build, edit or guarded mode that is neither user-once nor an intrinsic always-ask or user-interaction gate. When true, allow with permission_mode=yolo to grant full access.
+             */
+            full_access_available?: boolean;
             /**
              * Unique identifier for this event.
              */
@@ -51195,6 +52065,44 @@ export type SessionsThreadsEventsListResponses = {
              * Run that produced this event; null when no run identity was recorded.
              */
             run_id: string | null;
+            /**
+             * When present, this dangerous shell call requires approval for this execution only; offer allow once or deny.
+             */
+            user_once?: true;
+            /**
+             * Deterministic dangerous-command rule that requires single-execution approval; present only for guarded matches.
+             */
+            guarded_rule?: string;
+            /**
+             * On an allow confirmation, copy this call's permission_suggestions unchanged. Personal agents accept agent (shared across their sessions) or session; service agents accept session only. Rules must match the offered update exactly. A failed save leaves the call waiting for approval.
+             */
+            permission_suggestions?: Array<{
+                /**
+                 * add_rules adds the offered allow rules.
+                 */
+                type: 'add_rules';
+                /**
+                 * allow grants permission for matching calls.
+                 */
+                behavior: 'allow';
+                /**
+                 * agent shares the grant across a personal agent's sessions; session keeps it in this session. Service agents reject agent with 400.
+                 */
+                destination: 'agent' | 'session';
+                /**
+                 * The complete set of rules from one offered suggestion, without changes.
+                 */
+                rules: Array<{
+                    /**
+                     * The offered tool name, including the full mcp__server__tool name for an MCP tool.
+                     */
+                    tool_name: string;
+                    /**
+                     * The offered command, stable command prefix, exact file path, domain or whole-tool wildcard.
+                     */
+                    rule_content: string;
+                }>;
+            }>;
         } | {
             /**
              * Unique identifier for this event.
@@ -51263,6 +52171,18 @@ export type SessionsThreadsEventsListResponses = {
              */
             run_id: string | null;
         } | AgentManaged230 | AgentManaged231 | AgentManaged232 | AgentManaged233 | AgentManaged235 | AgentManaged236 | AgentManaged237 | AgentManaged238 | AgentManaged239 | AgentManaged240 | AgentManaged241 | AgentManaged242 | AgentManaged243 | AgentManaged244 | {
+            /**
+             * Monotone permission-mode version, incremented once per mode update.
+             */
+            permission_mode_version?: number;
+            /**
+             * The permission mode before this change, or null when none was selected.
+             */
+            previous_permission_mode?: string | null;
+            /**
+             * The new native session permission mode; null restores configured tool policies.
+             */
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Unique identifier for this event.
              */
@@ -51801,7 +52721,7 @@ export type SessionsResourcesListData = {
     };
     query?: {
         /**
-         * Number of items per page.
+         * Number of resources per page, from 1 to 100; defaults to 100.
          */
         limit?: number;
         page?: null | string;
@@ -52078,7 +52998,7 @@ export type DeploymentsListResponses = {
                 /**
                  * Permission mode for each new session; omitted or null inherits the agent policies.
                  */
-                permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+                permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
                 /**
                  * Working directory for each new session; omitted uses the session default.
                  */
@@ -52208,7 +53128,7 @@ export type DeploymentsCreateData = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -52348,7 +53268,7 @@ export type DeploymentsCreateResponses = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -52517,7 +53437,7 @@ export type DeploymentsRetrieveResponses = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -52642,7 +53562,7 @@ export type DeploymentsUpdateData = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -52797,7 +53717,7 @@ export type DeploymentsUpdateResponses = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -52966,7 +53886,7 @@ export type DeploymentsArchiveResponses = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -53139,7 +54059,7 @@ export type DeploymentsPauseResponses = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -53312,7 +54232,7 @@ export type DeploymentsUnpauseResponses = {
             /**
              * Permission mode for each new session; omitted or null inherits the agent policies.
              */
-            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | null;
+            permission_mode?: 'build' | 'edit' | 'plan' | 'yolo' | 'guarded' | null;
             /**
              * Working directory for each new session; omitted uses the session default.
              */
@@ -57220,7 +58140,7 @@ export type AutomationRunsCreateData = {
             [key: string]: string;
         };
         /**
-         * Positive integer seconds up to 604,800. Scripts default to and are capped at 300 seconds; workflows default to 86,400 seconds and allow up to seven days.
+         * Positive integer seconds up to 2,592,000. Scripts default to and are capped at 300 seconds; workflows default to 86,400 seconds and allow up to 30 days.
          */
         deadline_seconds?: number;
     } | {
@@ -57247,7 +58167,7 @@ export type AutomationRunsCreateData = {
             [key: string]: string;
         };
         /**
-         * Positive integer seconds up to 604,800. Scripts default to and are capped at 300 seconds; workflows default to 86,400 seconds and allow up to seven days.
+         * Positive integer seconds up to 2,592,000. Scripts default to and are capped at 300 seconds; workflows default to 86,400 seconds and allow up to 30 days.
          */
         deadline_seconds?: number;
     };
@@ -58767,6 +59687,247 @@ export type AutomationHooksReceiveResponses = {
     202: AutomationFiring;
 };
 export type AutomationHooksReceiveResponse = AutomationHooksReceiveResponses[keyof AutomationHooksReceiveResponses];
+export type AutomationHumanTasksListData = {
+    body?: never;
+    path?: never;
+    query?: {
+        /**
+         * Page size, 1–100, default 50.
+         */
+        limit?: number;
+        /**
+         * The next_cursor of the previous page; omit for the first page.
+         */
+        cursor?: string;
+        /**
+         * Filter by status, comma-separated: open, completed, expired, cancelled. Defaults to open.
+         */
+        status?: Array<AutomationHumanTaskStatus>;
+        /**
+         * Only tasks opened by this run (run_).
+         */
+        run_id?: string;
+        /**
+         * assigned (default) lists only tasks assigned to the caller; all lists every task of the organization.
+         */
+        scope?: 'assigned' | 'all';
+    };
+    url: '/automation/v1/human-tasks';
+};
+export type AutomationHumanTasksListErrors = {
+    /**
+     * INVALID_PARAMS: Invalid request parameters, path, cursor, or body format.
+     */
+    400: AutomationAutomationProblemDetails;
+    /**
+     * RFC 9457 automation problem. 429 includes Retry-After.
+     */
+    default: AutomationAutomationProblemDetails;
+};
+export type AutomationHumanTasksListError = AutomationHumanTasksListErrors[keyof AutomationHumanTasksListErrors];
+export type AutomationHumanTasksListResponses = {
+    /**
+     * Success
+     */
+    200: {
+        /**
+         * Human tasks on this page, newest first.
+         */
+        data: Array<AutomationHumanTask>;
+        /**
+         * Cursor for the next page, passed back as cursor; null when there are no more.
+         */
+        next_cursor: string | null;
+    };
+};
+export type AutomationHumanTasksListResponse = AutomationHumanTasksListResponses[keyof AutomationHumanTasksListResponses];
+export type AutomationHumanTasksGetData = {
+    body?: never;
+    path: {
+        /**
+         * Human task ID (htask_), from the list or the run's waits.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/automation/v1/human-tasks/{id}';
+};
+export type AutomationHumanTasksGetErrors = {
+    /**
+     * INVALID_PARAMS: Invalid request parameters, path, cursor, or body format.
+     */
+    400: AutomationAutomationProblemDetails;
+    /**
+     * HUMAN_TASK_NOT_FOUND: The human task does not exist or belongs to another organization; take the htask_ ID from the human-tasks list or the run's waits.
+     */
+    404: AutomationAutomationProblemDetails;
+    /**
+     * RFC 9457 automation problem. 429 includes Retry-After.
+     */
+    default: AutomationAutomationProblemDetails;
+};
+export type AutomationHumanTasksGetError = AutomationHumanTasksGetErrors[keyof AutomationHumanTasksGetErrors];
+export type AutomationHumanTasksGetResponses = {
+    /**
+     * Success
+     */
+    200: AutomationHumanTask;
+};
+export type AutomationHumanTasksGetResponse = AutomationHumanTasksGetResponses[keyof AutomationHumanTasksGetResponses];
+export type AutomationHumanTasksRespondData = {
+    body: AutomationHumanTaskRespondInput;
+    headers?: {
+        /**
+         * Optional; 1–256 characters. Within 24 hours, the same key replays the first response with Idempotent-Replayed: true; a different request body returns 422; an in-flight request returns 409.
+         */
+        'Idempotency-Key'?: string;
+    };
+    path: {
+        /**
+         * Human task ID (htask_).
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/automation/v1/human-tasks/{id}/respond';
+};
+export type AutomationHumanTasksRespondErrors = {
+    /**
+     * INVALID_PARAMS: Invalid request parameters, path, cursor, or body format.
+     * COMMENT_REQUIRED: The chosen action requires a comment (require_comment: true); retry with comment set.
+     * INVALID_ACTION: action_id is not one of the task's actions; read the task's actions for the valid ids.
+     * INVALID_VALUES: values do not match the task's form_schema (unknown field, missing required field, wrong type or out-of-range value), or comment exceeds 4000 characters.
+     */
+    400: AutomationAutomationProblemDetails;
+    /**
+     * NOT_ASSIGNED: The caller is not an assignee of this task, it is not yet their turn in sequential mode, or (for cancel) the caller is neither the run's initiator nor an organization API key.
+     * SELF_APPROVAL: The person who started the run cannot respond to, or be delegated, their own request unless the workflow set allow_self_approval: true.
+     * AGENT_NOT_ALLOWED: The request comes from an agent (an agent session or run token) and the task did not set allow_agent_decision: true; the person must respond from the Console or with their own credential.
+     */
+    403: AutomationAutomationProblemDetails;
+    /**
+     * HUMAN_TASK_NOT_FOUND: The human task does not exist or belongs to another organization; take the htask_ ID from the human-tasks list or the run's waits.
+     */
+    404: AutomationAutomationProblemDetails;
+    /**
+     * TASK_CLOSED: The task is already closed (decided, expired or cancelled) or past due_at; it no longer accepts responses, delegation or cancellation. Retrieve the task to read its outcome.
+     * ALREADY_RESPONDED: The caller already responded; each assignee responds once.
+     * IDEMPOTENCY_IN_FLIGHT: A request with the same idempotency key is still in progress.
+     */
+    409: AutomationAutomationProblemDetails;
+    /**
+     * IDEMPOTENCY_KEY_MISMATCH: The idempotency key was already used for different request content.
+     */
+    422: AutomationAutomationProblemDetails;
+    /**
+     * RFC 9457 automation problem. 429 includes Retry-After.
+     */
+    default: AutomationAutomationProblemDetails;
+};
+export type AutomationHumanTasksRespondError = AutomationHumanTasksRespondErrors[keyof AutomationHumanTasksRespondErrors];
+export type AutomationHumanTasksRespondResponses = {
+    /**
+     * Success
+     */
+    200: AutomationHumanTask;
+};
+export type AutomationHumanTasksRespondResponse = AutomationHumanTasksRespondResponses[keyof AutomationHumanTasksRespondResponses];
+export type AutomationHumanTasksCancelData = {
+    body?: AutomationHumanTaskCancelInput;
+    headers?: {
+        /**
+         * Optional; 1–256 characters. Within 24 hours, the same key replays the first response with Idempotent-Replayed: true; a different request body returns 422; an in-flight request returns 409.
+         */
+        'Idempotency-Key'?: string;
+    };
+    path: {
+        /**
+         * Human task ID (htask_).
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/automation/v1/human-tasks/{id}/cancel';
+};
+export type AutomationHumanTasksCancelErrors = {
+    /**
+     * INVALID_PARAMS: Invalid request parameters, path, cursor, or body format.
+     */
+    400: AutomationAutomationProblemDetails;
+    /**
+     * NOT_ASSIGNED: The caller is not an assignee of this task, it is not yet their turn in sequential mode, or (for cancel) the caller is neither the run's initiator nor an organization API key.
+     */
+    403: AutomationAutomationProblemDetails;
+    /**
+     * HUMAN_TASK_NOT_FOUND: The human task does not exist or belongs to another organization; take the htask_ ID from the human-tasks list or the run's waits.
+     */
+    404: AutomationAutomationProblemDetails;
+    /**
+     * TASK_CLOSED: The task is already closed (decided, expired or cancelled) or past due_at; it no longer accepts responses, delegation or cancellation. Retrieve the task to read its outcome.
+     * IDEMPOTENCY_IN_FLIGHT: A request with the same idempotency key is still in progress.
+     */
+    409: AutomationAutomationProblemDetails;
+    /**
+     * IDEMPOTENCY_KEY_MISMATCH: The idempotency key was already used for different request content.
+     */
+    422: AutomationAutomationProblemDetails;
+    /**
+     * RFC 9457 automation problem. 429 includes Retry-After.
+     */
+    default: AutomationAutomationProblemDetails;
+};
+export type AutomationHumanTasksCancelError = AutomationHumanTasksCancelErrors[keyof AutomationHumanTasksCancelErrors];
+export type AutomationHumanTasksCancelResponses = {
+    /**
+     * Success
+     */
+    200: AutomationHumanTask;
+};
+export type AutomationHumanTasksCancelResponse = AutomationHumanTasksCancelResponses[keyof AutomationHumanTasksCancelResponses];
+export type AutomationHumanTasksDelegateData = {
+    body: AutomationHumanTaskDelegateInput;
+    path: {
+        /**
+         * Human task ID (htask_).
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/automation/v1/human-tasks/{id}/delegate';
+};
+export type AutomationHumanTasksDelegateErrors = {
+    /**
+     * INVALID_PARAMS: Invalid request parameters, path, cursor, or body format.
+     */
+    400: AutomationAutomationProblemDetails;
+    /**
+     * NOT_ASSIGNED: The caller is not an assignee of this task, it is not yet their turn in sequential mode, or (for cancel) the caller is neither the run's initiator nor an organization API key.
+     * SELF_APPROVAL: The person who started the run cannot respond to, or be delegated, their own request unless the workflow set allow_self_approval: true.
+     */
+    403: AutomationAutomationProblemDetails;
+    /**
+     * HUMAN_TASK_NOT_FOUND: The human task does not exist or belongs to another organization; take the htask_ ID from the human-tasks list or the run's waits.
+     */
+    404: AutomationAutomationProblemDetails;
+    /**
+     * TASK_CLOSED: The task is already closed (decided, expired or cancelled) or past due_at; it no longer accepts responses, delegation or cancellation. Retrieve the task to read its outcome.
+     * ALREADY_RESPONDED: The caller already responded; each assignee responds once.
+     * IDEMPOTENCY_IN_FLIGHT: A request with the same idempotency key is still in progress.
+     */
+    409: AutomationAutomationProblemDetails;
+    /**
+     * RFC 9457 automation problem. 429 includes Retry-After.
+     */
+    default: AutomationAutomationProblemDetails;
+};
+export type AutomationHumanTasksDelegateError = AutomationHumanTasksDelegateErrors[keyof AutomationHumanTasksDelegateErrors];
+export type AutomationHumanTasksDelegateResponses = {
+    /**
+     * Success
+     */
+    200: AutomationHumanTask;
+};
+export type AutomationHumanTasksDelegateResponse = AutomationHumanTasksDelegateResponses[keyof AutomationHumanTasksDelegateResponses];
 export type DatabaseListDatabasesData = {
     body?: never;
     path?: never;
@@ -61265,6 +62426,10 @@ export type MediaListLibrariesErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61352,6 +62517,10 @@ export type MediaCreateLibraryErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61409,6 +62578,10 @@ export type MediaDeleteLibraryErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61466,6 +62639,10 @@ export type MediaGetLibraryErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61558,6 +62735,10 @@ export type MediaUpdateLibraryErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61615,6 +62796,10 @@ export type MediaRestoreLibraryErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61672,6 +62857,10 @@ export type MediaPurgeLibraryErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61746,6 +62935,10 @@ export type MediaListAssetsErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61875,6 +63068,10 @@ export type MediaUploadAssetErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -61921,6 +63118,9 @@ export type MediaImportAssetData = {
      * Source and upload options for copying content into the library.
      */
     body: {
+        /**
+         * File ID to copy into this library; passed as the upload source instead of file bytes.
+         */
         file_id: string;
         /**
          * Explicit delivery identifier. If omitted, a random value is generated unless use_filename is true.
@@ -61991,6 +63191,10 @@ export type MediaImportAssetErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62052,6 +63256,10 @@ export type MediaDeleteAssetErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62113,6 +63321,10 @@ export type MediaGetAssetErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62196,6 +63408,10 @@ export type MediaUpdateAssetErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62265,6 +63481,10 @@ export type MediaReprocessAssetErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62343,6 +63563,10 @@ export type MediaListUnderstandingsErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62430,6 +63654,10 @@ export type MediaExpressionSearchErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62513,6 +63741,10 @@ export type MediaVisualSearchErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62590,6 +63822,10 @@ export type MediaSemanticSearchErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62667,6 +63903,10 @@ export type MediaSearchErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62729,6 +63969,10 @@ export type MediaListFoldersErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62794,6 +64038,10 @@ export type MediaCreateBatchErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62855,6 +64103,10 @@ export type MediaGetBatchErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62920,6 +64172,10 @@ export type MediaBatchAssetsErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -62981,6 +64237,10 @@ export type MediaGetJobErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */
@@ -63055,6 +64315,10 @@ export type MediaListEventsErrors = {
      * Request failed; see the error code reference.
      */
     400: MediaMediaError;
+    /**
+     * Request failed; see the error code reference.
+     */
+    403: MediaMediaError;
     /**
      * Request failed; see the error code reference.
      */