@deepraxis/sdk 0.1.1-dev.ed5af3e → 0.1.1-dev.f5193c4

package/dist/generated/sdk.gen.js

@@ -343,7 +343,7 @@ export const computersList = (options) => (options?.client ?? client).get({
 /**
  * Create Computer
  *
- * Create a durable computer: a named machine whose files outlive sessions, for personal agents.
+ * Create a durable computer: a named machine whose files outlive sessions, for general and personal agents.
  *
  * Praxis extension: MA only has session-scoped temporary containers and memory_stores, not durable browsable computers. Archived files remain readable, but new sessions cannot bind them. environment_id is an optional recipe reference; computers start with a light sandbox and expose the public SDK sandbox_id. Lists include archived computers.
  */
@@ -706,7 +706,7 @@ export const stopSessionBackgroundTask = (options) => (options.client ?? client)
  *
  * Request session context compaction and retrieve an operation receipt.
  *
- * Available only on /agent/v1. The body may be omitted or {}. Optional instructions must be a string and is forwarded unchanged. Idempotency-Key is forwarded unchanged; a UUID is generated when absent. Returns { type: session_compaction, id, status, reason? }, where id is the operation ID. queued/running return 202; skipped/succeeded/failed return 200. Non-string instructions return 400 invalid_request_error. Missing or inaccessible managed sessions return 404 not_found_error.
+ * Available only on /agent/v1. The body may be omitted or {}. Optional instructions must be a string and is forwarded unchanged. Idempotency-Key is forwarded unchanged; a UUID is generated when absent. Returns { type: session_compaction, id, status, reason? }, where id is the operation ID. queued/running return 202; skipped/succeeded/failed/cancelled return 200. Non-string instructions return 400 invalid_request_error. Missing or inaccessible managed sessions return 404 not_found_error.
  */
 export const compactSession = (options) => (options.client ?? client).post({
     security: [{
@@ -750,7 +750,7 @@ export const getSessionCompaction = (options) => (options.client ?? client).get(
  *
  * Read session compaction history and summaries.
  *
- * Available only on /agent/v1. Returns { data: [...] }. Each entry contains type, id, event_id, trigger, status, model, compacted_message_count, input_tokens_before, input_tokens_after, summary, error and created_at, as recorded by the service. Missing or inaccessible managed sessions return 404 not_found_error.
+ * Available only on /agent/v1. Returns { data: [...], active }. active is the queued or running compaction ({ type: session_compaction, id, status, trigger: manual|auto|idle }), or null when none; manual work takes precedence. Each data entry contains type, id, event_id, trigger, status, model, compacted_message_count, input_tokens_before, input_tokens_after, summary, error and created_at, as recorded by the service. Missing or inaccessible managed sessions return 404 not_found_error.
  */
 export const listSessionCompactions = (options) => (options.client ?? client).get({
     security: [{
@@ -1092,7 +1092,7 @@ export const fileListFiles = (options) => (options?.client ?? client).get({
 /**
  * Upload file
  *
- * Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data, assistants and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File(["Return within 23 days."], "policy.txt", { type: "text/plain" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–2592000), or praxis[expires_in_seconds] (3600–7776000), never both. Without expiry, the file persists until deleted.
+ * Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data, assistants and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File(["Return within 23 days."], "policy.txt", { type: "text/plain" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–7776000). Without expiry, the file persists until deleted.
  */
 export const fileCreateFile = (options) => (options.client ?? client).post({
     ...formDataBodySerializer,
@@ -1169,7 +1169,7 @@ export const fileRetrieveFileContent = (options) => (options.client ?? client).g
 /**
  * Create an upload
  *
- * Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 2 GiB (2147483648 bytes) and only user_data, assistants and vision purposes. Add parts of at most 64000000 bytes and complete within one hour. Optional part_size enables fixed-size, retryable parts. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.
+ * Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 20 GiB (21474836480 bytes) and only user_data, assistants and vision purposes. Send parts of at most 64000000 bytes; an unfinished upload waits for them for 7 days, so a client can create → send parts → query GET /file/v1/uploads/{upload_id} → resend only the missing parts → complete. Optional part_size fixes every part length and makes each numbered part retryable with identical bytes. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.
  */
 export const fileCreateUpload = (options) => (options.client ?? client).post({
     security: [{
@@ -1187,7 +1187,7 @@ export const fileCreateUpload = (options) => (options.client ?? client).post({
 /**
  * Add an upload part
  *
- * Send one nonempty part as the multipart data field, at most 64000000 bytes. Parts may arrive concurrently in any order. Use upload_id from create. For a fixed-size upload, supply part_number starting at 1 and exactly part_size bytes except for the final remainder; retry the same number with identical bytes to recover its part ID. Without part_size, each request creates a new part and part_number is ignored. Save the returned part IDs for complete.
+ * Send one nonempty part as the multipart data field, at most 64000000 bytes. Parts may arrive concurrently in any order. Use upload_id from create. For a fixed-size upload, supply part_number starting at 1 and exactly part_size bytes except for the final remainder; retry the same number with identical bytes to recover its part ID, and query GET /file/v1/uploads/{upload_id} to see which numbers already arrived. Without part_size, each request creates a new part and part_number is ignored. Save the returned part IDs for complete.
  */
 export const fileAddUploadPart = (options) => (options.client ?? client).post({
     ...formDataBodySerializer,
@@ -1206,7 +1206,7 @@ export const fileAddUploadPart = (options) => (options.client ?? client).post({
 /**
  * Complete an upload
  *
- * Assemble the uploaded parts into a file. Supply upload_id from create and part_ids from addPart in file byte order; their sizes must total the declared bytes. Optional md5 verifies the assembled content. Retrying identical part_ids and normalized md5 returns the same result; different inputs return 409. Unlike OpenAI, completed can contain a file still processing (status uploaded). Poll files.retrieve using file.id until status processed (own face state active); error, expiry or 404 means processing failed and the file cannot be used.
+ * Assemble the uploaded parts into a file. Supply upload_id from create and part_ids from addPart in file byte order; their sizes must total the declared bytes. When parts were lost, query GET /file/v1/uploads/{upload_id} and resend them before completing. Optional md5 verifies the assembled content. Retrying identical part_ids and normalized md5 returns the same result; different inputs return 409. Unlike OpenAI, completed can contain a file still processing (status uploaded). Poll files.retrieve using file.id until status processed (own face state active); error, expiry or 404 means processing failed and the file cannot be used.
  */
 export const fileCompleteUpload = (options) => (options.client ?? client).post({
     security: [{
@@ -1235,6 +1235,86 @@ export const fileCancelUpload = (options) => (options.client ?? client).post({
     url: '/file/v1/uploads/{upload_id}/cancel',
     ...options
 });
+/**
+ * Retrieve an upload
+ *
+ * Read the state of an unfinished upload — its status, declared bytes, fixed part_size and the parts it already holds (received_parts, each with part_number, bytes and sha256). After a break or a failed part, call it to resend only the missing numbers, then complete. A cancelled or expired upload is refused; a completed one returns its file. A missing or other-organization upload returns 404.
+ */
+export const fileRetrieveUpload = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/file/v1/uploads/{upload_id}',
+    ...options
+});
+/**
+ * Create a one-time upload URL
+ *
+ * Upload a local file of up to 20 GiB from a coding agent without sending bytes through the model. Provide basename, exact byte count and MIME type. Up to 104857600 bytes, PUT the file to url with curl -T photo.png -H 'Content-Type: image/png' '<url>'; success returns 201 with the file object, and reuse returns 410 CAPABILITY_USED. Above that threshold, split the file into part_size chunks (default 64000000 bytes) and PUT each chunk to its numbered parts[].url in any order; an interrupted client GETs status_url to see the received parts and resends only what is missing, then POSTs complete_url without a body. Part PUTs return 200; completion returns 201 with the file object, including its state, or 400 if a part is missing. A processing file can be polled with files.retrieve until active. Identical part bytes may be retried; changed bytes at the same number return 400. Completion reuse returns 410 CAPABILITY_USED. Each PUT requires the exact signed Content-Length; single-PUT Content-Type must match content_type or be omitted. Expired, revoked, invalid, wrong-action or cross-organization URLs return 404. URL lifetime defaults to 900 seconds for single PUT or 604800 (7 days) for multipart, at most 604800; all multipart URLs, including status_url, share an expiry. Multipart creation reserves storage quota. Issuance requires the same unscoped credential as direct file creation. Each issuance creates a new upload and is not idempotent. Example body: {"filename":"photo.png","bytes":2048,"content_type":"image/png"}.
+ */
+export const fileCreateSignedUpload = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/file/v1/uploads/signed',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Create a download URL
+ *
+ * Download a file's bytes to a local disk from a coding agent without sending them through the model. Use file_id from file creation or listing, then run curl -fsSL -o <filename> '<url>' locally with the returned URL; GET needs no Authorization header. The link is reusable until expiry and supports a single byte Range (for example Range: bytes=0-9 returns 206). Revoke it with files.contentLinks.revoke, passing the token after /c/ in the URL. Expired, revoked, invalid or cross-organization URLs return 404. Lifetime defaults to 900 seconds and is at most 604800 seconds. Issuance requires the same credential and file-read access as files.retrieveContent; a processing file returns 409 FILE_NOT_READY, so poll files.retrieve until active before retrying. A missing, expired or other-organization file returns 404. Each issuance creates a new link. OpenAI Files has no signed download URL; this follows S3 presigned GET semantics. Example body: {"ttl_seconds":3600}.
+ */
+export const fileCreateContentUrl = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/file/v1/files/{file_id}/content_url',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Revoke a file content link
+ *
+ * Stop a previously issued content link from reading a file. Obtain the link with files.contentUrl.create. Use file_id from file creation or listing and the token path component from a content URL (/c/<token>), not the complete URL. The caller must own the file and have write access; a read-only binding is refused. Revocation propagates through the capability deny list within 15 minutes; the file and other links remain available. Only current IAM capability tokens can be revoked; legacy content links expire at the migration deadline. Example body: {"token":"<token from /c/>"}.
+ */
+export const fileRevokeContentLink = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/file/v1/files/{file_id}/content_links:revoke',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Health Check
  *
@@ -1269,6 +1349,18 @@ export const metaMethodsSearch = (options) => (options?.client ?? client).get({
  *
  */
 export const metaMethodsRetrieve = (options) => (options.client ?? client).get({ url: '/meta/v1/methods/{name}', ...options });
+/**
+ * Read documentation Markdown
+ *
+ * Read a platform guide or reference before implementing an unfamiliar capability. Public; no API key required. Take path from praxis.meta.docs.search, or use developers/automation/guides/write-workflow. Append #heading-id to path to read only that section, including its subsections. Encode the hash as %23 over HTTP; SDK callers pass it in the path string. lang defaults to zh; en selects the English page. Unknown pages or anchors return DOC_NOT_FOUND; search again for a valid path.
+ */
+export const metaDocsRetrieve = (options) => (options.client ?? client).get({ url: '/meta/v1/docs/{path}', ...options });
+/**
+ * Search platform documentation
+ *
+ * Find guides and references by keyword before reading them with praxis.meta.docs.retrieve. Public; no API key required. Matches documentation titles, headings and page text without case sensitivity; all query words must occur. q is required; limit defaults to 20 and accepts 1–50. lang defaults to zh or use en for English. Returns paths, page titles, canonical URLs and short matching snippets; no matches returns an empty array.
+ */
+export const metaDocsSearch = (options) => (options.client ?? client).get({ url: '/meta/v1/docs/search', ...options });
 /**
  * List Models
  *
@@ -1377,6 +1469,28 @@ export const remixVideo = (options) => (options.client ?? client).post({
     url: '/model/v1/videos/{video_id}/remix',
     ...options
 });
+/**
+ * Ask structured decision questions
+ *
+ * Ask typed questions about a state and get calibrated probabilities instead of generated text. Same request and response as TypeSafe System One. Use model ids from model.models.list declaring typesafe.systemone. Send one or more noul, choice or score questions; answers use the same question ids. Input tokens are charged at the catalog input price; output tokens are free. usage.cost and X-Praxis-Cost-Usd expose the same customer charge in USD. box questions and assets are unsupported and return 400: images are not supported. Unknown top-level fields pass unchanged to the native upstream.
+ */
+export const createSystemone = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/model/v1/systemone',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Transcribe audio
  *
@@ -1888,6 +2002,24 @@ export const countResponseInputTokens = (options) => (options.client ?? client).
         ...options.headers
     }
 });
+/**
+ * List organization members
+ *
+ * Concepts follow GitHub org members: find a person's user id, for example to assign an approver to an approval task. Lists only members of the organization behind your API key or runtime token, ordered by joined_at ascending (membership id breaks ties). Ask the user who should approve, then use that member's id. Emails are visible only within this organization. The request cannot select another organization. Pass next_page unchanged as page; null means the end. Read-only; no usage charge. Example: GET /organization/v1/members?limit=20.
+ */
+export const listOrganizationMembers = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/organization/v1/members',
+    ...options
+});
 /**
  * List your organization's feedback
  *
@@ -2372,7 +2504,7 @@ export const makeSandboxDirectory = (options) => (options.client ?? client).post
 /**
  * Run a command in the sandbox
  *
- * Execute a shell command and wait for stdout, stderr and exitCode. Supply cmd, optional cwd and envs, and timeoutMs (1–60000 milliseconds, default 60000). Unlike E2B, this endpoint is synchronous only: no background mode, callbacks or unlimited timeout; output is bounded to 1 MiB including stream framing. Nonzero exit codes return 200 with the result. A timeout returns COMMAND_TIMEOUT (504); transport timeout does not confirm process termination, so do not blindly retry commands with side effects. Example body: {"cmd":"echo hi"}.
+ * Execute a shell command and wait for stdout, stderr and exitCode. Supply cmd, optional cwd and envs, and timeoutMs (1–3600000 milliseconds, default 600000, that is 10 minutes; E2B defaults to 60000). Unlike E2B, this endpoint is synchronous only: no background mode, callbacks or unlimited timeout (timeoutMs 0); output is bounded to 1 MiB including stream framing. Nonzero exit codes return 200 with the result. A timeout returns COMMAND_TIMEOUT (504); transport timeout does not confirm process termination, so do not blindly retry commands with side effects. Example body: {"cmd":"echo hi"}.
  */
 export const runSandboxCommand = (options) => (options.client ?? client).post({
     security: [{
@@ -2452,7 +2584,7 @@ export const sessionsUpdate = (options) => (options.client ?? client).post({
 /**
  * List agents
  *
- * List the agents of the workspace behind your API key, newest first, in pages of at most 100 (default 20). Use it to find an agent id before creating a session; to read one agent use agents.retrieve, to see its history use agents.versions.list. Archived agents are hidden unless include_archived is true. Filter kind=personal for durable-computer agents or kind=service for per-session environments. Pass next_page from the response as page to read the next page; a null next_page means the end.
+ * List the agents of the workspace behind your API key, newest first, in pages of at most 100 (default 20). Use it to find an agent id before creating a session; to read one agent use agents.retrieve, to see its history use agents.versions.list. Archived agents are hidden unless include_archived is true. Filter kind=general or kind=personal for durable-computer agents, kind=service for per-session environments, or kind=assume for external MCP clients. Pass next_page from the response as page to read the next page; a null next_page means the end.
  */
 export const agentsList = (options) => (options?.client ?? client).get({
     security: [{
@@ -2470,7 +2602,7 @@ export const agentsList = (options) => (options?.client ?? client).get({
 /**
  * Create agent
  *
- * Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. skills attaches uploaded custom skills as [{type: "custom", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send "latest", to use the skill's newest version when a session starts. type anthropic returns 400. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. model and every models.allowed entry must be a catalog model that can run an agent: an unknown id returns 400 "model <id> is not in the model catalog" and an embedding, image or speech model returns 400 "model <id> cannot run an agent". name is a label, not a unique key: 1 to 256 characters after trimming, no NUL or line breaks. avatar is trimmed, must not contain spaces or point at a loopback, private or internal host, and its scheme is stored in lowercase. script and workflow binding ids are stored in lowercase, the form automation matches; bindings together with environment_id null return 400 because bindings need a machine. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.
+ * Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. skills attaches uploaded custom skills as [{type: "custom", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send "latest", to use the skill's newest version when a session starts. type anthropic returns 400. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. model and every models.allowed entry must be a catalog model that can run an agent: an unknown id returns 400 "model <id> is not in the model catalog" and an embedding, image or speech model returns 400 "model <id> cannot run an agent". name is a label, not a unique key: 1 to 256 characters after trimming, no NUL or line breaks. avatar is trimmed, must not contain spaces or point at a loopback, private or internal host, and its scheme is stored in lowercase. script and workflow binding ids are stored in lowercase, the form automation matches; bindings together with environment_id null return 400 because bindings need a machine. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}. For kind assume, provide name without model, models, subagent_model, subagents or multiagent; omit computer_id to register a new computer named after the agent without starting an instance, or provide an existing computer_id; vault_ids are accepted, bindings and environment_id are refused. Drive assume agents over MCP at /agent/v1/agents/{id}/mcp.
  */
 export const agentsCreate = (options) => (options.client ?? client).post({
     security: [{
@@ -2510,7 +2642,7 @@ export const agentsRetrieve = (options) => (options.client ?? client).get({
 /**
  * Update agent
  *
- * Save configuration changes as a new immutable version. Send latest_version from a default retrieve or update response as the request version for optimistic concurrency; a stale value returns 409. apply defaults to true and makes the new version effective; apply false saves without changing active_version. The response contains the effective configuration, with version equal to active_version and latest_version naming the newest saved version. An unchanged configuration, including a note-only update, is a no-op returning 200 and the current effective version without creating or activating a version. version_note records up to 280 characters only when a configuration change creates a new version; null is equivalent to omission. Use agents.versions.apply to activate an existing saved version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: "custom", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send "latest", to use the skill's newest version when a session starts. type anthropic returns 400.
+ * Save configuration changes as a new immutable version. Send latest_version from a default retrieve or update response as the request version for optimistic concurrency; a stale value returns 409. apply defaults to true and makes the new version effective; apply false saves without changing active_version. The response contains the effective configuration, with version equal to active_version and latest_version naming the newest saved version. An unchanged configuration, including a note-only update, is a no-op returning 200 and the current effective version without creating or activating a version. version_note records up to 280 characters only when a configuration change creates a new version; null is equivalent to omission. Use agents.versions.apply to activate an existing saved version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: "custom", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send "latest", to use the skill's newest version when a session starts. type anthropic returns 400. Assume agents reject model, models, subagent_model, subagents and multiagent on every update; other fields follow the general agent rules, with vault_ids also accepted.
  */
 export const agentsUpdate = (options) => (options.client ?? client).post({
     security: [{
@@ -2586,7 +2718,7 @@ export const sessionsList = (options) => (options?.client ?? client).get({
 /**
  * Create session
  *
- * Create a session: one conversation with an agent. Pass agent as an agent id or {type:"agent", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:"agent_with_overrides", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:"limit", max_list_cost:{amount, currency:"USD"}} where amount is a positive decimal string of US dollars with at most 2 decimal places ("20.00" is USD 20.00); omitted budget defaults to "20.00" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.
+ * Create a session: one conversation with an agent. Pass agent as an agent id or {type:"agent", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:"agent_with_overrides", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:"limit", max_list_cost:{amount, currency:"USD"}} where amount is a positive decimal string of US dollars with at most 2 decimal places ("20.00" is USD 20.00); omitted budget defaults to "20.00" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion. Assume agents return 400 INVALID_PARAMS; drive them over MCP at /agent/v1/agents/{id}/mcp instead.
  */
 export const sessionsCreate = (options) => (options.client ?? client).post({
     security: [{
@@ -2966,7 +3098,7 @@ export const deploymentsList = (options) => (options?.client ?? client).get({
 /**
  * Create deployment
  *
- * Freeze session parameters as a deployment; this operation does not open a session. Pass an agent id or versioned reference, a name, 1–50 user.message initial events and an environment_id from environments.list. Unlike Anthropic Managed Agents, /agent/v1 also accepts agent_with_overrides (model, permission_mode and cwd) and target=computer for personal agents, with environment_id omitted. Cron schedules use five POSIX fields and an IANA timezone. File resources are accepted. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Active schedules run every minute when due; session creation errors pause the deployment. Unsupported tools, mcp_servers, system and skills overrides return 400.
+ * Freeze session parameters as a deployment; this operation does not open a session. Pass an agent id or versioned reference, a name, 1–50 user.message initial events and an environment_id from environments.list. Unlike Anthropic Managed Agents, /agent/v1 also accepts agent_with_overrides (model, permission_mode and cwd) and target=computer for general and personal agents, with environment_id omitted. Cron schedules use five POSIX fields and an IANA timezone. File resources are accepted. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Active schedules run every minute when due; session creation errors pause the deployment. Unsupported tools, mcp_servers, system and skills overrides return 400.
  */
 export const deploymentsCreate = (options) => (options.client ?? client).post({
     security: [{
@@ -3612,7 +3744,7 @@ export const applicationListGrants = (options) => (options.client ?? client).get
 /**
  * Create grant
  *
- * Let this Worker's platform token access one of your databases, folders or knowledge bases.
+ * Record access to an organization-owned database or knowledge base, all organization files (files, id *), or models (models, id *, read only). Each resource and optional alias must be unique within this Worker. Foreign and missing resources both return RESOURCE_NOT_FOUND (404); an unavailable resource service returns PROVIDER_CAPACITY (503, retryable).
  */
 export const applicationCreateGrant = (options) => (options.client ?? client).post({
     security: [{
@@ -3757,7 +3889,7 @@ export const automationActionsGet = (options) => (options.client ?? client).get(
 /**
  * Update an action
  *
- * Update after checking compatibility against the current and five recent revisions. Widening inputs and narrowing outputs are compatible, including length, item count, property count, type (integer/number), and multipleOf (the new input factor divides the old one; the reverse holds for outputs). dry_run=true returns only CompatResult and may omit If-Match; a supplied header is still checked, and * matches any existing representation. Normal updates require If-Match and return ActionDef with ETag; previews return no ETag. Omitted optional fields retain their existing values only for description and labels; when constructing a new revision, errors defaults to [], omitted annotations keys to false, timeout_ms to 30000, and message to null. Incompatible normal updates return 422 SCHEMA_INCOMPATIBLE with issues; unchanged contents retain the existing revision.
+ * Update after checking compatibility against the current and five recent revisions. Widening inputs and narrowing outputs are compatible, including length, item count, property count, type (integer/number), and multipleOf (the new input factor divides the old one; the reverse holds for outputs). dry_run=true returns only CompatResult and may omit If-Match; a supplied header is still checked, and * matches any existing representation. Normal updates require If-Match and return ActionDef with ETag; previews return no ETag. Omitted optional fields retain their existing values only for description and labels; when constructing a new revision, errors defaults to [], omitted annotations keys to false, timeout_ms to 300000, and message to null. Incompatible normal updates return 422 SCHEMA_INCOMPATIBLE with issues; unchanged contents retain the existing revision.
  */
 export const automationActionsUpdate = (options) => (options.client ?? client).put({
     security: [{
@@ -4200,7 +4332,7 @@ export const automationWorkflowsList = (options) => (options?.client ?? client).
 /**
  * Create a workflow
  *
- * Save a YAML workflow as an editable draft; this does not validate, publish or run it, so check it with validate (kind=workflow) first. Minimal draft: document with dsl ("1.0.3"), namespace, name and version, plus a do list of steps, for example document: {dsl: "1.0.3", namespace: demo, name: add, version: "1.0.0"} and do: [{first: {call: demo/add-one, with: {n: "${ .n }"}}}]. call: <ns/name> calls an Action directly (bare name for built-ins such as ocr) and with is the Action input; the input contract is at current_revision.input_schema in the get-action response. run: starts a saved script or child workflow. The run input is . in the first step, and expressions are jq written as a whole ${ ... } string. Limits: Action 30 s (run-sandbox 10 min), workflow 24 h by default and 30 days at most, payload 1 MiB. Test the draft by sending its source and language=yaml to praxis.automation.runs.create. Guide: /docs/developers/automation/guides/write-workflow. Error details are in the errors[] of the response (pointer, detail, hint). Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.
+ * Workflow syntax reference: https://deepraxis.com/docs/developers/automation/reference/workflow-syntax. Save a YAML workflow as an editable draft; this does not validate, publish or run it, so check it with validate (kind=workflow) first. Minimal draft: document with dsl ("1.0.3"), namespace, name and version, plus a do list of steps, for example document: {dsl: "1.0.3", namespace: demo, name: add, version: "1.0.0"} and do: [{first: {call: demo/add-one, with: {n: "${ .n }"}}}]. call: <ns/name> calls an Action directly (bare name for built-ins such as ocr) and with is the Action input; the input contract is at current_revision.input_schema in the get-action response. run: starts a saved script or child workflow. The run input is . in the first step, and expressions are jq written as a whole ${ ... } string. Limits: Action 5 min (run-sandbox 6 h), workflow 24 h by default and 30 days at most, payload 1 MiB. Test the draft by sending its source and language=yaml to praxis.automation.runs.create. To pause for a person, call praxis/approval (it opens a human task; the step output is the decision); agents answer with praxis.automation.humanTasks.respond on behalf of their user. Guide: /docs/developers/automation/guides/approvals Guide: /docs/developers/automation/guides/write-workflow. Error details are in the errors[] of the response (pointer, detail, hint). Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.
  */
 export const automationWorkflowsCreate = (options) => (options.client ?? client).post({
     security: [{
@@ -4240,7 +4372,7 @@ export const automationWorkflowsGet = (options) => (options.client ?? client).ge
 /**
  * Update a workflow draft
  *
- * Update description, labels or draft with the current draft revision in If-Match, taken from draft.revision in the get-workflow response. Even metadata-only updates create a new draft revision. A mismatch returns 412 PRECONDITION_FAILED; read the draft again, merge and retry. The draft is not validated here, so check it with validate (kind=workflow) before publishing. Error details are in errors[].
+ * Update description, labels or draft with the current draft revision in If-Match, taken from draft.revision in the get-workflow response. Even metadata-only updates create a new draft revision. A mismatch returns 412 PRECONDITION_FAILED; read the draft again, merge and retry. The draft is not validated here, so check it with validate (kind=workflow) before publishing. Error details are in errors[]. See the workflow syntax reference at https://deepraxis.com/docs/developers/automation/reference/workflow-syntax.
  */
 export const automationWorkflowsPatch = (options) => (options.client ?? client).patch({
     security: [{
@@ -4444,7 +4576,7 @@ export const automationWorkflowsSetDistTag = (options) => (options.client ?? cli
 /**
  * Validate a definition
  *
- * Check source without executing it when you need diagnostics, inferred schemas or references. This is optional before praxis.automation.runs.create, which also validates source before execution. Actions, scripts and workflows are supported; results include validity without saving. Invalid source is reported with valid=false. Script/action output schemas are inferred from return types: Promise unwrapping, Record, intersections and Date. Unknown types yield an empty schema and a warning in warnings. Source diagnostics use /source or /implementation/source with 1-based line/column. For kind=action the same admission checks as action creation apply (no external imports, platform operations only as direct call(praxis/<api>.<op>, input) calls, no agent or automation calls), so source that validates is not rejected at creation. For kind=workflow the YAML needs document (dsl, namespace, name, version) and do; each problem is one entry in errors[] (pointer, detail, hint), so read the first one. A listen outside the supported subset (to.all, inside a fork) and emit are not reported here and fail with DEFINITION_INVALID only when a run is created.
+ * Check source without executing it when you need diagnostics, inferred schemas or references. This is optional before praxis.automation.runs.create, which also validates source before execution. Actions, scripts and workflows are supported; results include validity without saving. Invalid source is reported with valid=false. Script/action output schemas are inferred from return types: Promise unwrapping, Record, intersections and Date. Unknown types yield an empty schema and a warning in warnings. Source diagnostics use /source or /implementation/source with 1-based line/column. For kind=action the same admission checks as action creation apply (no external imports, platform operations only as direct call(praxis/<api>.<op>, input) calls, no agent or automation calls), so source that validates is not rejected at creation. For kind=workflow the YAML needs document (dsl, namespace, name, version) and do; each problem is one entry in errors[] (pointer, detail, hint), so read the first one. A listen outside the supported subset (to.all, inside a fork) and emit are not reported here and fail with DEFINITION_INVALID only when a run is created. Workflow syntax reference: https://deepraxis.com/docs/developers/automation/reference/workflow-syntax.
  */
 export const automationValidateValidate = (options) => (options.client ?? client).post({
     security: [{
@@ -4532,7 +4664,7 @@ export const automationRunsList = (options) => (options?.client ?? client).get({
 /**
  * Run a published target or execute draft source
  *
- * Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call("ocr", { document: { type: "file", file_id } }); return result; }`; send it as source with language="ts", input={"file_id":"<uploaded file ID>"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: "glm-ocr", document: { type: "file", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke("namespace/name", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 30 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. With language=yaml, source is a workflow YAML: the run input is . in the first step, and the shape is described in create workflow. Error details are in errors[] (pointer, detail, hint). New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.
+ * Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call("ocr", { document: { type: "file", file_id } }); return result; }`; send it as source with language="ts", input={"file_id":"<uploaded file ID>"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: "glm-ocr", document: { type: "file", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke("namespace/name", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 5 min (run-sandbox after 6 h); scripts have a 30 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 30 days. Each run can start at most 1,000 child runs, with at most 100 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. With language=yaml, source is a workflow YAML: the run input is . in the first step, and the shape is described in create workflow. Error details are in errors[] (pointer, detail, hint). New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.
  */
 export const automationRunsCreate = (options) => (options.client ?? client).post({
     security: [{
@@ -5139,31 +5271,57 @@ export const automationHumanTasksDelegate = (options) => (options.client ?? clie
     }
 });
 /**
- * List databases
+ * List script vault bindings
  *
- * Find databases owned by your tenant and obtain their ids for schema or row operations. Excludes deleting by default. status=active or status=deleting selects that state; invalid values return 400 INVALID_PARAMS.
+ * Inspect the whole vaults attached to a saved script, including archived definitions, without reading secret values. Obtain ns and name from automation.scripts.list. Bindings belong to the definition rather than a published version. When vault or secret metadata cannot be read, the binding remains visible with secrets: [] and secrets_unavailable: true.
  */
-export const databaseListDatabases = (options) => (options?.client ?? client).get({
+export const automationScriptsVaultsList = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases',
+    url: '/automation/v1/scripts/{ns}/{name}/vaults',
     ...options
 });
 /**
- * Create database
+ * Delete a script vault binding
  *
- * Creates an empty database for the caller and returns it with status active (HTTP 201); add tables next with praxis.database.databases.tables.create. name is required and is 1–64 visible characters after trimming. labels are optional string tags (at most 64; each key starts with a lowercase letter and uses up to 63 characters of a-z 0-9 _ -; each value is up to 63 characters of a-z 0-9 _ -) that databaseListDatabases can filter on. If initialization fails the call returns 503 CAPACITY and the half-created database is left with status failed; retry by calling create again, which makes a new database. Unlike Supabase, this creates a SQLite-backed database without a PostgreSQL connection or SQL execution endpoint. Use a Praxis credential; access is scoped to its tenant, not to Supabase Auth users or RLS policies.
+ * Remove the vault assignment from this saved script without deleting the vault or its secrets. Obtain aliases from automation.scripts.vaults.list. Repeating deletion of an absent alias on an existing definition succeeds. Bindings also disappear when the definition is permanently deleted, while archival retains them.
  */
-export const databaseCreateDatabase = (options) => (options.client ?? client).post({
+export const automationScriptsVaultsDelete = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases',
+    url: '/automation/v1/scripts/{ns}/{name}/vaults/{alias}',
+    ...options
+});
+/**
+ * Set a script vault binding
+ *
+ * Attach an entire active vault in your organization to a saved script, or replace the vault at an existing alias. Obtain the vault ID or display name from praxis.vault.vaults.list; ambiguous names require an ID. Bindings are independent of published versions and survive archival. The same vault cannot be assigned to two aliases on one definition. Repeating the same assignment is idempotent. Example body: {"vault":"Production"}.
+ */
+export const automationScriptsVaultsSet = (options) => (options.client ?? client).put({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/automation/v1/scripts/{ns}/{name}/vaults/{alias}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5171,45 +5329,57 @@ export const databaseCreateDatabase = (options) => (options.client ?? client).po
     }
 });
 /**
- * Delete database
+ * List workflow vault bindings
  *
- * Soft-delete a database when it should stop accepting schema and row operations. Idempotently enters deleting with a seven-day purge_at. GET remains available; child operations return 409 until restored.
+ * Inspect the whole vaults attached to a saved workflow, including archived definitions, without reading secret values. Obtain ns and name from automation.workflows.list. Bindings belong to the definition rather than a published version. When vault or secret metadata cannot be read, the binding remains visible with secrets: [] and secrets_unavailable: true.
  */
-export const databaseDeleteDatabase = (options) => (options.client ?? client).delete({
+export const automationWorkflowsVaultsList = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}',
+    url: '/automation/v1/workflows/{ns}/{name}/vaults',
     ...options
 });
 /**
- * Get database
+ * Delete a workflow vault binding
  *
- * Returns one database by id, including a database in the deleting state (purge_at then shows when it will be permanently removed). Call it before table or row operations to confirm status is active: schema and row calls on a deleting database return 409 DATABASE_INVALID_STATE. size_bytes is refreshed from live storage at most once every five seconds. A purged or unknown id returns 404 DATABASE_NOT_FOUND.
+ * Remove the vault assignment from this saved workflow without deleting the vault or its secrets. Obtain aliases from automation.workflows.vaults.list. Repeating deletion of an absent alias on an existing definition succeeds. Bindings also disappear when the definition is permanently deleted, while archival retains them.
  */
-export const databaseGetDatabase = (options) => (options.client ?? client).get({
+export const automationWorkflowsVaultsDelete = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}',
+    url: '/automation/v1/workflows/{ns}/{name}/vaults/{alias}',
     ...options
 });
 /**
- * Update database
+ * Set a workflow vault binding
  *
- * Renames an active database and/or replaces its labels; send only the keys you want to change. labels is replaced as a whole, not merged, so include every label you want to keep. A body without name or labels, or with values equal to the current ones, changes nothing and leaves updated_at as is. A database in the deleting state returns 409 DATABASE_INVALID_STATE; restore it first with databaseRestoreDatabase.
+ * Attach an entire active vault in your organization to a saved workflow, or replace the vault at an existing alias. Obtain the vault ID or display name from praxis.vault.vaults.list; ambiguous names require an ID. Bindings are independent of published versions and survive archival. The same vault cannot be assigned to two aliases on one definition. Repeating the same assignment is idempotent. Example body: {"vault":"Production"}.
  */
-export const databaseUpdateDatabase = (options) => (options.client ?? client).patch({
+export const automationWorkflowsVaultsSet = (options) => (options.client ?? client).put({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}',
+    url: '/automation/v1/workflows/{ns}/{name}/vaults/{alias}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5217,59 +5387,81 @@ export const databaseUpdateDatabase = (options) => (options.client ?? client).pa
     }
 });
 /**
- * Restore database
+ * List canvases
  *
- * Recover a soft-deleted database within its seven-day recovery window. Restore before purge_at. An empty body is accepted. Active databases return 409; purged databases return 404.
+ * Discover canvases in the API key's organization and obtain ids for retrieval or editing. Results are ordered by updated_at from newest to oldest. limit is 1–100 and defaults to 50; omit cursor for the first page, then copy next_cursor into the next request until it is null. Deleted canvases are unavailable.
  */
-export const databaseRestoreDatabase = (options) => (options.client ?? client).post({
+export const canvasListCanvases = (options) => (options?.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'canvas-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/restore',
+    url: '/canvas/v1/canvases',
     ...options
 });
 /**
- * Permanently purge database
+ * Create canvas
  *
- * Immediately and irreversibly purges a deleting database. Active databases return 409; absent or already purged databases return 404.
+ * Create a blank design canvas in the API key's organization before drawing with praxis.canvas.canvases.execute. Send an optional name of at most 200 characters; omitting name uses Untitled. Each successful call creates a new canvas and returns its id and viewer_url with HTTP 201; save the id for subsequent reads, edits and deletion.
  */
-export const databasePurgeDatabase = (options) => (options.client ?? client).post({
+export const canvasCreateCanvas = (options) => (options?.client ?? client).post({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'canvas-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/purge',
+    url: '/canvas/v1/canvases',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options?.headers
+    }
+});
+/**
+ * Delete canvas
+ *
+ * Permanently delete a canvas and its design content when it is no longer needed. Obtain canvas_id from create or list and confirm the target before calling; deletion cannot be undone. HTTP 200 confirms deletion with deleted=true. Subsequent access returns CANVAS_NOT_FOUND, as it does for a missing canvas or one outside the API key's organization.
+ */
+export const canvasDeleteCanvas = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'canvas-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/canvas/v1/canvases/{canvas_id}',
     ...options
 });
 /**
- * List tables
+ * Retrieve canvas
  *
- * Lists every table of an active database with its field definitions. A database holds at most 50 tables, so the single page contains all of them and next_cursor is always null. Use databaseGetTable instead when you also need row_count for one table.
+ * Inspect the current canvas before editing, like Pencil get_app_state. The response adds top-level node summaries in canvas order and reusable component ids to the canvas metadata. Use these ids in nodes.list, images.list or an execute script; use the returned version as expected_version to detect concurrent edits. Read full node content with nodes.list rather than guessing fields from these summaries.
  */
-export const databaseListTables = (options) => (options.client ?? client).get({
+export const canvasRetrieveCanvas = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'canvas-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/tables',
+    url: '/canvas/v1/canvases/{canvas_id}',
     ...options
 });
 /**
- * Create table
+ * Update canvas
  *
- * Creates a table together with its initial fields in one call and returns it (HTTP 201) with generated tbl_ and fld_ ids. name must match ^[a-z_][a-z0-9_]{0,62}$ and be unused in this database (duplicate: 409 UNIQUE_VIOLATION). fields is required and may be an empty array; fields can also be added later with databaseAddField. Limits: 50 tables per database, 64 fields per table, and 16 indexed or unique fields per table; exceeding one returns 400 LIMIT_EXCEEDED. Fields default to indexed:false. Set indexed:true explicitly for fields used in filters or ordering. Only indexed:true or unique:true consumes one of the 16 indexed-or-unique field slots; a field with both consumes one slot. Unique fields still consume a slot even with indexed:false. Existing fields are unchanged. Minimal field example: {"name":"notes","type":"string","indexed":false}. Every row also has a system id column, which is not declared as a field. Insert data afterwards with databaseInsert. Unlike Supabase, define schema with this table API and the field APIs; PostgreSQL DDL and SQL migration files cannot be submitted. Each table supports up to 1,000,000 rows.
+ * Rename a canvas or move it to a collection without editing its design content. Use a canvas id from canvases.list and a collection id from collections.list. Send collection_id=null to make it uncategorized; omit either field to preserve its current value. A canvas belongs to at most one collection. The destination must belong to your organization. Renaming keeps the canvas version unchanged.
  */
-export const databaseCreateTable = (options) => (options.client ?? client).post({
+export const canvasUpdateCanvas = (options) => (options.client ?? client).patch({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}/tables',
+    url: '/canvas/v1/canvases/{canvas_id}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5277,45 +5469,67 @@ export const databaseCreateTable = (options) => (options.client ?? client).post(
     }
 });
 /**
- * Delete table
+ * Read canvas nodes
  *
- * Permanently drops a table with all of its rows; the deletion is immediate and has no recovery window or undo. Refused with 409 REFERENCE_RESTRICT while a link field of another table points at this table, so delete or change those fields first. Returns {deleted: true}. A table name can be reused afterwards.
+ * Read node documents for inspection before changing individual nodes. Supply 1–100 comma-separated node ids from retrieve or execute, or instance paths such as a/b. depth is an integer at least 0; omit it for complete subtrees. Each requested id maps to a document wrapper or null if absent. Unlike Figma, document contains a Pencil .pen 2.21 node, not a Figma node. For top-level summaries use canvases.retrieve; for pixels use images.list.
  */
-export const databaseDeleteTable = (options) => (options.client ?? client).delete({
+export const canvasListNodes = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'canvas-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/tables/{table}',
+    url: '/canvas/v1/canvases/{canvas_id}/nodes',
     ...options
 });
 /**
- * Get table
+ * Render canvas nodes
  *
- * Returns one table by id or name with its field definitions, schema_revision and row_count. row_count is only returned by this operation, not by list or create. Use field ids from this response for stable references because field names can be renamed; an unknown table returns 404 TABLE_NOT_FOUND.
+ * Render 1–4 nodes to inspect the visual result of a design edit. Use ids from retrieve, execute.created or execute.screenshots; scale defaults to 1 and accepts 0.25–4, and png is the only supported format. Unlike Figma, images contains inline data:image/png;base64,... URLs, not hosted image URLs; a null entry means no image is available for that id. Use nodes.list for editable node content instead of pixels.
  */
-export const databaseGetTable = (options) => (options.client ?? client).get({
+export const canvasListImages = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'canvas-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/tables/{table}',
+    url: '/canvas/v1/canvases/{canvas_id}/images',
     ...options
 });
 /**
- * Update table
+ * Execute canvas script
+ *
+ * Draw or edit a canvas atomically with a synchronous Pencil execute script. First create a canvas with praxis.canvas.canvases.create and use its id as canvas_id; inspect an existing canvas with retrieve before modifying it. Send exactly one of script (new source) or edit_id (a failed script to patch using edits). Unlike Figma REST, :execute writes design content; nodes use Pencil .pen schema 2.21 (frame/group/rectangle/ellipse/polygon/path/text/icon/ref/note), not Figma node fields.
+ *
+ * The root variable is document. Synchronous functions are Insert / Copy / Update / Replace / Move / Delete / SetVariables / Get / GetVariables / FindEmptySpace / Print / TakeScreenshot; globals persist for the next call. A first frame needs only this body.script:
+ *
+ * ```js
+ * const f = Insert(document, { type: "frame", name: "Hero", width: 1200, layout: "vertical", padding: 48, fill: "#FFFFFF" }); Insert(f, { type: "text", content: "Hello", fontSize: 32, fill: "#111111" }); Print(f)
+ * ```
+ *
+ * Insert/Copy return the new node id; read the copy with Get(id) — copied descendants get new ids, so change them through Copy's third argument `descendants` keyed by the source node ids. To copy a page and change its title in the same script:
+ *
+ * ```js canvas-example="copy-page"
+ * const page = Insert(document, {type:"frame",name:"Original",width:320,height:160,layout:"vertical",padding:16});
+ * const title = Insert(page, {type:"text",name:"Title",content:"Original",fontSize:24});
+ * const copy = Copy(page, document, {name:"Copy",x:360,descendants:{[title]:{content:"Updated"}}});
+ * Print(copy); Print(Get(copy).children[0].content);
+ * ```
+ *
+ * Use viewer_url to watch the result in Console. TakeScreenshot records node ids in screenshots; call images.list with those ids to fetch PNG data URLs. See the [Canvas execute reference](https://deepraxis.com/en/docs/api/native/canvas/execute) for request fields and results, and the [Canvas node reference](https://deepraxis.com/en/docs/developers/canvas/nodes) for node content.
+ *
+ * A successful write increments version by one. Optionally set expected_version to the version from retrieve or nodes.list; on 409 REVISION_CONFLICT read again, merge your intent and retry with the current version. Every script failure rolls back all writes. On 400 SCRIPT_ERROR, SCRIPT_LIMIT or OPS_REJECTED, use error.details.edit_id plus edits to repair and rerun the stored source without resending the entire script; details may include line, column and rejection. On 400 EDIT_EXPIRED the saved script is older than ten minutes: submit a corrected new script. On 429 CANVAS_BUSY, more than four calls are queued for this canvas: wait for pending calls before retrying.
+ *
+ * Execution errors include error.details.prints containing output printed before failure, with the same string-array shape and output limit as successful prints; rolled-back writes still create no version.
  *
- * Renames a table and/or changes its description; send only the keys to change, and send description null to clear it. The new name must follow ^[a-z_][a-z0-9_]{0,62}$ and be unused (409 UNIQUE_VIOLATION); ids are stable, so renaming never rewrites row data. A body with no changes or values equal to the current ones does not bump schema_revision. Fields cannot be changed here; use databaseAddField, databaseUpdateField and databaseDeleteField.
  */
-export const databaseUpdateTable = (options) => (options.client ?? client).patch({
+export const canvasExecute = (options) => (options.client ?? client).post({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'canvas-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/tables/{table}',
+    url: '/canvas/v1/canvases/{canvas_id}:execute',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5323,17 +5537,39 @@ export const databaseUpdateTable = (options) => (options.client ?? client).patch
     }
 });
 /**
- * Add field
+ * List collections
  *
- * Adds one field to an existing table and returns the updated table (HTTP 201). Required inputs are name (lowercase letters, digits and underscores; id and names starting with _ are reserved) and type (string, integer, number, boolean, datetime, json or link); json needs options.schema and link needs options.linked_table_id and options.multiple. Adding a required field to a table that already has rows needs a default, otherwise the call fails with 400 VALIDATION_FAILED; a default is written into every existing row. Fields default to indexed:false. Set indexed:true explicitly for fields used in filters or ordering. Only indexed:true or unique:true consumes one of the 16 indexed-or-unique field slots; a field with both consumes one slot. Unique fields still consume a slot even with indexed:false. Existing fields are unchanged. Minimal field example: {"name":"notes","type":"string","indexed":false}. JSON and link fields cannot be indexed. Limits: 64 fields and 16 indexed or unique fields per table (400 LIMIT_EXCEEDED). Unlike Supabase, schema evolution uses field definitions rather than ALTER TABLE statements or SQL migrations.
+ * Find collections and ids for filtering or moving canvases. All organization collections are returned in name order in one response; next_cursor is always null. canvas_count excludes deleted canvases. total_count counts all live canvases, rather than collections, and uncategorized_count counts live canvases without a collection. Use canvases.list with collection_id to read a collection or none to read uncategorized canvases.
  */
-export const databaseAddField = (options) => (options.client ?? client).post({
+export const canvasListCollections = (options) => (options?.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}/tables/{table}/fields',
+    url: '/canvas/v1/collections',
+    ...options
+});
+/**
+ * Create collection
+ *
+ * Organize canvases by creating a one-level collection in your organization. Send a name of 1–100 characters after trimming; duplicate names are allowed. Each call creates a new collection, initially containing no canvases. Use canvases.update with its id as collection_id to move existing canvases into it. Collections cannot be nested and an organization can have at most 200.
+ */
+export const canvasCreateCollection = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/canvas/v1/collections',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5341,31 +5577,57 @@ export const databaseAddField = (options) => (options.client ?? client).post({
     }
 });
 /**
- * Delete field
+ * Delete collection
  *
- * Deletes one field definition from a table and returns the updated table; the deletion is immediate and has no recovery window. Look the field up by id or name. The field's index, if any, is dropped with it, and the name can be reused afterwards. Unknown fields return 400 FIELD_NOT_FOUND.
+ * Remove a collection using an id from collections.list. All its canvases are preserved and become uncategorized, with collection_id set to null; read them using canvases.list with collection_id=none. The removed collection cannot be retrieved again, and repeating deletion returns COLLECTION_NOT_FOUND.
  */
-export const databaseDeleteField = (options) => (options.client ?? client).delete({
+export const canvasDeleteCollection = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}/tables/{table}/fields/{field}',
+    url: '/canvas/v1/collections/{collection_id}',
     ...options
 });
 /**
- * Update field
+ * Retrieve collection
  *
- * Changes a field's name, description, required flag, indexed flag, default or json options.schema and returns the updated table. The field type, a link field's linked_table_id and the unique flag cannot be changed (400 FIELD_TYPE_IMMUTABLE or INVALID_PARAMS). Setting required to true fails with 400 VALIDATION_FAILED while existing rows hold null for the field. A new json schema constrains only later writes; existing rows are not revalidated. Renaming never rewrites row data, and a request that changes nothing does not bump schema_revision. Unlike Supabase, field types and uniqueness cannot be altered through SQL migrations; use the supported field settings described here.
+ * Inspect one collection and its current live canvas count using an id from collections.list or collections.create. The collection must belong to the API key organization. To read its canvases, pass the same id as collection_id to canvases.list; this response contains collection metadata only.
  */
-export const databaseUpdateField = (options) => (options.client ?? client).patch({
+export const canvasRetrieveCollection = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}/tables/{table}/fields/{field}',
+    url: '/canvas/v1/collections/{collection_id}',
+    ...options
+});
+/**
+ * Rename collection
+ *
+ * Change the display name of a collection from collections.list without changing its id or canvas assignments. Names contain 1–100 characters after trimming and may match another collection name. This operation does not move canvases; use canvases.update with collection_id for that.
+ */
+export const canvasUpdateCollection = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/canvas/v1/collections/{collection_id}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5373,93 +5635,127 @@ export const databaseUpdateField = (options) => (options.client ?? client).patch
     }
 });
 /**
- * List events
+ * List canvas versions
  *
- * Read lifecycle and schema events, including while the database is deleting. next_cursor is an opaque string cursor (do not do arithmetic on it): pass it as after_seq for asc or before_seq for desc. Supplying both cursors returns 400 INVALID_PARAMS. Unlike Supabase Realtime, this is paged lifecycle and schema history, not a subscription or a row-change feed; row inserts, updates and deletes do not appear here.
+ * Inspect retained edits before restoring a canvas or reading historical nodes and images. Supply a canvas_id from canvases.list or create. Results include successful execute, import and restore commits since history was enabled, newest first. limit is 1–100 and defaults to 30; pass next_cursor as cursor until it is null. All versions from the last 30 days are retained unless the 256 MiB history budget requires pruning; the newest 100 versions are always retained regardless of age or size. earliest_restorable_version is the oldest readable and restorable version, including the state immediately before the first retained commit; null means no history has been recorded. Listing does not change the canvas.
  */
-export const databaseListEvents = (options) => (options.client ?? client).get({
+export const canvasListVersions = (options) => (options.client ?? client).get({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}/events',
+    url: '/canvas/v1/canvases/{canvas_id}/versions',
     ...options
 });
 /**
- * Delete rows
+ * Restore canvas version
  *
- * Deletes the rows matched by the filter query parameters (the same filters as databaseSelect); with no filter every row of the table matches. Deletion is immediate and cannot be undone. A row that a link field of another table still references makes the whole call fail with 409 REFERENCE_RESTRICT and nothing is deleted. The default response is 204 with no body; send Prefer: return=representation to get HTTP 200 with the deleted rows.
+ * Recover a canvas after an unwanted edit by restoring a retained version from versions.list or its earliest_restorable_version. This replaces current nodes, variables and themes with the target state and creates one new version; history remains available, so restoring can itself be undone with another restore. Restoring the current version succeeds without creating a version. Optionally guard the write with expected_version from retrieve or nodes.list; if it is stale, inspect current state and retry with the new value. Repeating an unguarded request after another edit can create another restore version. Versions from before history was enabled or outside retention cannot be recovered. Connected viewers resync after a successful restore.
  */
-export const databaseDelete = (options) => (options.client ?? client).delete({
+export const canvasRestoreCanvas = (options) => (options.client ?? client).post({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/database/v1/databases/{database_id}/rest/{table}',
-    ...options
+    url: '/canvas/v1/canvases/{canvas_id}:restore',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Select rows
+ * List records
  *
- * Read matching rows with filters, selected columns and ordering. Returns at most 1000 rows per request, including when limit is omitted. Content-Range reports the actual returned interval and the total when count is requested. PATCH and DELETE are not subject to this read cap. Unlike Supabase, casts, aggregates, spread and join modifiers are unsupported. Each table supports up to 1,000,000 rows. Query budget: 8,000 ms with a shared 3,000,000-row safety ceiling. Create indexes on filtered or sorted fields, or narrow the request when it exceeds its budget. Synchronous SQLite aggregates use candidate-row throughput estimates before execution; deployed Workers freeze clocks during synchronous CPU work, so the timer is not a guaranteed server-side interrupt. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Error table: QUERY_CANCELED / PostgREST 57014 is HTTP 500, retryable=false: Query timed out: index filtered or sorted fields, or narrow the range. DATABASE_INVALID_STATE is HTTP 409 for operations on a deleting database. Cleared or nonexistent databases return DATABASE_NOT_FOUND / HTTP 404. The count is an HTTP Content-Range response header, not a JSON property. Use praxis.database.count in the SDK or codemode to return { count: number | null }; a page length is not a total unless you know all matches fit in that page.
+ * Browse records of one object type and obtain ids for retrieval or edits. Discover objectType with schemas.list; select properties by internal names from properties.list. Omit after for the first page, then copy paging.next.after until no next page is returned. archived defaults to false; use objects.search for property filters.
  */
-export const databaseSelect = (options) => (options.client ?? client).get({
+export const crmObjectsList = (options) => (options.client ?? client).get({
+    querySerializer: { parameters: {
+            associations: { array: { explode: false } },
+            properties: { array: { explode: false } },
+            propertiesWithHistory: { array: { explode: false } }
+        } },
     security: [{
-            key: 'database-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/rest/{table}',
+    url: '/crm/v1/objects/{objectType}',
     ...options
 });
 /**
- * Count rows
+ * Create record
  *
- * Inspect the HTTP row count and range without retrieving row data; send Prefer: count=exact for a filtered count. Returns no body and does not fetch or serialize row data. A known count determines the interval using limit/offset or Range with a default and maximum page size of 1000. Without a count preference, or when the selected count mode cannot supply a total, Content-Range is **. Singular Accept still validates page cardinality. Unlike Supabase, planned and estimated counts do not use PostgreSQL planner estimates. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Use praxis.database.count in the SDK or codemode to return { count: number | null } from this header without retrieving rows.
+ * Create a customer record with property values and optional initial associations. Discover objectType with schemas.list and allowed property names with properties.list; save the returned id for subsequent calls. Each call creates a record. Example for contacts: {"properties":{"email":"person@example.com"}}. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const databaseHead = (options) => (options.client ?? client).head({
+export const crmObjectsCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/rest/{table}',
+    url: '/crm/v1/objects/{objectType}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Archive record
+ *
+ * Archive a record selected from objects.list or objects.search when it should leave active results. This removes it from normal lists without deleting its history; archived=true can be used to read archived records. Confirm objectType and objectId before calling. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Unlike HubSpot, this own-face archive returns HTTP 200 with a JSON refs body instead of HTTP 204.
+ */
+export const crmObjectsArchive = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'crm-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/crm/v1/objects/{objectType}/{objectId}',
     ...options
 });
 /**
- * Update rows
+ * Retrieve record
  *
- * Updates the rows matched by the filter query parameters (the same filters as databaseSelect); with no filter every row of the table matches. The JSON object body lists only the fields to change, other fields keep their values, and id cannot be changed. Values are validated against the field types and the required and unique settings (400 VALIDATION_FAILED, 409 UNIQUE_VIOLATION). The default response is 204 with no body; send Prefer: return=representation to get HTTP 200 with the updated rows. Each changed row's _version increases by one.
+ * Read one record by id from objects.list, objects.search or objects.create. Select property names with properties and associated object types with associations; use idProperty only when objectId is a value of that unique property. Use archived=true to inspect an archived record.
  */
-export const databaseUpdate = (options) => (options.client ?? client).patch({
+export const crmObjectsRetrieve = (options) => (options.client ?? client).get({
+    querySerializer: { parameters: {
+            associations: { array: { explode: false } },
+            properties: { array: { explode: false } },
+            propertiesWithHistory: { array: { explode: false } }
+        } },
     security: [{
-            key: 'database-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/rest/{table}',
-    ...options,
-    headers: {
-        'Content-Type': 'application/json',
-        ...options.headers
-    }
+    url: '/crm/v1/objects/{objectType}/{objectId}',
+    ...options
 });
 /**
- * Insert rows
+ * Update record
  *
- * Insert rows into an existing table after defining its fields; at most 500 rows per request. Each request is atomic: any failure rolls back the entire batch. There are no transactions across requests.
- * Rows are filled to the union of their keys with null; send Prefer: missing=default to use field defaults for missing keys.
- * The default is return=minimal: success returns HTTP 201 with an empty body. Send Prefer: return=representation to return the inserted rows. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. Unlike Supabase, upsert conflicts can target only id or one unique field, not a composite key. Each table supports up to 1,000,000 rows.
+ * Change only the supplied properties of a record selected from objects.list or objects.search. Omitted properties retain their values. Use property names from properties.list and valid stage ids from pipelines.retrieve. Stage-entry requirements must be satisfied by the resulting record; inspect 400 errors before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const databaseInsert = (options) => (options.client ?? client).post({
+export const crmObjectsUpdate = (options) => (options.client ?? client).patch({
     security: [{
-            key: 'database-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/database/v1/databases/{database_id}/rest/{table}',
+    url: '/crm/v1/objects/{objectType}/{objectId}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5467,31 +5763,35 @@ export const databaseInsert = (options) => (options.client ?? client).post({
     }
 });
 /**
- * List knowledge bases
+ * Search records
  *
- * Lists knowledge bases visible to the caller, newest first by default. Use last_id as after to read the next page; for example, ?limit=20.
+ * Find records using text query, property filters and sort order rather than scanning a list. Obtain objectType from schemas.list and filter propertyName values from properties.list. Supply filterGroups, sorts, properties, limit and after; use empty arrays for no filters, sorts or property selection, and an empty after for the first page. Copy paging.next.after with the same query to continue. This operation reads records without changing them.
  */
-export const knowledgeListVectorStores = (options) => (options?.client ?? client).get({
+export const crmObjectsSearch = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores',
-    ...options
+    url: '/crm/v1/objects/{objectType}/search',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Create knowledge base
+ * Batch read records
  *
- * Create a knowledge base, optionally starting ingestion of uploaded file_ids in the same call; no separate attachment or batch is needed for those files. Use the returned id with vectorStores.files.retrieve to poll each attachment until completed, failed or cancelled; store status=completed alone does not mean every file succeeded. Unlike OpenAI vector stores, each file is limited to 100000000 bytes and each account to 100 active/nondeleted stores. Minimal body: {"name":"Refund policies"}.
+ * Read a set of known record ids in one call; use objects.search to discover ids first. Supply inputs with ids plus requested properties; set idProperty only when the inputs use unique-property values rather than record ids.
  */
-export const knowledgeCreateVectorStore = (options) => (options.client ?? client).post({
+export const crmObjectsBatchRead = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores',
+    url: '/crm/v1/objects/{objectType}/batch/read',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5499,45 +5799,53 @@ export const knowledgeCreateVectorStore = (options) => (options.client ?? client
     }
 });
 /**
- * Delete knowledge base
+ * Batch create records
  *
- * Remove a knowledge base from active use while keeping a recovery window. Unlike OpenAI vector stores, native DELETE returns the store with status=deleting and ISO purge_at, retains it for 7 days and is idempotent on repeat. Retrieve remains 200; object operations return 409. Use restore before purge_at to recover it, or purge to remove it irreversibly.
+ * Create several records of one object type using inputs with properties and optional associations. Obtain property names from properties.list; each successful input creates a record, so inspect per-item errors before resubmitting failed inputs. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const knowledgeDeleteVectorStore = (options) => (options.client ?? client).delete({
+export const crmObjectsBatchCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}',
-    ...options
+    url: '/crm/v1/objects/{objectType}/batch/create',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Retrieve knowledge base
+ * Batch update records
  *
- * Retrieves a knowledge base using an id returned by create or list. Add ?expand=files to include the first page of attached files. Soft-deleted stores remain readable with status=deleting until purged.
+ * Apply distinct property patches to existing records identified by inputs[].id. Obtain ids from objects.list or objects.search and property names from properties.list. Omitted properties retain their values; inspect results and errors for each input. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const knowledgeRetrieveVectorStore = (options) => (options.client ?? client).get({
+export const crmObjectsBatchUpdate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}',
-    ...options
+    url: '/crm/v1/objects/{objectType}/batch/update',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Update knowledge base
+ * Batch upsert records
  *
- * Updates an active knowledge base using its returned id. Omitted fields stay unchanged; metadata replaces the whole map. Example body: {"name":"Refund policies"}.
+ * Create records that do not yet exist or update matches using a unique property. Provide idProperty and its value in each input, plus properties; choose a property with hasUniqueValue from properties.list. Inspect each result to determine whether it was newly created. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const knowledgeUpdateVectorStore = (options) => (options.client ?? client).post({
+export const crmObjectsBatchUpsert = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}',
+    url: '/crm/v1/objects/{objectType}/batch/upsert',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5545,17 +5853,17 @@ export const knowledgeUpdateVectorStore = (options) => (options.client ?? client
     }
 });
 /**
- * Search knowledge base
+ * Batch archive records
  *
- * Search ingested text to answer a question or find supporting passages. Native results contain one chunk each, so file_id can repeat; max_num_results counts chunks (1–50, default 10), while the compatible URL groups results by file. Unlike OpenAI vector stores, next_page is always null even when has_more is true. Only completed attachments are searchable. For keyword-only retrieval set ranking_options.hybrid_search to {"embedding_weight":0,"text_weight":1}; omit rewrite_query or set it to false to avoid query rewriting. Unlike OpenAI, ranker auto does not rerank; only default-2024-11-15 requests reranking. Set praxis.explain=true to inspect scores and use returned content[].chunk_id to retrieve a segment.
+ * Archive known records of one object type using inputs[].id from objects.list or objects.search. Archived records leave active lists but retain their history; confirm all ids before calling. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Unlike HubSpot, this own-face archive returns HTTP 200 with a JSON refs body instead of HTTP 204.
  */
-export const knowledgeSearchVectorStore = (options) => (options.client ?? client).post({
+export const crmObjectsBatchArchive = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/search',
+    url: '/crm/v1/objects/{objectType}/batch/archive',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5563,31 +5871,31 @@ export const knowledgeSearchVectorStore = (options) => (options.client ?? client
     }
 });
 /**
- * List files
+ * List properties
  *
- * Lists attached files and their ingestion status, newest attachment first by default. Use last_id as after to continue; ?filter=failed selects files that can be retried.
+ * Inspect the property definitions available for an object type before writing or filtering records. Obtain objectType from schemas.list; reuse each immutable name in record properties and filters. archived defaults to false.
  */
-export const knowledgeListFiles = (options) => (options.client ?? client).get({
+export const crmPropertiesList = (options) => (options.client ?? client).get({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files',
+    url: '/crm/v1/properties/{objectType}',
     ...options
 });
 /**
- * Add file
+ * Create property
  *
- * Attach an uploaded File for asynchronous ingestion, then poll this attachment until status is completed, failed or cancelled before searching. Unlike OpenAI vector stores, the file limit is 100000000 bytes; chunk sizes use estimated tokens rather than a model tokenizer. Text, Markdown, CSV, JSON, HTML, PDF, DOCX, PPTX, XLSX and PNG/JPEG/GIF/WebP images can be extracted; audio and video uploads are not knowledge documents. Images may yield generated descriptions rather than verbatim OCR. auto chunking resolves to static 800/400; explicit sizes are 100–4096 with overlap at most half the size. Each store holds at most 10000 attached files. Reattaching the same file returns its existing record without applying new attributes or chunking; inspect last_error after failure.
+ * Define a property before setting its values on records. Choose objectType from schemas.list and groupName from properties.groups.list; provide an immutable internal name, display label, type and fieldType. Enumeration properties require their valid options. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const knowledgeAttachFile = (options) => (options.client ?? client).post({
+export const crmPropertiesCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files',
+    url: '/crm/v1/properties/{objectType}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5595,45 +5903,45 @@ export const knowledgeAttachFile = (options) => (options.client ?? client).post(
     }
 });
 /**
- * Remove file
+ * Archive property
  *
- * Removes the file from search immediately; does not delete the original File.
+ * Archive a property definition selected by internal name from properties.list. Confirm that record entry and search flows no longer depend on it; archived definitions are excluded from normal property lists. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Unlike HubSpot, this own-face archive returns HTTP 200 with a JSON refs body instead of HTTP 204.
  */
-export const knowledgeRemoveFile = (options) => (options.client ?? client).delete({
+export const crmPropertiesArchive = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}',
+    url: '/crm/v1/properties/{objectType}/{propertyName}',
     ...options
 });
 /**
- * Retrieve file
+ * Retrieve property
  *
- * Retrieves an attached file using the id returned by attachment or file listing. Poll this operation until status leaves in_progress to observe the ingestion outcome.
+ * Inspect the type, options and modification restrictions of a property before changing its definition or record values. Obtain propertyName from properties.list; it is the immutable internal name rather than the label.
  */
-export const knowledgeRetrieveFile = (options) => (options.client ?? client).get({
+export const crmPropertiesRetrieve = (options) => (options.client ?? client).get({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}',
+    url: '/crm/v1/properties/{objectType}/{propertyName}',
     ...options
 });
 /**
- * Update file attributes
+ * Update property
  *
- * Replaces search-filter attributes of an existing attachment without reingesting its content. Use an attached file id. Example body: {"attributes":{"category":"refund"}}; null clears the attributes.
+ * Change editable settings of a property selected from properties.list, such as its label, group or options. Preserve the immutable internal name; inspect modificationMetadata before editing system-managed definitions. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const knowledgeUpdateFile = (options) => (options.client ?? client).post({
+export const crmPropertiesUpdate = (options) => (options.client ?? client).patch({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}',
+    url: '/crm/v1/properties/{objectType}/{propertyName}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5641,31 +5949,31 @@ export const knowledgeUpdateFile = (options) => (options.client ?? client).post(
     }
 });
 /**
- * Read extracted content
+ * List property groups
  *
- * Extracted text chunks may overlap. Image content can be a generated description rather than verbatim OCR.
+ * Discover property groups for an object type before creating or organizing property definitions. Obtain objectType from schemas.list and reuse a group name as groupName in properties.create or properties.update.
  */
-export const knowledgeRetrieveFileContent = (options) => (options.client ?? client).get({
+export const crmPropertiesGroupsList = (options) => (options.client ?? client).get({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}/content',
+    url: '/crm/v1/properties/{objectType}/groups',
     ...options
 });
 /**
- * Create file batch
+ * Create property group
  *
- * Attaches existing Files as a batch for asynchronous ingestion. Supply exactly one of file_ids or files; files allows per-file settings. Existing attachments are reused. Read the returned batch id to monitor status.
+ * Create a named group for related property definitions of one object type. Obtain objectType from schemas.list; choose a unique internal name and display label, then reuse the returned name as groupName when creating properties. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const knowledgeCreateFileBatch = (options) => (options.client ?? client).post({
+export const crmPropertiesGroupsCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches',
+    url: '/crm/v1/properties/{objectType}/groups',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5673,157 +5981,173 @@ export const knowledgeCreateFileBatch = (options) => (options.client ?? client).
     }
 });
 /**
- * Retrieve file batch
+ * List pipelines
  *
- * Retrieves a batch created in this knowledge base, including current status and file counts. Use the batch id returned by batch creation to monitor ingestion.
+ * Discover pipelines and stage ids for records of one object type from schemas.list. Reuse pipeline and stage ids in record property updates or lead qualification. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeRetrieveFileBatch = (options) => (options.client ?? client).get({
+export const crmPipelinesList = (options) => (options.client ?? client).get({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches/{batch_id}',
+    url: '/crm/v1/pipelines/{objectType}',
     ...options
 });
 /**
- * Cancel file batch
+ * Create pipeline
  *
- * Cancels only in-progress batches and pending files. Completed, failed and cancelled batches return unchanged (200, idempotent).
+ * Create a pipeline with its ordered stages for an object type from schemas.list. Provide a display label, displayOrder and initial stages, then use the returned ids when assigning records. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeCancelFileBatch = (options) => (options.client ?? client).post({
+export const crmPipelinesCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches/{batch_id}/cancel',
-    ...options
+    url: '/crm/v1/pipelines/{objectType}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * List batch files
+ * Archive pipeline
  *
- * Lists files still attached from the identified batch, newest attachment first by default. Use the batch creation id and ?filter=failed to inspect failures; last_id is the next after cursor.
+ * Archive a pipeline selected from pipelines.list when records no longer depend on it. Check current records and stage usage first; resolve references reported by validation before retrying. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Unlike HubSpot, this own-face archive returns HTTP 200 with a JSON refs body instead of HTTP 204. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeListBatchFiles = (options) => (options.client ?? client).get({
+export const crmPipelinesArchive = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches/{batch_id}/files',
+    url: '/crm/v1/pipelines/{objectType}/{pipelineId}',
     ...options
 });
 /**
- * Restore knowledge base
+ * Retrieve pipeline
  *
- * Restores a deleting store within 7 days. Active stores return 409 VECTOR_STORE_INVALID_STATE; absent stores return 404. Empty body is allowed.
+ * Inspect the stage ids and metadata of a pipeline before moving a record or editing its workflow. Obtain pipelineId from pipelines.list and use the returned stages array to select a destination. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeRestoreVectorStore = (options) => (options.client ?? client).post({
+export const crmPipelinesRetrieve = (options) => (options.client ?? client).get({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/restore',
+    url: '/crm/v1/pipelines/{objectType}/{pipelineId}',
     ...options
 });
 /**
- * Permanently purge knowledge base
+ * Update pipeline
  *
- * Immediately and irreversibly clears a deleting store using the retention cleanup path. Active stores return 409; absent stores return 404. Empty body is allowed.
+ * Change editable pipeline settings selected by pipelineId from pipelines.list. Omit settings that should remain unchanged and inspect current stages with pipelines.retrieve before modifying the workflow. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgePurgeVectorStore = (options) => (options.client ?? client).post({
+export const crmPipelinesUpdate = (options) => (options.client ?? client).patch({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/purge',
-    ...options
+    url: '/crm/v1/pipelines/{objectType}/{pipelineId}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Retry failed file
+ * Create pipeline stage
  *
- * Retries only failed files; other states return 409 FILE_INVALID_STATE. Retry after failure has not yet been observed in the documented run.
+ * Add an ordered stage to a pipeline from pipelines.list. Provide its display label, displayOrder and metadata; save the returned stage id for record updates. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeRetryFile = (options) => (options.client ?? client).post({
+export const crmPipelinesStagesCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}/retry',
-    ...options
+    url: '/crm/v1/pipelines/{objectType}/{pipelineId}/stages',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * List file segments
+ * Archive pipeline stage
  *
- * Lists the stored chunks of an attached file, ordered by increasing segment index by default. Use the attachment id and last_id as after to continue; returned chunk ids can be retrieved individually.
+ * Archive a stage selected from pipelines.retrieve after checking record usage. A stage that still has records cannot be archived without resolving their assignment; move those records to an allowed stage first. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Unlike HubSpot, this own-face archive returns HTTP 200 with a JSON refs body instead of HTTP 204. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeListSegments = (options) => (options.client ?? client).get({
+export const crmPipelinesStagesArchive = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}/segments',
+    url: '/crm/v1/pipelines/{objectType}/{pipelineId}/stages/{stageId}',
     ...options
 });
 /**
- * Retrieve segment
+ * Update pipeline stage
  *
- * Retrieves one chunk and its term statistics. Take chunk_id from segment listing or native search content; the chunk must belong to this knowledge base.
+ * Change the label, order or metadata of a stage selected from pipelines.retrieve. Existing records must satisfy entry rules when subsequently moved; omitted settings retain their values. Stage rules are string values in stage.metadata: praxis_category is open (active), won (successful) or lost (unsuccessful); praxis_terminal is "true" (no further transition) or "false" (transitions allowed); praxis_allowed_next is a JSON-encoded array string of permitted next stage ids, with the string "null" meaning unrestricted; praxis_required is a JSON-encoded array string of property names ("[]" means none) that must be non-empty on entry (boolean properties must be "true"). Rule violations return HTTP 400 VALIDATION_ERROR; errors[0].context.properties lists missing required property names. Correct those values or choose an allowed stage before retrying. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Example metadata: {"praxis_category":"open","praxis_terminal":"false","praxis_allowed_next":"[\"proposal\",\"lost\"]","praxis_required":"[\"budget\",\"decision_maker\"]"}.
  */
-export const knowledgeRetrieveSegment = (options) => (options.client ?? client).get({
+export const crmPipelinesStagesUpdate = (options) => (options.client ?? client).patch({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/segments/{chunk_id}',
-    ...options
+    url: '/crm/v1/pipelines/{objectType}/{pipelineId}/stages/{stageId}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * List events
+ * List record associations
  *
- * Reads events for this knowledge base in increasing sequence order, including while soft-deleted. Pass next_seq as after_seq to continue; null next_seq marks the current end. Example: ?after_seq=0&limit=20.
+ * Read records linked to a source record, including association labels and type ids. Obtain source and destination object types from schemas.list and objectId from objects.list or objects.search. Follow paging.next.after to continue reading associated records.
  */
-export const knowledgeListEvents = (options) => (options.client ?? client).get({
+export const crmAssociationsList = (options) => (options.client ?? client).get({
     security: [{
-            key: 'knowledge-bearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/knowledge/v1/vector_stores/{vector_store_id}/events',
+    url: '/crm/v1/objects/{objectType}/{objectId}/associations/{toObjectType}',
     ...options
 });
 /**
- * List libraries
+ * Remove association
  *
- * List libraries owned by the caller, newest first. By default, deleting and deleted libraries are excluded; use status=deleting to find libraries awaiting purge. All supplied label pairs must match.
+ * Remove the association between two existing records without archiving either record. Obtain the linked destination id from associations.list and confirm the source and destination object types before calling. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations. Unlike HubSpot, this own-face archive returns HTTP 200 with a JSON refs body instead of HTTP 204.
  */
-export const mediaListLibraries = (options) => (options?.client ?? client).get({
+export const crmAssociationsRemove = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries',
+    url: '/crm/v1/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}',
     ...options
 });
 /**
- * Create library
+ * Create labelled association
  *
- * Create a library owned by the caller with a name, optional labels and understanding settings. Understanding is enabled by default; the returned id is used for subsequent asset operations.
+ * Associate two existing records using the requested association category and type id. Obtain record ids from objects.list or objects.search; reuse known association type ids from associations.list. Send the association-spec array as the body; use associations.createDefault when no label is needed. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const mediaCreateLibrary = (options) => (options.client ?? client).post({
+export const crmAssociationsCreate = (options) => (options.client ?? client).put({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries',
+    url: '/crm/v1/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5831,45 +6155,45 @@ export const mediaCreateLibrary = (options) => (options.client ?? client).post({
     }
 });
 /**
- * Delete library
+ * Create default association
  *
- * Soft-delete an active library, returning its deleting status and purge_at deadline. Asset operations and delivery become unavailable; the library can be restored before purge_at. Repeated deletion while deleting returns the current library.
+ * Link two existing records with the default unlabelled association. Obtain each record id from objects.list or objects.search for its type. No request body is required; use associations.create to choose explicit association labels. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const mediaDeleteLibrary = (options) => (options.client ?? client).delete({
+export const crmAssociationsCreateDefault = (options) => (options.client ?? client).put({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}',
+    url: '/crm/v1/objects/{objectType}/{objectId}/associations/default/{toObjectType}/{toObjectId}',
     ...options
 });
 /**
- * Get library
+ * List object schemas
  *
- * Read a caller-owned library’s current settings, usage and lifecycle status. A deleting library remains readable; missing, foreign or purged libraries return LIBRARY_NOT_FOUND.
+ * Discover available object schemas, display labels, property definitions and association definitions. Reuse the object type identifier or name in record, property and pipeline operations. archived defaults to false; the include parameters control the definition and audit details returned.
  */
-export const mediaGetLibrary = (options) => (options.client ?? client).get({
+export const crmSchemasList = (options) => (options?.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}',
+    url: '/crm/v1/schemas',
     ...options
 });
 /**
- * Update library
+ * Create object schema
  *
- * Update an active library’s supplied settings. Labels replace the complete map; understanding settings and model roles merge with current values. Changing the embedding model is rejected while assets exist.
+ * Define a custom CRM object type before creating its records. Provide its immutable name, singular and plural labels, primaryDisplayProperty, properties and associated object types. Save the returned object type identifier for subsequent record and property operations. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const mediaUpdateLibrary = (options) => (options.client ?? client).patch({
+export const crmSchemasCreate = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}',
+    url: '/crm/v1/schemas',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5877,59 +6201,63 @@ export const mediaUpdateLibrary = (options) => (options.client ?? client).patch(
     }
 });
 /**
- * Restore library
+ * Qualify lead
  *
- * Restore a deleting library before its purge_at deadline. The library becomes active again and deleted_at and purge_at are cleared; expired or non-deleting libraries cannot be restored.
+ * Qualify a lead with explicit contact, company and optional deal choices in one operation. Unlike HubSpot, CRM exposes these decisions as a single action because qualification coordinates several related record edits rather than editing only the lead stage. Obtain leadId from objects.list for leads and qualifiedStageId from its pipeline; choose a won stage and satisfy its required properties. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const mediaRestoreLibrary = (options) => (options.client ?? client).post({
+export const crmLeadsQualify = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}/restore',
-    ...options
+    url: '/crm/v1/leads/{leadId}:qualify',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Purge library
+ * Revert change set
  *
- * Permanently remove a library that is already deleting, without waiting for purge_at. Its assets and related resources are removed and cannot be restored; first soft-delete an active library.
+ * Reverse property changes made by one earlier request. Unlike HubSpot, CRM exposes change-set reversal because agents need to undo a whole recorded action rather than manually reconstructing individual values. Supply the changeSetId recorded in property history. A later conflicting value prevents reversal with HTTP 409 CONFLICT; inspect current records before resolving the conflict. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const mediaPurgeLibrary = (options) => (options.client ?? client).post({
+export const crmChangesRevert = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}/purge',
+    url: '/crm/v1/changes/{changeSetId}:revert',
     ...options
 });
 /**
- * List assets
+ * Retrieve record layout
  *
- * List assets in an active library, newest first, optionally filtering by exact folder and stored resource type. Continue using next_cursor; video includes audio-only assets.
+ * Read the shared record-page layout for an object type from schemas.list. Unlike HubSpot, CRM exposes this presentation as an API resource so people and agents can share the same record layout instead of relying on interface-only settings. The response orders summary tiles, sidebar properties and main-column sections.
  */
-export const mediaListAssets = (options) => (options.client ?? client).get({
+export const crmLayoutsRetrieve = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}/assets',
+    url: '/crm/v1/layouts/{objectType}',
     ...options
 });
 /**
- * Upload asset
+ * Update record layout
  *
- * Upload content into an active library and return a Cloudinary-compatible resource. Use file for a multipart file, data URI, public HTTPS URL or same-owner file identifier. Reusing public_id overwrites by default; overwrite=false returns the existing resource. Chunk uploads require both chunk headers.
+ * Replace the shared record-page layout for an object type from schemas.list. Unlike HubSpot, CRM exposes this presentation as an API resource so agents can configure the same record view used by people. Send the complete layout with at most three summary tiles and property names from properties.list; omitted prior sections are removed. Writes return refs (ResourceRef[]) for entity cards and optional property changes in conversations.
  */
-export const mediaUploadAsset = (options) => (options.client ?? client).post({
+export const crmLayoutsUpdate = (options) => (options.client ?? client).put({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'crm-bearerAuth',
             scheme: 'bearer',
             type: 'http'
         }],
-    url: '/media/v1/libraries/{library_id}/assets',
+    url: '/crm/v1/layouts/{objectType}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5937,17 +6265,39 @@ export const mediaUploadAsset = (options) => (options.client ?? client).post({
     }
 });
 /**
- * Import file
+ * List projects
  *
- * Copy source content into an active library using upload options and return the full native Asset. The imported asset is independent of the source after copying. Reusing public_id follows overwrite semantics.
+ * Discover projects owned by the API key organization and obtain project_id values. Results default to active projects ordered by updateTime descending; use filter state = "deleted" to find retained deleted projects for undelete. Continue with next_page_token as page_token until the token is absent.
  */
-export const mediaImportAsset = (options) => (options.client ?? client).post({
+export const cutListProjects = (options) => (options?.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/assets/import',
+    url: '/cut/v1/projects',
+    ...options
+});
+/**
+ * Create project
+ *
+ * Create a blank editing project in the API key organization before writing a script. First obtain accessible library ids from praxis.media; bindings must include exactly one read_write library with default_upload true. Each call creates a new project and returns HTTP 201; save its id for execute, state and timeline calls. All editing positions use seconds.
+ */
+export const cutCreateProject = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/projects',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -5955,45 +6305,57 @@ export const mediaImportAsset = (options) => (options.client ?? client).post({
     }
 });
 /**
- * Delete asset
+ * Delete project
  *
- * Delete an asset from the library so it is no longer readable, searchable or deliverable. This removes the asset rather than placing it in the library’s restoration window; a missing asset returns ASSET_NOT_FOUND.
+ * Soft-delete a project selected from projects.list. The project is retained for seven days until purge_time and can be restored with undelete before that deadline. Deleted projects cannot be edited; list with filter state = "deleted" to locate retained projects.
  */
-export const mediaDeleteAsset = (options) => (options.client ?? client).delete({
+export const cutDeleteProject = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/assets/{asset_id}',
+    url: '/cut/v1/projects/{project_id}',
     ...options
 });
 /**
- * Get asset
+ * Retrieve project
  *
- * Read a non-deleted asset by its asset_id in an active library, including content hashes, processing progress and available previews. Missing or deleted assets return ASSET_NOT_FOUND.
+ * Inspect project metadata, settings and library bindings before editing. Copy id from projects.create or list; expand=timeline,exports,versions includes selected related resources. The expanded timeline uses seconds and the returned revision can guard a later execute call with expected_revision.
  */
-export const mediaGetAsset = (options) => (options.client ?? client).get({
+export const cutRetrieveProject = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/assets/{asset_id}',
+    url: '/cut/v1/projects/{project_id}',
     ...options
 });
 /**
- * Update asset
+ * Update project metadata
  *
- * Update an asset’s supplied metadata fields. Tags and context replace their current collections; an empty collection clears them. Moving asset_folder or changing display_name preserves public_id and delivery URLs.
+ * Change the project display name or replace its labels by naming those fields in update_mask. Use execute for clip or track edits. Each successful update commits a new revision; labels are replaced as a whole when selected, so read and merge existing labels before overwriting them.
  */
-export const mediaUpdateAsset = (options) => (options.client ?? client).patch({
+export const cutUpdateProject = (options) => (options.client ?? client).patch({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/assets/{asset_id}',
+    url: '/cut/v1/projects/{project_id}',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6001,17 +6363,173 @@ export const mediaUpdateAsset = (options) => (options.client ?? client).patch({
     }
 });
 /**
- * Reprocess asset
+ * Restore deleted project
  *
- * Queue reprocessing of the asset’s current version and return its updated state immediately. Omit kinds to retry failed tasks; explicit kinds rerun applicable completed tasks. Replaced understandings become superseded, and processing finishes asynchronously.
+ * Return a retained deleted project to active state before its purge_time. Obtain project_id from projects.list filtered to deleted projects. This restores the project, not an older timeline revision; use versions.restore when reverting editing content.
  */
-export const mediaReprocessAsset = (options) => (options.client ?? client).post({
+export const cutUndeleteProject = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/assets/{asset_id}/reprocess',
+    url: '/cut/v1/projects/{project_id}:undelete',
+    ...options
+});
+/**
+ * Execute editing script
+ *
+ * Edit the current timeline atomically using synchronous JavaScript source. Read state or timeline first, then pass its revision as expected_revision to detect concurrent changes. Unlike Shotstack, execute applies script edits to a persistent project in one transaction. Provide script or a saved edit_id with literal edits, never both; failures roll back writes. A revision conflict while preparing the response may follow a committed edit: retrieve state before retrying. Minimal script after creating a project: `const t = AddTrack("video"); Insert(t, {type: "color", color: "#123456", start: 0, length: 3}); Print(t);`
+ *
+ * ### Script function reference
+ *
+ * Functions are synchronous globals; do not import them. `project` is the current project ID. TrackId and ClipId are strings returned by AddTrack and Insert or read from GetTimeline. JoinId is the string returned by Join or read from GetTimeline().joins. Reads see earlier writes in the same script.
+ *
+ * ```ts
+ * GetTimeline(o?: { from?: number; to?: number; tracks?: TrackId[] }): TimelineView;
+ * GetItem(id: ClipId): ItemView;
+ * FindItems<T>(visit: (item: ItemView, ctx: { track: TrackView; index: number }) => T | undefined): T[];
+ * GetMedia(ref: MediaRef): MediaInfo;
+ * GetTranscript(ref: MediaRef, o?: { from?: number; to?: number }): Word[];
+ * GetAnalysis(ref: MediaRef, kind: AnalysisKind): Segment[];
+ * ListTransitions(): TransitionInfo[];
+ * ListEffects(): EffectInfo[];
+ * ListTextStyles(): TextStylePreset[];
+ * ListTextTemplates(): TextTemplate[];
+ * ListAnimations(): { id: string; version: number; phase: "in" | "out" | "loop"; target: "any" | "text"; name: string; description: string; defaultDuration: number; params: { name: string; type: string; values?: string[]; default?: string | number; min?: number; max?: number; description: string }[] }[];
+ * ListFonts(): { family: string; weights: number[]; scripts: ("latin"|"cjk")[]; source: "bundled"|"catalog" }[];
+ * Insert(track: TrackId, item: ItemInit, o?: { ripple?: boolean }): ClipId;
+ * Update(id: ClipId, patch: ItemPatchView): void;
+ * SetSpeed(id: ClipId, rate: number | { curve: { at: number; rate: number; ease?: Ease }[]; audio?: "mute" | "resample" }, o: { keep: "source" | "duration"; ripple?: boolean }): { length: number; sourceOut: number };
+ * Delete(id: ClipId, o?: { ripple?: boolean }): void;
+ * Join(left: ClipId, right: ClipId, o: { length?: number; effect: TransitionInput }): JoinId;
+ * UpdateJoin(id: JoinId, patch: { length?: number; effect?: TransitionInput }): void;
+ * DeleteJoin(id: JoinId): void;
+ * Split(id: ClipId, at: number): ClipId;
+ * Trim(id: ClipId, edge: "in" | "out", delta: number, o?: { ripple?: boolean }): void;
+ * Move(id: ClipId, start: number, track?: TrackId): void;
+ * RippleDeleteRange(from: number, to: number, tracks?: TrackId[]): void;
+ * AddTrack(kind: "video" | "audio" | "caption", init?: { name?: string; role?: "voice" | "music" | "sfx" }, index?: number): TrackId;
+ * UpdateTrack(id: TrackId, patch: TrackPatch): void;
+ * DeleteTrack(id: TrackId): void;
+ * SetSettings(patch: Partial<ProjectSettingsView>): void;
+ * AddCaptionsFromTranscript(track: TrackId, source: ClipId, o?: { style?: Partial<CaptionStyle> & { preset?: string }; maxChars?: number }): ClipId[];
+ * InsertTemplate(track: TrackId, o: { template: string; start: number; slots?: Record<string, string> }): ClipId[];
+ * AlignCaptions(trackId: TrackId, script: string, options?: { resplit?: boolean; maxChars?: number }): { replaced: number; added: number; deleted: number };
+ * ImportCaptions(trackId: TrackId, text: string, o?: { format?: "srt" | "vtt"; offset?: number }): ClipId[];
+ * ExportCaptions(trackId: TrackId, o: { format: "srt" | "vtt" }): string;
+ * SetMarker(at: number, label: string): string;
+ * Print(...values: unknown[]): void;
+ * Preview(at: number[]): void;
+ * ```
+ *
+ * | Functions | Behavior and arguments |
+ * | --- | --- |
+ * | GetTimeline, GetItem | Read compact item views: id, track, type, start, end, length, optional media, playback, sourceIn/sourceOut, text, effects, blend and offline reason. GetTimeline returns duration, tracks (id, kind, name, index, locked, items), and joins (id, track, left, right, length in seconds, normalized effect). from/to and tracks narrow the items and joins; joins are selected by their overlap window. |
+ * | ListEffects | Discover the shared visual-effect catalog with parameter types, ranges, defaults, cost and bounds. Effects are supported only on visual clips. |
+ * | ListTransitions | Discover the shared validation catalog: each entry contains kind (effect ID), name, description and params. Each parameter has name, type (enum/number/integer), default, description, enum values or numeric min/max. Use the returned kind and parameter names inside effect. |
+ * | ListAnimations | Discover animation presets. Each entry has id, version, phase (`in`, `out`, `loop`), target (`any`, `text`), name, description, defaultDuration (seconds), and params (name, type, values/default/min/max/description as applicable). A slot use is `{preset, duration?, ...params}`; duration is seconds. |
+ * | FindItems | Visit items with their track and index; return undefined to omit an item, any other value to collect it. |
+ * | GetMedia | Read metadata for `{libraryId, assetId}` in a bound library: kind, dimensions, fps, hasAudio and durationUs when available. durationUs is microseconds. |
+ * | GetTranscript, GetAnalysis | Read available transcript words or silence/filler/scenes segments. Transcript filter from/to is seconds; returned word and segment from/to values are source microseconds (divide by 1,000,000 for editing). Words contain text and optional speaker/filler; segments may include label/confidence. Request analysis first if unavailable. |
+ * | Insert, Update, Delete | Insert returns the new clip ID; Update changes supplied fields; Delete removes the clip. Optional ripple on Insert/Delete closes or opens space on the track. |
+ * | SetSpeed | Change video/audio rate in 0.25–4; keep is required. A `{curve: [{at, rate, ease?}, ...], audio?: "mute" | "resample"}` rate is forward-only and holds output duration fixed; pitch preservation is unavailable. Scalar rates: source preserves consumed source and changes length; duration preserves output length. Returns actual length and sourceOut in seconds. Optional ripple explicitly shifts same-track followers when keeping source; otherwise overlaps are rejected. |
+ * | Join, UpdateJoin, DeleteJoin | Join creates an overlap between two butt-adjacent visual clips on the same track and returns its ID. length defaults to 0.5 seconds; effect is required. The right clip and all same-track followers move left by length, shortening that track and potentially the project. UpdateJoin moves those followers by the difference in length; omitted fields are preserved. DeleteJoin moves them right to restore the butt cut. Other tracks stay in place. |
+ * | Split, Trim, Move | Split at a timeline position and return the new right-hand clip ID. Trim changes the in or out edge by delta seconds. Move sets the timeline start and optionally a new track. |
+ * | RippleDeleteRange | Delete a timeline interval and close its gap on the specified tracks, or all unlocked tracks when omitted. |
+ * | AddTrack, UpdateTrack, DeleteTrack | Add video/audio/caption tracks; index selects layer order (0 is top). TrackPatch supports name, locked, hidden, muted, gainDb, audio role (`voice`, `music`, `sfx`) and style as appropriate to track kind. |
+ * | SetSettings | Supply any of width/height (pixels), fps (frames per second), background (color). |
+ * | AddCaptionsFromTranscript | Create captions from an audio/video clip's kept words. Optional maxChars is 1–1000, default 16; style updates the caption track. Returns caption IDs. |
+ * | ImportCaptions, ExportCaptions | Import SRT or WebVTT text onto a caption track and export it back. format is inferred from a WEBVTT header when omitted. offset shifts imported cues in seconds. Import rejects more than 100000 bytes, more than 5000 cues, malformed or overlapping file cues with INVALID_CAPTION_FILE; overlap with existing timeline clips uses the normal OVERLAP rejection. Export sorts by timeline start and writes millisecond timecodes. |
+ * | SetMarker | Add a label at a timeline time and return its ID. |
+ * | Print, Preview | Print appends text to prints. Preview requests up to eight times total per execute and puts images in the result's frames. Each url is an inline PNG data URL, not an HTTP image link. Decode the base64 payload to save an image. Codemode returns at most four images per call; request at most four times there. |
+ *
+ * #### Joins between clips
+ *
+ * Endpoints may be video, image, text, color or shape; audio and caption are rejected. Require 0 < length < each endpoint's length. Each clip allows at most one incoming and one outgoing join; their summed lengths cannot exceed its length. Three-input overlaps, nonadjacent endpoints and cross-track joins are rejected with OPS_REJECTED. Read the rejection's code and message, shorten or remove conflicting joins, and retry the saved edit.
+ *
+ * TransitionInput is an object with kind plus the parameters returned by ListTransitions; omitted parameters use catalog defaults. Unknown kinds and invalid parameters return INVALID_TRANSITION_PARAM with available parameters. Effects: dissolve; dip color black/white default black; push and wipe direction left/right/up/down default left; wipe softness 0–1 default 0; iris centerX/centerY 0–1 default 0.5; blinds integer count 2–64 default 8 and orientation vertical/horizontal default vertical; blur radius 0–100 pixels at 1080-pixel frame height default 24; zoom direction in/out default in, amount 0.1–3 default 1, blur 0–1 default 0.5; clock direction clockwise/counterclockwise default clockwise, startAngle 0–360 degrees default 0 (twelve o'clock), softness 0–1 default 0; flash color white/black default white, intensity 0–1 default 1. Zoom blur uses up to eight radial samples per shot and is slower on server rendering. Join options and UpdateJoin patches accept only length and effect. Effect updates replace the effect object and apply defaults for omitted parameters.
+ *
+ * Minimal example on an existing visual track with adjacent clips left and right: `Print(ListTransitions()); const j = Join(left, right, {length: 0.5, effect: {kind: "dissolve"}}); Print(GetTimeline().joins); Preview([GetItem(right).start + 0.25]);` Use `UpdateJoin(j, {length: 0.8})` to adjust it in a later edit or `DeleteJoin(j)` to restore the cut. Preview uses server-rendered frames and includes joins. Per-clip transitionIn/transitionOut remain separate entrance/exit effects.
+ *
+ * #### Insert fields (ItemInit)
+ *
+ * Every item requires `type` and `start`. Times used for editing are seconds and snap to the project frame rate: start, length, sourceIn, fadeIn/fadeOut, transition length, keyframe at, reveal delay/stagger/duration. Keyframe and reveal times are relative to the clip start. Video/audio may omit length to use the remaining source duration; other types require length.
+ *
+ * | type | Required fields beyond type/start | Optional fields |
+ * | --- | --- | --- |
+ * | video | media | length, sourceIn, playback, volumeDb, transform, fit, blend, animate, animation, effects, mask, transitionIn, transitionOut |
+ * | image | media, length | transform, fit, blend, animate, animation, effects, mask, transitionIn, transitionOut |
+ * | text | text, length | style, transform, blend, reveal, animate, animation, effects, mask, transitionIn, transitionOut |
+ * | color | color, length | transform, fill, blend, animate, animation, effects, mask, transitionIn, transitionOut |
+ * | shape | shape, length, width, height, fill | radius, stroke, transform, blend, animate, animation, effects, mask, transitionIn, transitionOut |
+ * | audio | media | length, sourceIn, playback, volumeDb, gain, fadeIn, fadeOut, duck |
+ * | caption | text, length | — |
+ *
+ * Visual Insert/Update also accepts `blend`: `normal` (default), `screen`, `multiply`, `overlay`, or `add`; set it to null in Update to clear it. During a Join overlap, both inputs render with normal blending. Video tracks accept video/image/text/color/shape; audio and caption tracks accept their corresponding type. Media is `{libraryId: string, assetId: string}` from a bound library. sourceIn defaults to 0, volumeDb to 0 dB, audio fades to 0 seconds. fit defaults to contain: contain fits the whole image, cover fills and crops, fill stretches, none keeps native dimensions.
+ *
+ * | Field | Value |
+ * | --- | --- |
+ * | transform | Partial `{x, y, scale, rotation, opacity, crop, blur}`. x/y are normalized canvas center coordinates (default 0.5); scale 1 is fitted size; rotation is degrees (default 0); opacity is 0–1 (default 1). crop is `{top,right,bottom,left}`. blur is 0–100 pixels at 1080-pixel frame height. |
+ * | style | Partial `{fontFamily, fontSize, fontWeight, color, fill, stroke, strokes, shadows, glow, background, align, maxWidth, position, margin}`. fill accepts a color or linear/radial gradient across the entire text bounding box. strokes draw outside to inside; at most 4, width 0–40. shadows accepts at most 4 `{color,x,y,blur}` entries; blur is 0–100. glow is `{color,radius,strength}` with radius 0–100 and strength 0–1. All dimensions use pixels at 1080 frame height and scale with the text. Glow and large shadow blur increase render time. Invalid colors or ranges return actionable INVALID_STYLE errors. `ListFonts()` discovers family, available weights, scripts and bundled/catalog source. Text and captions share the style fields; caption style additionally supports highlightColor and maxLines: 2. |
+ * | animate | An object keyed by x, y, scale, rotation, opacity or blur. Each value is an array of `{at: number, value: number, ease?: Ease}` sorted by at with distinct frame-snapped times. Values hold before the first and after the last keyframe, overriding the static transform. |
+ * | animation | `{in?: AnimationUse, out?: AnimationUse, loop?: AnimationUse}` on visual clips. Each use is `{preset: string, duration?: number, ...params}`; duration and parameter units follow `ListAnimations()`. Presets replace existing animate and reveal when applied. Update accepts `animation: null` to clear the preset and its generated effects. |
+ * | Ease | linear, in, out, inOut, `{bezier: [x1,y1,x2,y2]}` or `{spring: {stiffness, damping, mass?}}`. Easing shapes the segment arriving at that keyframe; springs may overshoot. |
+ * | reveal | `{by, delay?: number, stagger: number, duration: number, from: {y?, opacity?, scale?, blur?}, ease?: Ease}`. by selects char, word or line. Unit k starts at delay + k * stagger and takes duration seconds to reach its resting state; from.y is a fraction of font size. |
+ * | fill | A color string (#RRGGBB or #RRGGBBAA), `{linear: {angle, stops: [{at,color}, ...]}}` or `{radial: {stops: [{at,color}, ...]}}`. Stop positions are 0–1; angle is degrees, 0 left to right. On color clips, fill replaces color when supplied. |
+ * | shape, width, height, radius, stroke | shape is rect or ellipse. width/height are fractions of canvas width/height before scaling. radius rounds rect corners in pixels at 1080-pixel frame height. stroke is `{color: string, width: number}`. |
+ * | transitionIn, transitionOut | `{kind, length: number}` at the clip's beginning/end. length is seconds. fade changes opacity; dissolve blends; push_left/push_right move horizontally; wipe_left reveals horizontally. |
+ *
+ * #### Visual effects
+ *
+ * `effects` is an ordered stack of at most 8 catalog entries. Call `ListEffects()` to discover the catalog; unknown kinds return `UNKNOWN_EFFECT`, invalid names/values/keyframes return `INVALID_EFFECT_PARAM`, and stacks over 8 return `TOO_MANY_EFFECTS`. Entries include blur, color adjustment, vignette, film grain, chromatic aberration, pixelate, glitch, shake, flash, light leak and built-in `lut` looks; user `.cube` LUTs are not supported. `speed` is cycles per second. Effects run on CPU during export and increase render time. Parameters are discovered with ListEffects(). Catalog entries expose their own parameters through ListEffects(), including `blur` (`radius` 0–100, default 24) and `color_adjust`: `brightness`, `contrast`, `temperature`, and `tint` each range -1–1 (default 0), while `saturation` ranges 0–2 (default 1). Disabled entries are skipped. `color_adjust` uses an SDR-only Rec.709 adjustment matrix with no color management.
+ *
+ * Numeric and integer effect parameters accept `keyframes: {parameter: [{at, value, ease?}, ...]}`; times are seconds relative to the clip, snap to frames like `animate`, must be strictly increasing and within clip duration, and values follow that parameter's catalog range. Omitted parameters use catalog defaults. Trim and Split preserve effect keyframes with the same clip-local behavior as `animate`. There are no custom shaders.
+ *
+ * `blend` applies to the completed visual layer after its content, effects and `transform.blur`; `add` maps to Skia Plus. The default `normal` path adds no blend layer. During Join overlaps, blending is forced to normal because each input is composed on transparency.
+ *
+ * #### Update fields (ItemPatchView)
+ *
+ * All fields are optional; use only fields relevant to the item's type. Supported fields: start, length, sourceIn, playback, volumeDb, transform, fit, text, style, color, fadeIn, fadeOut, duck, animate, reveal, animation, fill, stroke, shape, width, height, radius, transitionIn, transitionOut, effects, blend, mask, gain. Values and units match Insert; set effects or blend to null to clear them. Set animation to null to clear the preset; set animate or reveal to null to remove that effect. Applying a preset replaces existing animate/reveal. Do not set animation together with animate or reveal in one Insert/Update call. Omit a field to preserve it.
+ *
+ * #### Animation presets
+ *
+ * Discover the catalog with `ListAnimations()`. Its entries contain id, version, phase (`in`, `out`, `loop`), target (`any` or `text`), name, description, defaultDuration in seconds, and params. Slots may combine one in, one out and one loop preset. A loop runs only in the interval between in and out; if the same property is animated by multiple slots, loop occupies only that middle interval. Text-target presets are entrances. Their duration controls the rhythm per character/word/line, not the total reveal time. Out and loop presets apply to the whole clip, not per text unit.
+ *
+ * Presets replace the clip's existing animate and reveal when applied. The source preset is retained, so changing clip length or transform automatically regenerates its keyframes/reveal. If a clip becomes shorter, in/out durations shrink proportionally; when it grows, the requested durations are restored. Split keeps in on the left, out on the right, and loop on both. Writing animate or reveal directly detaches the preset; setting animation to null clears both source and generated effects. Insert/Update reject a call that supplies animation together with animate or reveal.
+ *
+ * Errors: UNKNOWN_ANIMATION (unknown preset), INVALID_ANIMATION_PARAM (invalid slot/parameter or frame/keyframe limit), ANIMATION_TOO_LONG (in+out exceed clip length), ANIMATION_TARGET_MISMATCH (text-only preset on a non-text or preset on non-visual clip), ANIMATION_PHASE_MISMATCH (preset in the wrong slot). Each animated property is limited to 600 keyframes; loop duration must be at least 4 frames. `ANIMATION_TOO_LONG` is avoided during later length changes by proportional fitting.
+ *
+ * #### Speed, reverse and freeze
+ *
+ * Video/audio Insert and Update accept playback as `{kind: "rate", rate: number, direction: "forward" | "reverse", audio: "preservePitch" | "resample" | "mute"}` or `{kind: "freeze"}`. Rate is finite and inclusive 0.25–4. Omitted playback defaults to 1× forward with preservePitch; supply the complete rate object when changing playback. preservePitch keeps pitch, resample changes pitch with speed, mute removes audio. Reverse requires explicit audio: "mute"; preservePitch/resample are rejected with UNSUPPORTED_PLAYBACK rather than silently muted. Freeze holds sourceIn and is silent. GetItem/GetTimeline echo playback and the source interval in seconds; sourceOut is exclusive even for reverse and equals sourceIn for freeze.
+ *
+ * Update of playback keeps output length unless length is also supplied. SetSpeed preserves direction/audio, rejects frozen and non-video/audio clips, and requires keep: "source" or "duration". keep: "source" computes round(consumed source / new rate × fps) frames, falling back to floor if rounding would exceed the source end; the returned length/sourceOut are actual frame-rounded seconds. keep: "duration" keeps output length and changes source consumption. Length conflicts fail with OVERLAP; move/shorten the conflicting clip, keep duration, or explicitly use ripple: true to shift following clips on the same track. Source overflow fails with OUT_OF_SOURCE; rate limits fail with RATE_OUT_OF_RANGE. Unknown playback fields and SetSpeed options are rejected with UNKNOWN_FIELD; options only accept keep and boolean ripple.
+ *
+ * Example for an existing four-second video/audio clip id: `Print(SetSpeed(id, 0.5, {keep: "source"})); Print(SetSpeed(id, 2, {keep: "source"}));` returns lengths 8 then 2, keeping the same source interval. Reverse: `Update(id, {playback: {kind: "rate", rate: 1, direction: "reverse", audio: "mute"}})`. Freeze: `Update(id, {playback: {kind: "freeze"}})`. Ensure enough source remains for the chosen length/rate. Browser reverse playback currently displays a placeholder; server-rendered Preview/frames and exports support reverse normally. Speed-adjusted audio is generated asynchronously after the edit transaction commits; exports wait for that audio before rendering.
+ *
+ * #### Script names versus HTTP response names
+ *
+ * Use camelCase inside scripts, including nested objects. HTTP request/response JSON outside script source uses snake_case. Map media.library_id → media.libraryId, media.asset_id → media.assetId, source_in → sourceIn, volume_db → volumeDb, fade_in/fade_out → fadeIn/fadeOut, transition_in/transition_out → transitionIn/transitionOut, font_family/font_size/font_weight/max_width → fontFamily/fontSize/fontWeight/maxWidth, gain_db → gainDb, highlight_color/max_lines → highlightColor/maxLines. Fields such as animate, reveal, fill, stroke, at and length retain their spelling. GetTimeline/GetItem already return camelCase compact views; the expanded retrieveTimeline HTTP response is not an Insert object.
+ *
+ * Unrecognized script fields fail with OPS_REJECTED and rejection code UNKNOWN_FIELD; snake_case mistakes suggest the corresponding camelCase name. The error message lists each rejection's #opIndex, code and reason. Correct the named fields and retry the saved edit; do not assume an ignored field applied an effect.
+ *
+ */
+export const cutExecute = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/projects/{project_id}:execute',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6019,67 +6537,75 @@ export const mediaReprocessAsset = (options) => (options.client ?? client).post(
     }
 });
 /**
- * List understandings
+ * Read editing state
  *
- * List an asset’s understanding results in creation order. By default only current, non-superseded results are returned; use include_superseded=true for history or kind to select an output type.
+ * Read lightweight project context before composing an execute script. Returns current revision, rendering settings, track counts, library bindings and offline media count without individual clips. For complete clip documents or a selected time range, read timeline instead.
  */
-export const mediaListUnderstandings = (options) => (options.client ?? client).get({
+export const cutRetrieveState = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/assets/{asset_id}/understandings',
+    url: '/cut/v1/projects/{project_id}/state',
     ...options
 });
 /**
- * Expression search
+ * Read project timeline
  *
- * Search active assets using the supported filter-expression syntax, sorting and cursor pagination. Empty expression matches all assets. Tags and context require with_field; inspect the exactness flags before treating counts as complete.
+ * Inspect clips and markers in a selected project range before editing. view=full returns structured tracks with all timeline positions in seconds; view=compact returns compact text for script context. from and to are seconds and tracks limits the selection to comma-separated track ids from state. Concurrent changes while preparing a full timeline return 409; retrieve the latest state and try the read again.
  */
-export const mediaExpressionSearch = (options) => (options.client ?? client).post({
+export const cutRetrieveTimeline = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/search/expression',
-    ...options,
-    headers: {
-        'Content-Type': 'application/json',
-        ...options.headers
-    }
+    url: '/cut/v1/projects/{project_id}/timeline',
+    ...options
 });
 /**
- * Visual search
+ * Render preview frames
  *
- * Find visually similar assets using exactly one of asset_id or an inline base64 image. The library must support image search; an asset query needs a current image embedding and excludes that source asset from results.
+ * Review the visual result at one or more project times without creating an export. Pass comma-separated seconds in at, such as 12,15.5; scale changes preview size and revision selects a committed project revision. Request at most eight times. Each returned url is an inline PNG data URL (data:image/png;base64,...), not a hosted HTTP image link. The default scale is 0.25; use 0.5 for subtitle layout inspection (1080×1920 renders at 540×960). The maximum is 0.5; values above it return INVALID_PARAMS. Actual width and height are returned per frame. PNGs above 2 MiB or responses above 4 MiB return RESPONSE_TOO_LARGE without silently lowering resolution. The response always includes warnings; FRAME_UNAVAILABLE means a source preview could not be obtained and an offline tile was drawn. Its message identifies a timeout, delivery capacity limit, or unavailable source and contains no source URL. Decode each image's base64 payload to save it. Codemode returns at most four images per call, so request at most four times when reviewing there.
  */
-export const mediaVisualSearch = (options) => (options.client ?? client).post({
+export const cutListFrames = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/search/visual',
-    ...options,
-    headers: {
-        'Content-Type': 'application/json',
-        ...options.headers
-    }
+    url: '/cut/v1/projects/{project_id}/frames',
+    ...options
 });
 /**
- * Semantic search
+ * Analyze project media
  *
- * Search assets with a nonblank text query and optional expression filter. Hybrid mode combines semantic and keyword matches; semantic mode uses vector similarity only. Results are ranked and limited by top_k.
+ * Request silence, filler-word or scene analysis for selected bound assets before editing. Omit media to select project sources; ranges returned in segments use source seconds. A pending result is not completion: use retry_after_sec before checking again, and inspect failed or unsupported asset results before deciding which edits are possible. Silence measures transcript-based speech pauses, not music or loudness. A completed transcript without words returns ready with empty segments and reason no_speech; no completed transcript returns unsupported with reason no_transcript. A failed transcription remains failed.
  */
-export const mediaSemanticSearch = (options) => (options.client ?? client).post({
+export const cutCreateAnalysis = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/search/semantic',
+    url: '/cut/v1/projects/{project_id}/analysis',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6087,17 +6613,39 @@ export const mediaSemanticSearch = (options) => (options.client ?? client).post(
     }
 });
 /**
- * Semantic search alias
+ * List library bindings
  *
- * Alias of semantic search. Search assets with a nonblank text query, optional expression filter and top_k; hybrid combines semantic and keyword matches, while semantic uses vector similarity only.
+ * Discover the named media libraries available to this project before selecting source assets or an import/export destination. read bindings supply source assets; read_write bindings also accept uploads. Exactly one writable binding supplies the default upload destination.
  */
-export const mediaSearch = (options) => (options.client ?? client).post({
+export const cutListBindings = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/projects/{project_id}/bindings',
+    ...options
+});
+/**
+ * Bind media library
+ *
+ * Attach an accessible media library to an existing project under a unique name. Obtain library_id from praxis.media and choose read for source-only access or read_write for imports and exports. The project must retain exactly one read_write binding with default_upload true after the change.
+ */
+export const cutCreateBinding = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/search',
+    url: '/cut/v1/projects/{project_id}/bindings',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6105,31 +6653,39 @@ export const mediaSearch = (options) => (options.client ?? client).post({
     }
 });
 /**
- * List folders
+ * Remove library binding
  *
- * List all immediate child folders under parent, or under the root when parent is omitted. Counts include descendant assets. The result is unpaginated; limit and cursor are rejected.
+ * Detach a library alias obtained from bindings.list after removing all timeline clips that reference its library. BINDING_IN_USE returns 409 while references remain; inspect timeline and edit those clips first. Removal must preserve the one writable default upload binding.
  */
-export const mediaListFolders = (options) => (options.client ?? client).get({
+export const cutDeleteBinding = (options) => (options.client ?? client).delete({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/folders',
+    url: '/cut/v1/projects/{project_id}/bindings/{name}',
     ...options
 });
 /**
- * Create batch
+ * Import project media
  *
- * Create an asynchronous batch for tagging, untagging, replacing context, moving or deleting assets. Select ids or an expression; selection is frozen at creation. Poll the returned job id for completion and per-item failures.
+ * Import a URL, data URI or existing file into a writable project media library. Select binding from bindings.list or omit it to use default_upload. Save library_id and asset_id from the result and use them as libraryId and assetId inside execute script media references; overwrites follow the source asset latest version.
  */
-export const mediaCreateBatch = (options) => (options.client ?? client).post({
+export const cutImportMedia = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/batches',
+    url: '/cut/v1/projects/{project_id}/media:import',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6137,31 +6693,1800 @@ export const mediaCreateBatch = (options) => (options.client ?? client).post({
     }
 });
 /**
- * Get batch
+ * List project exports
  *
- * Read a batch job’s status, successful and failed item counts, and a bounded list of failed items. Use the id returned by batch creation; a job outside this library is not found.
+ * Find export jobs associated with this project before polling or canceling a render. Copy an export id into praxis.cut.exports.retrieve or cancel. Continue with next_page_token as page_token when present; queued or in-progress jobs have not produced a final media asset.
  */
-export const mediaGetBatch = (options) => (options.client ?? client).get({
+export const cutListExports = (options) => (options.client ?? client).get({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
             scheme: 'bearer',
             type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
         }],
-    url: '/media/v1/libraries/{library_id}/batches/{job_id}',
+    url: '/cut/v1/projects/{project_id}/exports',
     ...options
 });
 /**
- * Batch assets alias
+ * Create video export
  *
- * Alias of batch creation. Apply one metadata or deletion action to ids or a frozen expression selection asynchronously; poll the returned job id to inspect completion and item failures.
+ * Start an asynchronous video export from the project into a writable bound media library. Choose binding from bindings.list or omit it for default_upload, and optionally select revision and output settings. HTTP 202 only accepts the job; poll praxis.cut.exports.retrieve using the returned id until status is done, failed or canceled. On done, asset identifies the video written back to praxis.media. Each call starts a job, so retrieve a known job before retrying a submission.
  */
-export const mediaBatchAssets = (options) => (options.client ?? client).post({
+export const cutCreateExport = (options) => (options.client ?? client).post({
     security: [{
-            key: 'media-BearerAuth',
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/projects/{project_id}/exports',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Retrieve video export
+ *
+ * Poll an export id returned by projects.exports.create or list to observe render progress. queued, fetching, rendering, stitching and saving are in progress; done provides asset in the target library, failed provides error, and canceled means the job stopped. Only done confirms a usable output asset.
+ */
+export const cutRetrieveExport = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/exports/{export_id}',
+    ...options
+});
+/**
+ * Cancel video export
+ *
+ * Request cancellation of an export obtained from projects.exports.create or list when its output is no longer needed. Read the returned job status and retrieve it to confirm the terminal outcome; do not interpret a cancellation request as successful rendering.
+ */
+export const cutCancelExport = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/exports/{export_id}:cancel',
+    ...options
+});
+/**
+ * List saved versions
+ *
+ * Find saved timeline snapshots for this project and obtain version_id values for restore. A saved version records its original revision; restoring it creates a new current revision rather than rewinding the revision counter. Continue with next_page_token as page_token until absent.
+ */
+export const cutListVersions = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/projects/{project_id}/versions',
+    ...options
+});
+/**
+ * Save project version
+ *
+ * Save the current project timeline as a named recovery point before a substantial edit. Supply an optional label or send an empty object; keep the returned version id for versions.restore. Saving a version does not publish a rendered asset; use projects.exports.create for video output.
+ */
+export const cutCreateVersion = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/projects/{project_id}/versions',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Restore saved version
+ *
+ * Replace current editing content with a saved project snapshot selected from projects.versions.list. The restore commits a new transaction and revision while preserving the saved version for future use. Inspect the returned summary and timeline before further editing; a response revision conflict can follow a committed restore, so retrieve current state before retrying.
+ */
+export const cutRestoreVersion = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            key: 'ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        }],
+    url: '/cut/v1/versions/{version_id}:restore',
+    ...options
+});
+/**
+ * List databases
+ *
+ * Find databases owned by your tenant and obtain their ids for schema or row operations. Excludes deleting by default. status=active or status=deleting selects that state; invalid values return 400 INVALID_PARAMS.
+ */
+export const databaseListDatabases = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases',
+    ...options
+});
+/**
+ * Create database
+ *
+ * Creates an empty database for the caller and returns it with status active (HTTP 201); add tables next with praxis.database.databases.tables.create. name is required and is 1–64 visible characters after trimming. labels are optional string tags (at most 64; each key starts with a lowercase letter and uses up to 63 characters of a-z 0-9 _ -; each value is up to 63 characters of a-z 0-9 _ -) that databaseListDatabases can filter on. If initialization fails the call returns 503 CAPACITY and the half-created database is left with status failed; retry by calling create again, which makes a new database. Unlike Supabase, this creates a SQLite-backed database without a PostgreSQL connection or SQL execution endpoint. Use a Praxis credential; access is scoped to its tenant, not to Supabase Auth users or RLS policies.
+ */
+export const databaseCreateDatabase = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete database
+ *
+ * Soft-delete a database when it should stop accepting schema and row operations. Idempotently enters deleting with a seven-day purge_at. GET remains available; child operations return 409 until restored.
+ */
+export const databaseDeleteDatabase = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}',
+    ...options
+});
+/**
+ * Get database
+ *
+ * Returns one database by id, including a database in the deleting state (purge_at then shows when it will be permanently removed). Call it before table or row operations to confirm status is active: schema and row calls on a deleting database return 409 DATABASE_INVALID_STATE. size_bytes is refreshed from live storage at most once every five seconds. A purged or unknown id returns 404 DATABASE_NOT_FOUND.
+ */
+export const databaseGetDatabase = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}',
+    ...options
+});
+/**
+ * Update database
+ *
+ * Renames an active database and/or replaces its labels; send only the keys you want to change. labels is replaced as a whole, not merged, so include every label you want to keep. A body without name or labels, or with values equal to the current ones, changes nothing and leaves updated_at as is. A database in the deleting state returns 409 DATABASE_INVALID_STATE; restore it first with databaseRestoreDatabase.
+ */
+export const databaseUpdateDatabase = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Restore database
+ *
+ * Recover a soft-deleted database within its seven-day recovery window. Restore before purge_at. An empty body is accepted. Active databases return 409; purged databases return 404.
+ */
+export const databaseRestoreDatabase = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/restore',
+    ...options
+});
+/**
+ * Permanently purge database
+ *
+ * Immediately and irreversibly purges a deleting database. Active databases return 409; absent or already purged databases return 404.
+ */
+export const databasePurgeDatabase = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/purge',
+    ...options
+});
+/**
+ * List tables
+ *
+ * Lists every table of an active database with its field definitions. A database holds at most 50 tables, so the single page contains all of them and next_cursor is always null. Use databaseGetTable instead when you also need row_count for one table.
+ */
+export const databaseListTables = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables',
+    ...options
+});
+/**
+ * Create table
+ *
+ * Creates a table together with its initial fields in one call and returns it (HTTP 201) with generated tbl_ and fld_ ids. name must match ^[a-z_][a-z0-9_]{0,62}$ and be unused in this database (duplicate: 409 UNIQUE_VIOLATION). fields is required and may be an empty array; fields can also be added later with databaseAddField. Limits: 50 tables per database, 64 fields per table, and 16 indexed or unique fields per table; exceeding one returns 400 LIMIT_EXCEEDED. Fields default to indexed:false. Set indexed:true explicitly for fields used in filters or ordering. Only indexed:true or unique:true consumes one of the 16 indexed-or-unique field slots; a field with both consumes one slot. Unique fields still consume a slot even with indexed:false. Existing fields are unchanged. Minimal field example: {"name":"notes","type":"string","indexed":false}. Every row also has a system id column, which is not declared as a field. Insert data afterwards with databaseInsert. Unlike Supabase, define schema with this table API and the field APIs; PostgreSQL DDL and SQL migration files cannot be submitted. Each table supports up to 1,000,000 rows.
+ */
+export const databaseCreateTable = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete table
+ *
+ * Permanently drops a table with all of its rows; the deletion is immediate and has no recovery window or undo. Refused with 409 REFERENCE_RESTRICT while a link field of another table points at this table, so delete or change those fields first. Returns {deleted: true}. A table name can be reused afterwards.
+ */
+export const databaseDeleteTable = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables/{table}',
+    ...options
+});
+/**
+ * Get table
+ *
+ * Returns one table by id or name with its field definitions, schema_revision and row_count. row_count is only returned by this operation, not by list or create. Use field ids from this response for stable references because field names can be renamed; an unknown table returns 404 TABLE_NOT_FOUND.
+ */
+export const databaseGetTable = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables/{table}',
+    ...options
+});
+/**
+ * Update table
+ *
+ * Renames a table and/or changes its description; send only the keys to change, and send description null to clear it. The new name must follow ^[a-z_][a-z0-9_]{0,62}$ and be unused (409 UNIQUE_VIOLATION); ids are stable, so renaming never rewrites row data. A body with no changes or values equal to the current ones does not bump schema_revision. Fields cannot be changed here; use databaseAddField, databaseUpdateField and databaseDeleteField.
+ */
+export const databaseUpdateTable = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables/{table}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Add field
+ *
+ * Adds one field to an existing table and returns the updated table (HTTP 201). Required inputs are name (lowercase letters, digits and underscores; id and names starting with _ are reserved) and type (string, integer, number, boolean, datetime, json or link); json needs options.schema and link needs options.linked_table_id and options.multiple. Adding a required field to a table that already has rows needs a default, otherwise the call fails with 400 VALIDATION_FAILED; a default is written into every existing row. Fields default to indexed:false. Set indexed:true explicitly for fields used in filters or ordering. Only indexed:true or unique:true consumes one of the 16 indexed-or-unique field slots; a field with both consumes one slot. Unique fields still consume a slot even with indexed:false. Existing fields are unchanged. Minimal field example: {"name":"notes","type":"string","indexed":false}. JSON and link fields cannot be indexed. Limits: 64 fields and 16 indexed or unique fields per table (400 LIMIT_EXCEEDED). Unlike Supabase, schema evolution uses field definitions rather than ALTER TABLE statements or SQL migrations.
+ */
+export const databaseAddField = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables/{table}/fields',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete field
+ *
+ * Deletes one field definition from a table and returns the updated table; the deletion is immediate and has no recovery window. Look the field up by id or name. The field's index, if any, is dropped with it, and the name can be reused afterwards. Unknown fields return 400 FIELD_NOT_FOUND.
+ */
+export const databaseDeleteField = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables/{table}/fields/{field}',
+    ...options
+});
+/**
+ * Update field
+ *
+ * Changes a field's name, description, required flag, indexed flag, default or json options.schema and returns the updated table. The field type, a link field's linked_table_id and the unique flag cannot be changed (400 FIELD_TYPE_IMMUTABLE or INVALID_PARAMS). Setting required to true fails with 400 VALIDATION_FAILED while existing rows hold null for the field. A new json schema constrains only later writes; existing rows are not revalidated. Renaming never rewrites row data, and a request that changes nothing does not bump schema_revision. Unlike Supabase, field types and uniqueness cannot be altered through SQL migrations; use the supported field settings described here.
+ */
+export const databaseUpdateField = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/tables/{table}/fields/{field}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List events
+ *
+ * Read lifecycle and schema events, including while the database is deleting. next_cursor is an opaque string cursor (do not do arithmetic on it): pass it as after_seq for asc or before_seq for desc. Supplying both cursors returns 400 INVALID_PARAMS. Unlike Supabase Realtime, this is paged lifecycle and schema history, not a subscription or a row-change feed; row inserts, updates and deletes do not appear here.
+ */
+export const databaseListEvents = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/events',
+    ...options
+});
+/**
+ * Delete rows
+ *
+ * Deletes the rows matched by the filter query parameters (the same filters as databaseSelect); with no filter every row of the table matches. Deletion is immediate and cannot be undone. A row that a link field of another table still references makes the whole call fail with 409 REFERENCE_RESTRICT and nothing is deleted. The default response is 204 with no body; send Prefer: return=representation to get HTTP 200 with the deleted rows.
+ */
+export const databaseDelete = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/rest/{table}',
+    ...options
+});
+/**
+ * Select rows
+ *
+ * Read matching rows with filters, selected columns and ordering. Returns at most 1000 rows per request, including when limit is omitted. Content-Range reports the actual returned interval and the total when count is requested. PATCH and DELETE are not subject to this read cap. Unlike Supabase, casts, aggregates, spread and join modifiers are unsupported. Each table supports up to 1,000,000 rows. Query budget: 8,000 ms with a shared 3,000,000-row safety ceiling. Create indexes on filtered or sorted fields, or narrow the request when it exceeds its budget. Synchronous SQLite aggregates use candidate-row throughput estimates before execution; deployed Workers freeze clocks during synchronous CPU work, so the timer is not a guaranteed server-side interrupt. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Error table: QUERY_CANCELED / PostgREST 57014 is HTTP 500, retryable=false: Query timed out: index filtered or sorted fields, or narrow the range. DATABASE_INVALID_STATE is HTTP 409 for operations on a deleting database. Cleared or nonexistent databases return DATABASE_NOT_FOUND / HTTP 404. The count is an HTTP Content-Range response header, not a JSON property. Use praxis.database.count in the SDK or codemode to return { count: number | null }; a page length is not a total unless you know all matches fit in that page.
+ */
+export const databaseSelect = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/rest/{table}',
+    ...options
+});
+/**
+ * Count rows
+ *
+ * Inspect the HTTP row count and range without retrieving row data; send Prefer: count=exact for a filtered count. Returns no body and does not fetch or serialize row data. A known count determines the interval using limit/offset or Range with a default and maximum page size of 1000. Without a count preference, or when the selected count mode cannot supply a total, Content-Range is **. Singular Accept still validates page cardinality. Unlike Supabase, planned and estimated counts do not use PostgreSQL planner estimates. Count preferences: without filters, exact, planned and estimated all use SQLite's exact b-tree count. With filters, exact counts within budget; planned skips counting and reports an unknown total (Content-Range: 0-24*); estimated attempts exact counting only when the preflight budget allows it, otherwise reports an unknown total. Preference-Applied echoes the requested count mode. Use praxis.database.count in the SDK or codemode to return { count: number | null } from this header without retrieving rows.
+ */
+export const databaseHead = (options) => (options.client ?? client).head({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/rest/{table}',
+    ...options
+});
+/**
+ * Update rows
+ *
+ * Updates the rows matched by the filter query parameters (the same filters as databaseSelect); with no filter every row of the table matches. The JSON object body lists only the fields to change, other fields keep their values, and id cannot be changed. Values are validated against the field types and the required and unique settings (400 VALIDATION_FAILED, 409 UNIQUE_VIOLATION). The default response is 204 with no body; send Prefer: return=representation to get HTTP 200 with the updated rows. Each changed row's _version increases by one.
+ */
+export const databaseUpdate = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/rest/{table}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Insert rows
+ *
+ * Insert rows into an existing table after defining its fields; at most 500 rows per request. Each request is atomic: any failure rolls back the entire batch. There are no transactions across requests.
+ * Rows are filled to the union of their keys with null; send Prefer: missing=default to use field defaults for missing keys.
+ * The default is return=minimal: success returns HTTP 201 with an empty body. Send Prefer: return=representation to return the inserted rows. With resolution=merge-duplicates, a conflicting row keeps columns omitted from the request; supplied values replace the whole field value (including JSON objects), and explicit null clears a nullable field. With resolution=ignore-duplicates, a conflicting row is left unchanged. Without a conflict, both modes insert a new row using field defaults for omitted fields. In a batch, a key present in another row is filled with null when omitted in this row unless missing=default is set; that null can overwrite a value during merge. With missing=default, omitted keys stay omitted for conflict merges (existing values are preserved); new rows use defaults, or null when no default exists. Explicit null never invokes a default. Unlike Supabase, upsert conflicts can target only id or one unique field, not a composite key. Each table supports up to 1,000,000 rows.
+ */
+export const databaseInsert = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'database-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/database/v1/databases/{database_id}/rest/{table}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List knowledge bases
+ *
+ * Lists knowledge bases visible to the caller, newest first by default. Use last_id as after to read the next page; for example, ?limit=20.
+ */
+export const knowledgeListVectorStores = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores',
+    ...options
+});
+/**
+ * Create knowledge base
+ *
+ * Create a knowledge base, optionally starting ingestion of uploaded file_ids in the same call; no separate attachment or batch is needed for those files. Use the returned id with vectorStores.files.retrieve to poll each attachment until completed, failed or cancelled; store status=completed alone does not mean every file succeeded. PDF files accept up to 536870912 bytes (512 MiB), while other formats accept up to 52428800 bytes (50 MiB), constrained by Router conversion; every file is limited to 5000000 estimated tokens; each account holds up to 100 active/nondeleted stores. Minimal body: {"name":"Refund policies"}.
+ */
+export const knowledgeCreateVectorStore = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete knowledge base
+ *
+ * Remove a knowledge base from active use while keeping a recovery window. Unlike OpenAI vector stores, native DELETE returns the store with status=deleting and ISO purge_at, retains it for 7 days and is idempotent on repeat. Retrieve remains 200; object operations return 409. Use restore before purge_at to recover it, or purge to remove it irreversibly.
+ */
+export const knowledgeDeleteVectorStore = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}',
+    ...options
+});
+/**
+ * Retrieve knowledge base
+ *
+ * Retrieves a knowledge base using an id returned by create or list. Add ?expand=files to include the first page of attached files. Soft-deleted stores remain readable with status=deleting until purged.
+ */
+export const knowledgeRetrieveVectorStore = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}',
+    ...options
+});
+/**
+ * Update knowledge base
+ *
+ * Updates an active knowledge base using its returned id. Omitted fields stay unchanged; metadata replaces the whole map. Example body: {"name":"Refund policies"}.
+ */
+export const knowledgeUpdateVectorStore = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Search knowledge base
+ *
+ * Search ingested text to answer a question or find supporting passages. Native results contain one chunk each, so file_id can repeat; max_num_results counts chunks (1–50, default 10), while the compatible URL groups results by file. Unlike OpenAI vector stores, next_page is always null even when has_more is true. Only completed attachments are searchable. For keyword-only retrieval set ranking_options.hybrid_search to {"embedding_weight":0,"text_weight":1}; omit rewrite_query or set it to false to avoid query rewriting. Unlike OpenAI, ranker auto does not rerank; only default-2024-11-15 requests reranking. Set praxis.explain=true to inspect scores and use returned content[].chunk_id to retrieve a segment.
+ */
+export const knowledgeSearchVectorStore = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/search',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List files
+ *
+ * Lists attached files and their ingestion status, newest attachment first by default. Use last_id as after to continue; ?filter=failed selects files that can be retried.
+ */
+export const knowledgeListFiles = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files',
+    ...options
+});
+/**
+ * Add file
+ *
+ * Attach an uploaded File for asynchronous ingestion, then poll this attachment until status is completed, failed or cancelled before searching. PDF files accept up to 536870912 bytes (512 MiB), while other formats accept up to 52428800 bytes (50 MiB), constrained by Router conversion; every file is limited to 5000000 estimated tokens; chunk sizes use estimated tokens rather than a model tokenizer. Text, Markdown, CSV, JSON, HTML, PDF, DOCX, PPTX, XLSX and PNG/JPEG/GIF/WebP images can be extracted; audio and video uploads are not knowledge documents. Images may yield generated descriptions rather than verbatim OCR. auto chunking resolves to static 800/400; explicit sizes are 100–4096 with overlap at most half the size. Each store holds at most 10000 attached files. Reattaching the same file returns its existing record without applying new attributes or chunking; inspect last_error after failure.
+ */
+export const knowledgeAttachFile = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Remove file
+ *
+ * Removes the file from search immediately; does not delete the original File.
+ */
+export const knowledgeRemoveFile = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}',
+    ...options
+});
+/**
+ * Retrieve file
+ *
+ * Retrieves an attached file using the id returned by attachment or file listing. Poll this operation until status leaves in_progress to observe the ingestion outcome.
+ */
+export const knowledgeRetrieveFile = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}',
+    ...options
+});
+/**
+ * Update file attributes
+ *
+ * Replaces search-filter attributes of an existing attachment without reingesting its content. Use an attached file id. Example body: {"attributes":{"category":"refund"}}; null clears the attributes.
+ */
+export const knowledgeUpdateFile = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Read extracted content
+ *
+ * Extracted text chunks may overlap. Image content can be a generated description rather than verbatim OCR.
+ */
+export const knowledgeRetrieveFileContent = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}/content',
+    ...options
+});
+/**
+ * Create file batch
+ *
+ * Attaches existing Files as a batch for asynchronous ingestion. Supply exactly one of file_ids or files; files allows per-file settings. Existing attachments are reused. Read the returned batch id to monitor status.
+ */
+export const knowledgeCreateFileBatch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Retrieve file batch
+ *
+ * Retrieves a batch created in this knowledge base, including current status and file counts. Use the batch id returned by batch creation to monitor ingestion.
+ */
+export const knowledgeRetrieveFileBatch = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches/{batch_id}',
+    ...options
+});
+/**
+ * Cancel file batch
+ *
+ * Cancels only in-progress batches and pending files. Completed, failed and cancelled batches return unchanged (200, idempotent).
+ */
+export const knowledgeCancelFileBatch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches/{batch_id}/cancel',
+    ...options
+});
+/**
+ * List batch files
+ *
+ * Lists files still attached from the identified batch, newest attachment first by default. Use the batch creation id and ?filter=failed to inspect failures; last_id is the next after cursor.
+ */
+export const knowledgeListBatchFiles = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/file_batches/{batch_id}/files',
+    ...options
+});
+/**
+ * Restore knowledge base
+ *
+ * Restores a deleting store within 7 days. Active stores return 409 VECTOR_STORE_INVALID_STATE; absent stores return 404. Empty body is allowed.
+ */
+export const knowledgeRestoreVectorStore = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/restore',
+    ...options
+});
+/**
+ * Permanently purge knowledge base
+ *
+ * Immediately and irreversibly clears a deleting store using the retention cleanup path. Active stores return 409; absent stores return 404. Empty body is allowed.
+ */
+export const knowledgePurgeVectorStore = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/purge',
+    ...options
+});
+/**
+ * Retry failed file
+ *
+ * Retries only failed files; other states return 409 FILE_INVALID_STATE. Retry after failure has not yet been observed in the documented run.
+ */
+export const knowledgeRetryFile = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}/retry',
+    ...options
+});
+/**
+ * List file segments
+ *
+ * Lists the stored chunks of an attached file, ordered by increasing segment index by default. Use the attachment id and last_id as after to continue; returned chunk ids can be retrieved individually.
+ */
+export const knowledgeListSegments = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/files/{file_id}/segments',
+    ...options
+});
+/**
+ * Retrieve segment
+ *
+ * Retrieves one chunk and its term statistics. Take chunk_id from segment listing or native search content; the chunk must belong to this knowledge base.
+ */
+export const knowledgeRetrieveSegment = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/segments/{chunk_id}',
+    ...options
+});
+/**
+ * List events
+ *
+ * Reads events for this knowledge base in increasing sequence order, including while soft-deleted. Pass next_seq as after_seq to continue; null next_seq marks the current end. Example: ?after_seq=0&limit=20.
+ */
+export const knowledgeListEvents = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'knowledge-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/knowledge/v1/vector_stores/{vector_store_id}/events',
+    ...options
+});
+/**
+ * List libraries
+ *
+ * Read a caller-owned library’s current settings, usage and lifecycle status. A deleting library remains readable; missing, foreign or purged libraries return LIBRARY_NOT_FOUND.
+ */
+export const mediaListLibraries = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries',
+    ...options
+});
+/**
+ * Create library
+ *
+ * Create a library owned by the caller with a name, optional labels and understanding settings. Understanding is enabled by default; the returned id is used for subsequent asset operations.
+ */
+export const mediaCreateLibrary = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Create frame URLs
+ *
+ * Media creates JPEG frame URLs for inspecting one or more moments in a video without downloading the original. Obtain library_id from libraries and asset_id plus duration from assets. Send 1–20 integer microsecond timestamps strictly below duration, for example {"at_micros":[0,1000000],"width":640}. Only video assets are supported; audio and images return INVALID_PARAMS. Width defaults to 640 and accepts 160, 320 or 640. This read operation does not store a new asset or rerun understanding. Fetch each returned URL to obtain the frame; delivery usage follows media pricing. Authenticated links expire after 300 seconds; upload links remain public and permanent. Reissue expired links. Foreign libraries and assets return 404 without revealing their existence.
+ */
+export const mediaCreateFrameUrls = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/{asset_id}/frames',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete library
+ *
+ * Restore a deleting library before its purge_at deadline. The library becomes active again and deleted_at and purge_at are cleared; expired or non-deleting libraries cannot be restored.
+ */
+export const mediaDeleteLibrary = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}',
+    ...options
+});
+/**
+ * Get library
+ *
+ * Update an active library’s supplied settings. Labels replace the complete map; understanding settings and model roles merge with current values. Changing the embedding model is rejected while assets exist.
+ */
+export const mediaGetLibrary = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}',
+    ...options
+});
+/**
+ * Update library
+ *
+ * Update an active library. Set hotwords for spelling evidence in subsequent transcripts; [] disables inferred vocabulary. Transcript understanding calls the timestamped ASR, optional reference ASR and correction model through the existing metered model path. Reprocess assets to apply new settings to existing transcripts.
+ */
+export const mediaUpdateLibrary = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Restore library
+ *
+ * Permanently remove a library that is already deleting, without waiting for purge_at. Its assets and related resources are removed and cannot be restored; first soft-delete an active library.
+ */
+export const mediaRestoreLibrary = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/restore',
+    ...options
+});
+/**
+ * Purge library
+ *
+ * List assets in an active library, newest first, optionally filtering by exact folder and stored resource type. Continue using next_cursor; video includes audio-only assets.
+ */
+export const mediaPurgeLibrary = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/purge',
+    ...options
+});
+/**
+ * List assets
+ *
+ * Upload content into an active library and return a Cloudinary-compatible resource. Use file for a multipart file, data URI, public HTTPS URL or same-owner file identifier. Reusing public_id overwrites by default; overwrite=false returns the existing resource. Chunk uploads require both chunk headers.
+ */
+export const mediaListAssets = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets',
+    ...options
+});
+/**
+ * Upload asset
+ *
+ *  For understanding, Media generates proxies for video sources of 25 MB or more or longer than 10 minutes, and for audio-only sources of 100 MB or more; originals remain available unchanged. Long videos are supported. When a video proxy is needed and is still above 95 MB after recompression, the source is reported as UNSUPPORTED with the limit in the failure message. Proxy preparation uses the organization’s metered sandbox resources.
+ */
+export const mediaUploadAsset = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Import file
+ *
+ * Copy a File into an independent Media asset. New assets default to organization-private delivery (type=authenticated); explicitly set type=upload for public originals and derivatives. Omitting type on overwrite preserves the current type. Deleting the source File does not delete this copy. For understanding, Media generates proxies for video sources of 25 MB or more or longer than 10 minutes, and for audio-only sources of 100 MB or more; originals remain available unchanged. Long videos are supported. When a video proxy is needed and is still above 95 MB after recompression, the source is reported as UNSUPPORTED with the limit in the failure message. Proxy preparation uses the organization’s metered sandbox resources.
+ */
+export const mediaImportAsset = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/import',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete asset
+ *
+ * Queue reprocessing of the asset’s current version and return its updated state immediately. Omit kinds to retry failed tasks and legacy source-size unsupported tasks; explicit kinds rerun applicable completed tasks and recoverable source-size unsupported tasks. Other unsupported causes remain unchanged. Replaced understandings become superseded, and processing finishes asynchronously.
+ */
+export const mediaDeleteAsset = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/{asset_id}',
+    ...options
+});
+/**
+ * Get asset
+ *
+ * Update an asset’s supplied metadata fields. Tags and context replace their current collections; an empty collection clears them. Moving asset_folder or changing display_name preserves public_id and delivery URLs.
+ */
+export const mediaGetAsset = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/{asset_id}',
+    ...options
+});
+/**
+ * Update asset
+ *
+ * Delete an asset from the library so it is no longer readable, searchable or deliverable. This removes the asset rather than placing it in the library’s restoration window; a missing asset returns ASSET_NOT_FOUND.
+ */
+export const mediaUpdateAsset = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/{asset_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Reprocess asset
+ *
+ *  For understanding, Media generates proxies for video sources of 25 MB or more or longer than 10 minutes, and for audio-only sources of 100 MB or more; originals remain available unchanged. Long videos are supported. When a video proxy is needed and is still above 95 MB after recompression, the source is reported as UNSUPPORTED with the limit in the failure message. Proxy preparation uses the organization’s metered sandbox resources.
+ */
+export const mediaReprocessAsset = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/{asset_id}/reprocess',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List understandings
+ *
+ * List understanding results for an asset, ordered by creation time. Use the cursor to continue; include_superseded also returns replaced records. The optional shots array contains current-version shot boundaries and per-shot captions, scene, location guesses, visible text and confidence flags; it is absent on legacy records. Location guesses and folder mismatch are unverified hints. Correction-enabled transcripts expose text_original, corrected text and a correction audit. Their timed data array remains suitable for subtitles. Reference failure is marked missing; correction failure returns the original verbatim. Model inference uses the existing metered model path.
+ */
+export const mediaListUnderstandings = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets/{asset_id}/understandings',
+    ...options
+});
+/**
+ * Expression search
+ *
+ * Find visually similar assets using exactly one of asset_id or an inline base64 image. The library must support image search; an asset query needs a current image embedding and excludes that source asset from results.
+ */
+export const mediaExpressionSearch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/search/expression',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Visual search
+ *
+ * Search assets with a nonblank text query and optional expression filter. Hybrid mode combines semantic and keyword matches; semantic mode uses vector similarity only. Results are ranked and limited by top_k.
+ */
+export const mediaVisualSearch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/search/visual',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Semantic search
+ *
+ * Alias of semantic search. Search assets with a nonblank text query, optional expression filter and top_k; hybrid combines semantic and keyword matches, while semantic uses vector similarity only.
+ */
+export const mediaSemanticSearch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/search/semantic',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Semantic search alias
+ *
+ * List all immediate child folders under parent, or under the root when parent is omitted. Counts include descendant assets. The result is unpaginated; limit and cursor are rejected.
+ */
+export const mediaSearch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/search',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List folders
+ *
+ * undefined understood_count includes ready and partial assets; failed_count includes failed assets. Both accumulate descendants. counts_complete is false during historical backfill.
+ */
+export const mediaListFolders = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/folders',
+    ...options
+});
+/**
+ * Create batch
+ *
+ * Queue a frozen selection for tagging, untagging, context replacement, moving, deleting or reprocessing. IDs are limited to 1000; use an expression for larger selections, subject to the search scan budget. reprocess starts at most 30 assets per rolling minute per library. Only retryable failed steps and legacy source-size unsupported steps rerun. Omit kinds to inspect all recoverable steps, or supply kinds to narrow them. Other unsupported, permanent and completed steps remain unchanged; a permanent output blocks only its own step. Assets without any selected recoverable step count as failed items without starting understanding. Poll the returned job id; done counts accepted launches, not successful model inference. Staff Admin only permits reprocess and requires a nonblank reason. Example: {"action":"reprocess","selector":{"expression":"processing_state=failed AND failure_code=UPSTREAM_FAILED"}}. For understanding, Media generates proxies for video sources of 25 MB or more or longer than 10 minutes, and for audio-only sources of 100 MB or more; originals remain available unchanged. Long videos are supported. When a video proxy is needed and is still above 95 MB after recompression, the source is reported as UNSUPPORTED with the limit in the failure message. Proxy preparation uses the organization’s metered sandbox resources.
+ */
+export const mediaCreateBatch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/batches',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get batch
+ *
+ * Alias of batch creation. Apply one metadata or deletion action to ids or a frozen expression selection asynchronously; poll the returned job id to inspect completion and item failures.
+ */
+export const mediaGetBatch = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/batches/{job_id}',
+    ...options
+});
+/**
+ * Batch assets alias
+ *
+ * Queue a frozen selection for tagging, untagging, context replacement, moving, deleting or reprocessing. IDs are limited to 1000; use an expression for larger selections, subject to the search scan budget. reprocess starts at most 30 assets per rolling minute per library. Only retryable failed steps and legacy source-size unsupported steps rerun. Omit kinds to inspect all recoverable steps, or supply kinds to narrow them. Other unsupported, permanent and completed steps remain unchanged; a permanent output blocks only its own step. Assets without any selected recoverable step count as failed items without starting understanding. Poll the returned job id; done counts accepted launches, not successful model inference. Staff Admin only permits reprocess and requires a nonblank reason. Example: {"action":"reprocess","selector":{"expression":"processing_state=failed AND failure_code=UPSTREAM_FAILED"}}. For understanding, Media generates proxies for video sources of 25 MB or more or longer than 10 minutes, and for audio-only sources of 100 MB or more; originals remain available unchanged. Long videos are supported. When a video proxy is needed and is still above 95 MB after recompression, the source is reported as UNSUPPORTED with the limit in the failure message. Proxy preparation uses the organization’s metered sandbox resources.
+ */
+export const mediaBatchAssets = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/assets:batch',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get job
+ *
+ * Read the current batch or video-generation Job status and progress. For generation, inspect outputs and failures, then save successful candidates before their preview and save window expires after 7 days.
+ */
+export const mediaGetJob = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/jobs/{job_id}',
+    ...options
+});
+/**
+ * List events
+ *
+ * Read library events in sequence order for observing asset writes and understanding progress. Obtain library_id from creation or listing; continue with after_seq for asc or before_seq for desc, without combining both. Use next_cursor when supplied. Reads do not start or retry understanding.
+ */
+export const mediaListEvents = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/events',
+    ...options
+});
+/**
+ * Create delivery token
+ *
+ * Issue a time-limited bearer token for originals and transformed authenticated assets in an active library. Use library_id from library creation or listing; read access is sufficient. Append token as the __cld_token__ query parameter on a matching delivery URL. The default ACL covers this library and the default lifetime is 900 seconds; narrow acl and expires_in before sharing. Anyone holding the token can read matching paths until expires_at.
+ */
+export const mediaCreateDeliveryToken = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/delivery_tokens',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Summarize understanding failures
+ *
+ * Inspect current understanding failures before retrying. Use library_id from library creation or listing. Groups include code, output kind, actual producer model, retryability and up to five sample asset IDs. At most 1024 detailed groups plus two overflow groups are returned; overflow groups separate retryable and unrecoverable entries and mark overflow=true. Unknown failure codes remain retryable. Historical counts are provisional while counts_complete is false. Example: GET /media/v1/libraries/lib_example/understandings/failure_summary.
+ */
+export const mediaUnderstandingFailureSummary = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/understandings/failure_summary',
+    ...options
+});
+/**
+ * List understanding results across a library
+ *
+ * Read current understanding entries across one library without fetching every asset separately. Use library_id from creation or listing. folder includes descendants; kinds is a comma-separated list of output kinds. Entries are ordered by asset_id and then understanding id. Continue with next_cursor and the same folder and kinds; limit defaults to 100 and cannot exceed 100. Superseded, deleted and old-version entries are excluded. During historical backfill, this method returns 503 CAPACITY rather than incomplete pages; poll failureSummary until counts_complete is true, then start pagination. Example: GET /media/v1/libraries/lib_example/understandings?folder=travel&kinds=caption,transcript&limit=100.
+ */
+export const mediaListUnderstandingsByLibrary = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/understandings',
+    ...options
+});
+/**
+ * Create video generation
+ *
+ * Create a video.generate job. Generation is charged per second. The response is 202 with a queued Job; poll GET /media/v1/libraries/{library_id}/jobs/{job_id} until terminal, then save successful outputs. Unsaved candidate Files expire after 7 days.
+ */
+export const mediaCreateGeneration = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/generations',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List jobs
+ *
+ * List batch and video-generation jobs in a library. Filter by status and continue with next_cursor. Poll a generation Job until terminal, then save successful candidate outputs before they expire after 7 days.
+ */
+export const mediaListJobs = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/jobs',
+    ...options
+});
+/**
+ * Cancel job
+ *
+ * Cancel a queued or running generation job. Already completed outputs remain available to save; poll or read the returned Job to confirm its status.
+ */
+export const mediaCancelJob = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/jobs/{job_id}/cancel',
+    ...options
+});
+/**
+ * Save generation output
+ *
+ * Save a successful candidate as a library asset. Candidate outputs expire after 7 days; save before expiry. Generation is charged per second when the job runs, not when an output is saved.
+ */
+export const mediaSaveGenerationOutput = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/libraries/{library_id}/jobs/{job_id}/outputs/{index}/save',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get generation capabilities
+ *
+ * Read supported text-to-video intent, default model, duration and aspect-ratio limits, per-library concurrency and candidate retention. Generation is charged per second; unsaved candidates expire after 7 days.
+ */
+export const mediaGetGenerationCapabilities = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'media-BearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/media/v1/generation/capabilities',
+    ...options
+});
+/**
+ * List types
+ *
+ * Read the node and relation types registered for this organization before writing, so a create names a type the graph accepts. Each entry is one registrant's registration with its owner, version and definitions. Types cannot be created at runtime; they are registered by the owning service at deploy time, so a type missing here is not available to write.
+ */
+export const ontologyListTypes = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/types',
+    ...options
+});
+/**
+ * Register type
+ *
+ * Register a node or relation type for this organization. Not open yet — this call currently answers 501 NOT_IMPLEMENTED and writes nothing, because a registration is checked and stored by the deploy gate that ships the registering service, not by a runtime call. Until it opens, read the types already in force with praxis.ontology.types.list and create records only of those types.
+ */
+export const ontologyRegisterType = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/types',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Retrieve type
+ *
+ * Read one registered type's definition before writing a record of it, to learn whether it is a node or an edge, which endpoints an edge type admits, and which origins it accepts. The name comes from types.list; a name that is not registered answers ONTOLOGY_TYPE_UNKNOWN, and writes of that type are refused.
+ */
+export const ontologyRetrieveType = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/types/{name}',
+    ...options
+});
+/**
+ * List nodes
+ *
+ * Discover the entities in this organization's graph and obtain node ids for retrieval, updates and relations. Filter by type, by free text over names, aliases, descriptions and facts, or by owner; limit is 1–100 and defaults to 50. Omit cursor for the first page, then copy next_cursor into the next request until it is null. A node whose content belongs to somebody else comes back as a restricted entry carrying only its id, type and name.
+ */
+export const ontologyListNodes = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/nodes',
+    ...options
+});
+/**
+ * Create node
+ *
+ * Record one entity in the graph, for a system mirroring a record it owns. type must already be registered and ref, when given, must match that type's ref_prefix. Send an Idempotency-Key header; repeating the same key with the same content returns the first result instead of creating a second node. This writes structure only — to give an agent something to remember, use POST /agent/v1/agents/{agent_id}/consolidations.
+ */
+export const ontologyCreateNode = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/nodes',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Retrieve node
+ *
+ * Read one node's content and, with expand=relations, every relation on and around it. as_of reads the node as it was at that time. A node id from another organization, or one that never existed, answers ONTOLOGY_NODE_NOT_FOUND; a node you may reach but not read returns restricted true with its name only.
+ */
+export const ontologyRetrieveNode = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/nodes/{node_id}',
+    ...options
+});
+/**
+ * Update node
+ *
+ * Change a node's name, aliases or description when the mirrored record was renamed, without touching its type or identity. Send only the fields to change; omitted fields keep their current values and an explicitly null description clears it. Repeating the same edit converges on the same node, so this needs no Idempotency-Key.
+ */
+export const ontologyUpdateNode = (options) => (options.client ?? client).patch({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/nodes/{node_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Merge node
+ *
+ * Fold a duplicate node into the node that should survive, when two records are discovered to be the same entity. The merged node's relations and aliases move to the survivor and later reads of the duplicate resolve to it. Send an Idempotency-Key header; repeating the same key replays the first result. Reversal is a staff operation, not available here.
+ */
+export const ontologyMergeNode = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/nodes/{node_id}/merge',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List relations
+ *
+ * Read the facts in the graph and obtain relation ids for retrieval, invalidation or spreading. Filter by endpoint node, by type and by direction; as_of reads the relations as they were then. Invalidated relations are omitted unless include_invalid is true. limit is 1–100 and defaults to 50; follow next_cursor until it is null.
+ */
+export const ontologyListRelations = (options) => (options?.client ?? client).get({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/relations',
+    ...options
+});
+/**
+ * Create relation
+ *
+ * Record one fact between two existing nodes, for a system mirroring a relationship it owns. type must be registered and must admit these endpoints; fact states the relationship in one sentence. Send an Idempotency-Key header; repeating the same key returns the first result instead of writing a second relation. This writes structure only — to give an agent something to remember, use POST /agent/v1/agents/{agent_id}/consolidations.
+ */
+export const ontologyCreateRelation = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/relations',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Retrieve relation
+ *
+ * Read one relation's fact and both of its clocks — valid_at and invalid_at for when it was true in the world, created_at and expired_at for when it was recorded and retired. An id from another organization, or one that never existed, answers ONTOLOGY_EDGE_NOT_FOUND.
+ */
+export const ontologyRetrieveRelation = (options) => (options.client ?? client).get({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/relations/{relation_id}',
+    ...options
+});
+/**
+ * Invalidate relation
+ *
+ * Mark a relation as no longer true from a world time, when the mirrored record changed. The relation is kept — invalid_at moves and the relation still reads at an earlier as_of, so history stays answerable. Send an Idempotency-Key header; repeating the same key replays the first result. There is no delete.
+ */
+export const ontologyInvalidateRelation = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/relations/{relation_id}/invalidate',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Apply changeset
+ *
+ * Apply a batch of node, relation and invalidation operations as one transaction, when a mirror has several records to write together and a partial write would leave the graph inconsistent. Every operation succeeds or none is applied. Send an Idempotency-Key header; the same key with the same content replays the first result, and the same key with different content is ONTOLOGY_CONFLICT.
+ */
+export const ontologyApplyChangeset = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/changesets',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Search nodes
+ *
+ * Resolve text to the nodes it most likely names, when a mirror holds a name and needs the node id it corresponds to. Results are ranked candidates, not an answer, each reporting whether the match came from the node's name, an alias, its description or a relation's fact. Narrow with types, and cap the result count with limit (1–50, default 20). This reads structure; it is not an agent recall — agents recall through POST /agent/v1/agents/{agent_id}/consolidations.
+ */
+export const ontologySearch = (options) => (options.client ?? client).post({
+    security: [{
+            key: 'ontology-bearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }],
+    url: '/ontology/v1/search',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List sandboxes (v2)
+ *
+ * List your running and paused sandboxes with paging and filters. Use it to find a sandboxID before connecting to, pausing or killing a sandbox. Filter by state, template (id or alias), name, metadata (key=value pairs joined with &) and startedAfter; order sorts by start time (default newest first); limit is 1 to 100 (default 100). When more results exist the response carries an x-next-token header; send it back as nextToken for the next page. To read one sandbox use getSandbox.
+ */
+export const getSandboxV1Sandboxes = (options) => (options?.client ?? client).get({
+    querySerializer: { parameters: { state: { array: { explode: false } } } },
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/sandboxes',
+    ...options
+});
+/**
+ * Create sandbox (v2)
+ *
+ * Create a sandbox from the template. All system communication with the sandbox is secured.
+ */
+export const postSandboxV1Sandboxes = (options) => (options.client ?? client).post({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/sandboxes',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Sandbox metrics
+ *
+ * Read CPU, memory and disk usage samples of a sandbox over a time window. Use it to size a sandbox or find out why it is slow. start and end are Unix timestamps in seconds; without them the recent samples are returned. An unknown id answers 404.
+ */
+export const getSandboxV1SandboxesBySandboxIdMetrics = (options) => (options.client ?? client).get({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/sandboxes/{sandboxID}/metrics',
+    ...options
+});
+/**
+ * Pause sandbox
+ *
+ * Pause a running sandbox, keeping its files and memory so that connectSandbox can resume it later. Use it to stop paying for compute without losing state; to discard the sandbox use killSandbox. Success answers 204. A sandbox that is not running answers 409.
+ */
+export const postSandboxV1SandboxesBySandboxIdPause = (options) => (options.client ?? client).post({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/sandboxes/{sandboxID}/pause',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Set sandbox timeout
+ *
+ * Set the timeout for the sandbox. The sandbox will expire x seconds from the time of the request. Calling this method multiple times overwrites the TTL, each time using the current timestamp as the starting point to measure the timeout duration.
+ */
+export const postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.client ?? client).post({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/sandboxes/{sandboxID}/timeout',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Connect sandbox (v2)
+ *
+ * Returns sandbox details. If the sandbox is paused, it will be resumed. TTL is only extended. The request body is optional; an omitted timeout defaults to 300 seconds.
+ */
+export const postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.client ?? client).post({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
             scheme: 'bearer',
             type: 'http'
-        }],
-    url: '/media/v1/libraries/{library_id}/assets:batch',
+        }
+    ],
+    url: '/sandbox/v1/sandboxes/{sandboxID}/connect',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6169,40 +8494,89 @@ export const mediaBatchAssets = (options) => (options.client ?? client).post({
     }
 });
 /**
- * Get job alias
+ * List templates (v2)
  *
- * Alias of batch retrieval. Read the job returned by a batch request, including terminal status, successful and failed counts, and individual failure codes.
+ * List official templates and all your custom templates, including waiting, building, ready and error builds. Custom templates appear first; each custom row describes its latest build, not necessarily the current ready build. Use templateID for build management and a ready template name when creating a sandbox. Own-face official distinguishes public catalog entries; sourceKind is omitted until a source is submitted and on official templates. Other organizations' templates are invisible.
  */
-export const mediaGetJob = (options) => (options.client ?? client).get({
-    security: [{
-            key: 'media-BearerAuth',
+export const listSandboxTemplates = (options) => (options?.client ?? client).get({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
             scheme: 'bearer',
             type: 'http'
-        }],
-    url: '/media/v1/libraries/{library_id}/jobs/{job_id}',
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/templates',
     ...options
 });
 /**
- * List events
+ * Create template (v3)
  *
- * Read library events in sequence order, including while the library is deleting. Page forward with asc and after_seq, or backward with desc and before_seq; never combine the two sequence cursors.
+ * Reserve a waiting build before submitting its source. Reusing a name in your organization allocates a new build on the same template. Returns templateID and buildID; start it with templates.builds.update, then poll templates.builds.status.list. A name:tag suffix and tags are assigned after successful publication. Example: {"name":"my-template","cpuCount":2,"memoryMB":2048}. The own face also accepts diskGb, a positive integer defaulting to 10 GiB.
  */
-export const mediaListEvents = (options) => (options.client ?? client).get({
-    security: [{
-            key: 'media-BearerAuth',
+export const requestTemplateBuild = (options) => (options.client ?? client).post({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
             scheme: 'bearer',
             type: 'http'
-        }],
-    url: '/media/v1/libraries/{library_id}/events',
-    ...options
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/templates',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * List sandboxes (v2)
+ * List team volumes
  *
- * List your running and paused sandboxes with paging and filters. Use it to find a sandboxID before connecting to, pausing or killing a sandbox. Filter by state, template (id or alias), name, metadata (key=value pairs joined with &) and startedAfter; order sorts by start time (default newest first); limit is 1 to 100 (default 100). When more results exist the response carries an x-next-token header; send it back as nextToken for the next page. To read one sandbox use getSandbox.
+ * List the volumes of your team. Use it to find a volumeID before reading or deleting a volume, or to attach a volume to a sandbox by name when you create it.
  */
-export const getSandboxV1Sandboxes = (options) => (options?.client ?? client).get({
-    querySerializer: { parameters: { state: { array: { explode: false } } } },
+export const getSandboxV1Volumes = (options) => (options?.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6231,15 +8605,15 @@ export const getSandboxV1Sandboxes = (options) => (options?.client ?? client).ge
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes',
+    url: '/sandbox/v1/volumes',
     ...options
 });
 /**
- * Create sandbox (v2)
+ * Create team volume
  *
- * Create a sandbox from the template. All system communication with the sandbox is secured.
+ * Create a team volume: persistent storage that can be mounted into sandboxes and outlives them. Send the volume name; the response returns the volume id and name. Use getVolume to read it back and deleteVolume to remove it.
  */
-export const postSandboxV1Sandboxes = (options) => (options.client ?? client).post({
+export const postSandboxV1Volumes = (options) => (options.client ?? client).post({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6268,7 +8642,7 @@ export const postSandboxV1Sandboxes = (options) => (options.client ?? client).po
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes',
+    url: '/sandbox/v1/volumes',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6276,11 +8650,11 @@ export const postSandboxV1Sandboxes = (options) => (options.client ?? client).po
     }
 });
 /**
- * Sandbox metrics
+ * Delete team volume
  *
- * Read CPU, memory and disk usage samples of a sandbox over a time window. Use it to size a sandbox or find out why it is slow. start and end are Unix timestamps in seconds; without them the recent samples are returned. An unknown id answers 404.
+ * Delete a team volume and its data permanently. Use it only when no sandbox needs the volume any more; the data cannot be recovered. Success answers 204; an unknown id answers 404.
  */
-export const getSandboxV1SandboxesBySandboxIdMetrics = (options) => (options.client ?? client).get({
+export const deleteSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).delete({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6309,15 +8683,15 @@ export const getSandboxV1SandboxesBySandboxIdMetrics = (options) => (options.cli
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/metrics',
+    url: '/sandbox/v1/volumes/{volumeID}',
     ...options
 });
 /**
- * Pause sandbox
+ * Team volume
  *
- * Pause a running sandbox, keeping its files and memory so that connectSandbox can resume it later. Use it to stop paying for compute without losing state; to discard the sandbox use killSandbox. Success answers 204. A sandbox that is not running answers 409.
+ * Read one team volume by id. Use it to confirm a volume exists and to read its name before mounting it in a sandbox. An unknown id answers 404.
  */
-export const postSandboxV1SandboxesBySandboxIdPause = (options) => (options.client ?? client).post({
+export const getSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6346,19 +8720,15 @@ export const postSandboxV1SandboxesBySandboxIdPause = (options) => (options.clie
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/pause',
-    ...options,
-    headers: {
-        'Content-Type': 'application/json',
-        ...options.headers
-    }
+    url: '/sandbox/v1/volumes/{volumeID}',
+    ...options
 });
 /**
- * Set sandbox timeout
+ * Fork sandbox
  *
- * Set the timeout for the sandbox. The sandbox will expire x seconds from the time of the request. Calling this method multiple times overwrites the TTL, each time using the current timestamp as the starting point to measure the timeout duration.
+ * Fork the sandbox: checkpoint the running sandbox in place (it is briefly paused, snapshotted with its full memory state, and resumed on its node, keeping its ID and expiration untouched) and create count new sandboxes from that snapshot. Returns one result per requested fork, each carrying either the created sandbox or the error that prevented it from starting. A non-201 status means the request failed before any fork was attempted.
  */
-export const postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.client ?? client).post({
+export const postSandboxV1SandboxesBySandboxIdFork = (options) => (options.client ?? client).post({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6387,7 +8757,7 @@ export const postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.cl
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/timeout',
+    url: '/sandbox/v1/sandboxes/{sandboxID}/fork',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6395,11 +8765,11 @@ export const postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.cl
     }
 });
 /**
- * Connect sandbox (v2)
+ * Create snapshot
  *
- * Returns sandbox details. If the sandbox is paused, it will be resumed. TTL is only extended. The request body is optional; an omitted timeout defaults to 300 seconds.
+ * Create a persistent snapshot from the sandbox's current state. Snapshots can be used to create new sandboxes and persist beyond the original sandbox's lifetime.
  */
-export const postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.client ?? client).post({
+export const postSandboxV1SandboxesBySandboxIdSnapshots = (options) => (options.client ?? client).post({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6428,7 +8798,7 @@ export const postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.cl
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/connect',
+    url: '/sandbox/v1/sandboxes/{sandboxID}/snapshots',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6436,11 +8806,11 @@ export const postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.cl
     }
 });
 /**
- * List templates (v2)
+ * List snapshots
  *
- * List the templates you can create sandboxes from. Use it to pick the template id or alias for createSandbox. `base` is the default template that createSandbox uses when templateID is omitted. limit is 1 to 100 (default 100); send the cursor from the response back as nextToken to continue.
+ * List the snapshots you created, one cursor page at a time. Use it to find a snapshot id before you create a sandbox from it or delete it. Filter by sandboxID (the source sandbox) or by name or snapshot id, optionally tag-qualified; limit is 1 to 100 (default 100). When more results exist send the cursor from the response back as nextToken.
  */
-export const getSandboxV1Templates = (options) => (options?.client ?? client).get({
+export const getSandboxV1Snapshots = (options) => (options?.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6469,15 +8839,15 @@ export const getSandboxV1Templates = (options) => (options?.client ?? client).ge
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/templates',
+    url: '/sandbox/v1/snapshots',
     ...options
 });
 /**
- * List team volumes
+ * Delete template
  *
- * List the volumes of your team. Use it to find a volumeID before reading or deleting a volume, or to attach a volume to a sandbox by name when you create it.
+ * Delete one of your snapshots. Sandboxes already created from it keep running; no new sandbox can be created from it afterwards. Success answers 204. A snapshot that does not exist or belongs to someone else answers 404.
  */
-export const getSandboxV1Volumes = (options) => (options?.client ?? client).get({
+export const deleteSandboxV1SnapshotsBySnapshotId = (options) => (options.client ?? client).delete({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6506,15 +8876,15 @@ export const getSandboxV1Volumes = (options) => (options?.client ?? client).get(
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/volumes',
+    url: '/sandbox/v1/snapshots/{snapshotID}',
     ...options
 });
 /**
- * Create team volume
+ * Update sandbox network
  *
- * Create a team volume: persistent storage that can be mounted into sandboxes and outlives them. Send the volume name; the response returns the volume id and name. Use getVolume to read it back and deleteVolume to remove it.
+ * Update the network configuration for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting field clears it.
  */
-export const postSandboxV1Volumes = (options) => (options.client ?? client).post({
+export const putSandboxV1SandboxesBySandboxIdNetwork = (options) => (options.client ?? client).put({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6543,7 +8913,7 @@ export const postSandboxV1Volumes = (options) => (options.client ?? client).post
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/volumes',
+    url: '/sandbox/v1/sandboxes/{sandboxID}/network',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6551,11 +8921,11 @@ export const postSandboxV1Volumes = (options) => (options.client ?? client).post
     }
 });
 /**
- * Delete team volume
+ * Sandbox logs (v2)
  *
- * Delete a team volume and its data permanently. Use it only when no sandbox needs the volume any more; the data cannot be recovered. Success answers 204; an unknown id answers 404.
+ * Read the log lines of a sandbox. Use it to debug what ran inside a sandbox. cursor is a start timestamp in milliseconds, direction chooses forward or backward from it, level sets the lowest level to return, search is a case-sensitive substring filter (at most 256 characters) and limit caps the count (at most 1000, default 1000). To continue, pass the timestamp of the last entry as the next cursor.
  */
-export const deleteSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).delete({
+export const getSandboxV1SandboxesBySandboxIdLogs = (options) => (options.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6584,15 +8954,15 @@ export const deleteSandboxV1VolumesByVolumeId = (options) => (options.client ??
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/volumes/{volumeID}',
+    url: '/sandbox/v1/sandboxes/{sandboxID}/logs',
     ...options
 });
 /**
- * Team volume
+ * Start template build (v2)
  *
- * Read one team volume by id. Use it to confirm a volume exists and to read its name before mounting it in a sandbox. An unknown id answers 404.
+ * Submit source for a waiting build returned by templates.create; returns 202 after queueing, not after successful publication. Unlike E2B, COPY is rejected (use RUN curl or git clone), fromTemplate accepts official catalog names only, and plaintext registry credentials are rejected. The own face also accepts dockerfile, mutually exclusive with fromImage/fromTemplate/steps, and fromImageRegistry vault references for nonofficial images. Poll templates.builds.status.list until ready or error. Example: {"fromImage":"node:22","steps":[{"type":"RUN","args":["echo hello"]}]}.
  */
-export const getSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).get({
+export const startTemplateBuild = (options) => (options.client ?? client).post({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6621,15 +8991,19 @@ export const getSandboxV1VolumesByVolumeId = (options) => (options.client ?? cli
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/volumes/{volumeID}',
-    ...options
+    url: '/sandbox/v1/templates/{templateID}/builds/{buildID}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Fork sandbox
+ * Template build status
  *
- * Fork the sandbox: checkpoint the running sandbox in place (it is briefly paused, snapshotted with its full memory state, and resumed on its node, keeping its ID and expiration untouched) and create count new sandboxes from that snapshot. Returns one result per requested fork, each carrying either the created sandbox or the error that prevented it from starting. A non-201 status means the request failed before any fork was attempted.
+ * Poll a build using templateID and buildID from templates.create. waiting means source has not been submitted; building includes queued work; ready permits sandbox creation; error is terminal, with reason when available. logsOffset counts previously read log entries, starting at zero; add logEntries.length after each response. limit is 0–100, default 100. level selects one log level; offsets then count entries at that level. Drain logs until an empty page, including after a terminal status.
  */
-export const postSandboxV1SandboxesBySandboxIdFork = (options) => (options.client ?? client).post({
+export const getTemplateBuildStatus = (options) => (options.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6658,19 +9032,15 @@ export const postSandboxV1SandboxesBySandboxIdFork = (options) => (options.clien
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/fork',
-    ...options,
-    headers: {
-        'Content-Type': 'application/json',
-        ...options.headers
-    }
+    url: '/sandbox/v1/templates/{templateID}/builds/{buildID}/status',
+    ...options
 });
 /**
- * Create snapshot
+ * Delete template
  *
- * Create a persistent snapshot from the sandbox's current state. Snapshots can be used to create new sandboxes and persist beyond the original sandbox's lifetime.
+ * Permanently remove your template, its builds and tag assignments using templateID from templates.create. Active instances prevent deletion with 409; terminate them first. Unknown or other-organization IDs return 404. Snapshot IDs use snapshots.delete instead.
  */
-export const postSandboxV1SandboxesBySandboxIdSnapshots = (options) => (options.client ?? client).post({
+export const deleteUserTemplate = (options) => (options.client ?? client).delete({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6699,19 +9069,15 @@ export const postSandboxV1SandboxesBySandboxIdSnapshots = (options) => (options.
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/snapshots',
-    ...options,
-    headers: {
-        'Content-Type': 'application/json',
-        ...options.headers
-    }
+    url: '/sandbox/v1/templates/{templateID}',
+    ...options
 });
 /**
- * List snapshots
+ * List template builds
  *
- * List the snapshots you created, one cursor page at a time. Use it to find a snapshot id before you create a sandbox from it or delete it. Filter by sandboxID (the source sandbox) or by name or snapshot id, optionally tag-qualified; limit is 1 to 100 (default 100). When more results exist send the cursor from the response back as nextToken.
+ * Inspect your template and its newest builds using templateID from templates.create. Build states are waiting, building, ready or error. Use limit and the returned x-next-token header to page builds. Unknown or other-organization templates return 404.
  */
-export const getSandboxV1Snapshots = (options) => (options?.client ?? client).get({
+export const getTemplateWithBuilds = (options) => (options.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6740,15 +9106,15 @@ export const getSandboxV1Snapshots = (options) => (options?.client ?? client).ge
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/snapshots',
+    url: '/sandbox/v1/templates/{templateID}',
     ...options
 });
 /**
- * Delete template
+ * Delete template tags
  *
- * Delete one of your snapshots. Sandboxes already created from it keep running; no new sandbox can be created from it afterwards. Success answers 204. A snapshot that does not exist or belongs to someone else answers 404.
+ * Remove the specified tag labels from your template by name, for example {"name":"my-template","tags":["stable"]}. Builds remain available. Removing default means untagged sandbox creation no longer resolves this template. Unknown or other-organization names return 404. b<number> names are reserved read-only build aliases and cannot be assigned or deleted as tags.
  */
-export const deleteSandboxV1SnapshotsBySnapshotId = (options) => (options.client ?? client).delete({
+export const deleteTemplateTags = (options) => (options.client ?? client).delete({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6777,15 +9143,19 @@ export const deleteSandboxV1SnapshotsBySnapshotId = (options) => (options.client
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/snapshots/{snapshotID}',
-    ...options
+    url: '/sandbox/v1/templates/tags',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
- * Update sandbox network
+ * Assign template tags
  *
- * Update the network configuration for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting field clears it.
+ * Assign tags to the ready build selected by target in name:tag format, for example {"target":"my-template:default","tags":["stable"]}. Names belong to your organization. Tags move an existing label to this build without rebuilding. Obtain available names from templates.list and tags from templates.tags.list. b<number> names are reserved read-only build aliases and cannot be assigned or deleted as tags. target also accepts name:b<number> to select a ready build by number, for example my-template:b1.
  */
-export const putSandboxV1SandboxesBySandboxIdNetwork = (options) => (options.client ?? client).put({
+export const assignTemplateTags = (options) => (options.client ?? client).post({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6814,7 +9184,7 @@ export const putSandboxV1SandboxesBySandboxIdNetwork = (options) => (options.cli
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/network',
+    url: '/sandbox/v1/templates/tags',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -6822,11 +9192,11 @@ export const putSandboxV1SandboxesBySandboxIdNetwork = (options) => (options.cli
     }
 });
 /**
- * Sandbox logs (v2)
+ * List template tags
  *
- * Read the log lines of a sandbox. Use it to debug what ran inside a sandbox. cursor is a start timestamp in milliseconds, direction chooses forward or backward from it, level sets the lowest level to return, search is a case-sensitive substring filter (at most 256 characters) and limit caps the count (at most 1000, default 1000). To continue, pass the timestamp of the last entry as the next cursor.
+ * Read the tag-to-build assignments for your template using templateID from templates.create. Only ready builds acquire tags. Use a returned tag with the template name as name:tag when creating a sandbox or assigning additional tags. Foreign IDs return 404.
  */
-export const getSandboxV1SandboxesBySandboxIdLogs = (options) => (options.client ?? client).get({
+export const listTemplateTags = (options) => (options.client ?? client).get({
     security: [
         {
             key: 'sandbox-ApiKeyAuth',
@@ -6855,7 +9225,44 @@ export const getSandboxV1SandboxesBySandboxIdLogs = (options) => (options.client
             type: 'http'
         }
     ],
-    url: '/sandbox/v1/sandboxes/{sandboxID}/logs',
+    url: '/sandbox/v1/templates/{templateID}/tags',
+    ...options
+});
+/**
+ * Check template alias
+ *
+ * Resolve a name within your organization to its templateID before reading or managing builds. Use the bare template name, without a :tag suffix. Unknown and other-organization names return 404. The response public field is false for your private templates.
+ */
+export const resolveTemplateAlias = (options) => (options.client ?? client).get({
+    security: [
+        {
+            key: 'sandbox-ApiKeyAuth',
+            name: 'X-API-Key',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AuthProviderBearerAuth',
+            scheme: 'bearer',
+            type: 'http'
+        },
+        {
+            key: 'sandbox-AuthProviderTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        { name: 'X-Admin-Token', type: 'apiKey' },
+        {
+            key: 'sandbox-AdminTeamAuth',
+            name: 'X-Team-ID',
+            type: 'apiKey'
+        },
+        {
+            key: 'sandbox-AdminJWTAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }
+    ],
+    url: '/sandbox/v1/templates/aliases/{alias}',
     ...options
 });
 /**
@@ -6947,7 +9354,7 @@ export const vaultListVaults = (options) => (options?.client ?? client).get({
 /**
  * Create vault
  *
- * Create an empty, active vault to hold credentials for your account, with a display name and optional metadata. Use its returned id as vault_id when creating secrets or OAuth authorizations. Unlike Anthropic, Agent sessions do not accept nonempty vault_ids; storing a credential or adding its ID to metadata does not enable vault-backed MCP authentication. Application vault references are also unavailable; praxis_vault_ref version bindings and secret writes with a vault source return 501, so creating a vault does not yet enable either consumer.
+ * Create an empty, active vault to hold credentials for your account, with a display name and optional metadata. Use its returned id as vault_id when creating secrets or OAuth authorizations. Agent sessions and deployments accept up to 50 vault_ids and match their credentials against the session's MCP servers, so a stored static or oauth credential does serve as vault-backed MCP authentication; only environment_variable credentials are not yet placed, because the egress proxy ADR-058 §6 gives them is not built. Application vault references are also unavailable; praxis_vault_ref version bindings and secret writes with a vault source return 501, so creating a vault does not yet enable either consumer.
  */
 export const vaultCreateVault = (options) => (options.client ?? client).post({
     security: [{
@@ -7071,7 +9478,7 @@ export const vaultListSecrets = (options) => (options.client ?? client).get({
 /**
  * Create secret
  *
- * Store a manually supplied token in an active vault for use on requests to its allowed_hosts. Unlike Anthropic credentials, this native operation takes name, value and allowed_hosts directly and creates only static secrets; use praxis.vault.authorizations.create for OAuth. Its name must be unused by any non-archived secret in that vault; the response contains metadata but never the supplied value. Application praxis_vault_ref bindings declare vault_id and secret (the secret name), but currently return 501; do not copy the value into a plain-text binding or metadata as a substitute.
+ * Store a manually supplied token in an active vault. Omit allowed_hosts for name-based resolution only; host-based redemption never matches an empty host list. Unlike Anthropic credentials, this native operation takes name and value directly, with optional allowed_hosts and creates only static secrets; use praxis.vault.authorizations.create for OAuth. Its name must be unused by any non-archived secret in that vault; the response contains metadata but never the supplied value. Application praxis_vault_ref bindings declare vault_id and secret (the secret name), but currently return 501; do not copy the value into a plain-text binding or metadata as a substitute.
  */
 export const vaultCreateSecret = (options) => (options.client ?? client).post({
     security: [{
@@ -7089,7 +9496,7 @@ export const vaultCreateSecret = (options) => (options.client ?? client).post({
 /**
  * Import secrets
  *
- * Import lines or dotenv text into an active vault, reporting success or failure for each entry. Existing names have their values replaced; their hosts change only when that line supplies allowed_hosts. Shared hosts apply only to newly created secrets.
+ * Import lines or dotenv text into an active vault, reporting success or failure for each entry. Existing names have their values replaced; their hosts change only when that line supplies allowed_hosts. Shared hosts apply only to newly created secrets; if neither shared nor per-line hosts are supplied, new secrets use an empty host list for name-based resolution only.
  */
 export const vaultImportSecrets = (options) => (options.client ?? client).post({
     security: [{
@@ -7641,7 +10048,7 @@ export const ticketGetMilestones = (options) => (options?.client ?? client).get(
 /**
  * Create or add milestones
  *
- * Create or add milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.
+ * Create or add milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.
  */
 export const ticketPostMilestones = (options) => (options.client ?? client).post({
     security: [{
@@ -7663,7 +10070,7 @@ export const ticketPostMilestones = (options) => (options.client ?? client).post
 /**
  * Remove milestones
  *
- * Remove milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.
+ * Remove milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.
  */
 export const ticketDeleteMilestonesNumber = (options) => (options.client ?? client).delete({
     security: [{
@@ -7699,7 +10106,7 @@ export const ticketGetMilestonesNumber = (options) => (options.client ?? client)
 /**
  * Update milestones
  *
- * Update milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.
+ * Update milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.
  */
 export const ticketPatchMilestonesNumber = (options) => (options.client ?? client).patch({
     security: [{