@inferencesh/sdk 0.27.0 → 0.29.0

package/dist/types.d.ts

@@ -266,14 +266,6 @@ export interface MCPToolConfigDTO {
     tool_name: string;
     credential_id?: string;
 }
-/**
- * AgentImages contains display images for an agent
- */
-export interface AgentImages {
-    card: string;
-    thumbnail: string;
-    banner: string;
-}
 /**
  * CoreAppConfigDTO references an app used as the agent's core
  */
@@ -295,7 +287,7 @@ export interface AgentDTO extends BaseModelDTO, PermissionModelDTO, ProjectModel
      * Title is the human-readable name; empty falls back to Name.
      */
     title: string;
-    images: AgentImages;
+    images: ResourceImages;
     version_id: string;
     version?: AgentVersionDTO;
     /**
@@ -345,7 +337,7 @@ export interface CreateAgentRequest {
     id?: string;
     name: string;
     title?: string;
-    images?: AgentImages;
+    images?: ResourceImages;
     visibility?: Visibility;
     /**
      * Harness runs the agent: "inference" (ours) or an external harness.
@@ -572,7 +564,7 @@ export interface CreateAppRequest {
     description?: string;
     agent_description?: string;
     category?: AppCategory;
-    images?: AppImages;
+    images?: ResourceImages;
     /**
      * Tags replace the app's tags when given; omitted, a deploy takes them
      * from the version's metadata.tags, and keeps the stored ones if that is
@@ -773,6 +765,12 @@ export interface SecretCreateRequest {
      */
     provider_name?: string;
     provider_website?: string;
+    /**
+     * Label names this key among the owner's keys for Provider (prod,
+     * personal): a new label adds a key beside the others, the same label
+     * replaces that key's value. Empty: the owner's default key.
+     */
+    label?: string;
 }
 /**
  * SecretProviderRequest attaches an existing secret to a provider's
@@ -784,6 +782,11 @@ export interface SecretProviderRequest {
     connection_scope?: CredentialScope;
     provider_name?: string;
     provider_website?: string;
+    /**
+     * Label names the key among the owner's keys for Provider, as on
+     * SecretCreateRequest. Empty: the owner's default key.
+     */
+    label?: string;
 }
 export interface SecretUpdateRequest {
     value: string;
@@ -1103,7 +1106,7 @@ export declare const ScopeSecretsWrite: Scope;
 export declare const ScopeSecretsReveal: Scope;
 /**
  * Action-level scopes for credentials (connected accounts, vaults,
- * auth schemes, MCP servers).
+ * auth providers, MCP servers).
  */
 export declare const ScopeCredentialsRead: Scope;
 /**
@@ -1426,14 +1429,6 @@ export interface AppFunction {
      */
     annotations?: ToolAnnotations;
 }
-/**
- * AppImages holds developer-provided images for the app.
- */
-export interface AppImages {
-    card: string;
-    thumbnail: string;
-    banner: string;
-}
 /**
  * AppGPUResource describes GPU requirements.
  */
@@ -1465,7 +1460,7 @@ export interface SecretRequirement {
  * the platform-defined grants it needs ("x.tweet.read", "google.sheets":
  * an OAuth grant with the scopes it implies), each a capability of the
  * entry's own provider. Provider seeds the catalog row for the company the
- * first time it is seen and never overwrites it; Auth seeds the auth scheme
+ * first time it is seen and never overwrites it; Auth seeds the auth provider
  * when the slug is free.
  * 	credentials:
  * 	  slack:
@@ -1489,17 +1484,17 @@ export interface CredentialRequirement {
      * catalog row that does not exist yet. Its slug defaults to the
      * credential slug.
      */
-    provider?: ProviderSeed;
+    provider?: CompanySeed;
     /**
-     * Auth is the credential's auth scheme, for a slug no row defines yet.
+     * Auth is the credential's auth provider, for a slug no row defines yet.
      */
-    auth?: AuthSchemeSpec;
+    auth?: AuthMethod;
 }
 /**
- * ProviderSeed is a provider (the company behind a credential) as an app
+ * CompanySeed is a provider (the company behind a credential) as an app
  * declares it: enough to create its catalog row when none exists.
  */
-export interface ProviderSeed {
+export interface CompanySeed {
     slug?: string;
     name?: string;
     description?: string;
@@ -1531,7 +1526,7 @@ export interface AppDTO extends BaseModelDTO, PermissionModelDTO {
     description: string;
     agent_description: string;
     category: AppCategory;
-    images: AppImages;
+    images: ResourceImages;
     /**
      * Tags name what the app does and its traits, as lowercase slugs
      * (text-to-image, open-weights). GET /store/tags lists the ones in use
@@ -1634,7 +1629,7 @@ export interface AppVersionDTO extends BaseModelDTO {
 export interface DeployWarning {
     /**
      * Code identifies the check: readonly_broad_credential,
-     * unused_credential, missing_annotations.
+     * unused_credential, missing_annotations, unapproved_platform_scope.
      */
     code: string;
     /**
@@ -1702,25 +1697,13 @@ export interface PublicAppStoreDTO {
      */
     title: string;
     description: string;
-    images: AppImages;
+    images: ResourceImages;
     is_featured: boolean;
     rank: number;
     has_approved_version: boolean;
     page_id?: string;
     pricing_description?: string;
 }
-/**
- * ResourceImages is the display-image set every listable resource carries:
- * a card image for grids, a thumbnail for dense rows, a banner for headers.
- * AppImages and AgentImages predate this and hold the same three fields;
- * they should collapse onto this type, but aliasing them changes what
- * gotypegen emits for existing consumers, so that migration is separate.
- */
-export interface ResourceImages {
-    card: string;
-    thumbnail: string;
-    banner: string;
-}
 /**
  * ArtifactDTO is the API shape of an artifact entry.
  */
@@ -1751,6 +1734,12 @@ export interface ArtifactDTO extends BaseModelDTO, PermissionModelDTO {
      * SharedVersionID pins the version viewers see. Empty = always latest.
      */
     shared_version_id?: string;
+    /**
+     * CoverVersionID is the version a captured cover shows. Empty means the
+     * cover (if any) was set by a person or agent, and a capture never
+     * replaces it.
+     */
+    cover_version_id?: string;
     /**
      * Capabilities declared by the latest version (runtime features the page
      * may use). Reserved for the artifact runtime; opaque to the API.
@@ -1763,6 +1752,11 @@ export interface ArtifactDTO extends BaseModelDTO, PermissionModelDTO {
      * URL is the canonical viewer URL for this artifact.
      */
     url?: string;
+    /**
+     * Access is the viewer's level on this artifact: read, interact (may
+     * change its data) or write (may edit it). Set on single reads only.
+     */
+    access?: Permission;
 }
 /**
  * ArtifactVersionDTO is one immutable publish of an artifact.
@@ -1797,6 +1791,32 @@ export interface ArtifactVersionDTO extends BaseModelDTO {
         [key: string]: any;
     };
     created_by_user_id?: string;
+    /**
+     * Files are the pages and data served beside the index page.
+     */
+    files?: ArtifactVersionFileDTO[];
+}
+/**
+ * ArtifactVersionFileDTO is one file published beside a version's index.
+ */
+export interface ArtifactVersionFileDTO {
+    path: string;
+    size_bytes: number;
+    content_type: string;
+}
+/**
+ * ArtifactFileInput is one extra file in a publish, served at Path relative
+ * to the index page: another page (.html, .md), or css, js, json, svg, txt,
+ * xml, csv.
+ */
+export interface ArtifactFileInput {
+    path: string;
+    content: string;
+    /**
+     * ContentEncoding is "base64" when Content is base64-encoded, as for the
+     * main content.
+     */
+    content_encoding?: string;
 }
 /**
  * ArtifactCreateRequest is the body for POST /artifacts. Creates the entry
@@ -1822,6 +1842,11 @@ export interface ArtifactCreateRequest {
      * from browsers and CLIs: edge firewalls reject raw <script> in JSON bodies.
      */
     content_encoding?: string;
+    /**
+     * Files are published beside the index page. A publish is the whole
+     * site: files of the previous version are not carried over.
+     */
+    files?: ArtifactFileInput[];
     label?: string;
     notes?: string;
     origin?: string;
@@ -1868,6 +1893,11 @@ export interface ArtifactPublishRequest {
      * ContentEncoding is "base64" when Content is base64-encoded UTF-8.
      */
     content_encoding?: string;
+    /**
+     * Files are published beside the index page. A publish is the whole
+     * site: files of the previous version are not carried over.
+     */
+    files?: ArtifactFileInput[];
     label?: string;
     notes?: string;
     origin?: string;
@@ -1938,9 +1968,25 @@ export interface ArtifactDataRequest {
         [key: string]: any;
     };
     /**
-     * Limit caps a list; the server clamps it.
+     * Limit caps a list; the server clamps it to 200.
      */
     limit?: number;
+    /**
+     * Cursor continues a list from the next_cursor of the page before.
+     */
+    cursor?: string;
+    /**
+     * Order is the list order: -updated_at (the default), updated_at,
+     * -created_at or created_at.
+     */
+    order?: string;
+    /**
+     * Where keeps only documents whose top-level fields equal these values
+     * (string, number, boolean, or null for a missing field).
+     */
+    where?: {
+        [key: string]: any;
+    };
 }
 /**
  * ArtifactDataListResponse is a page of documents from one collection.
@@ -1949,6 +1995,10 @@ export interface ArtifactDataListResponse {
     collection: string;
     documents: ArtifactDataDTO[];
     count: number;
+    /**
+     * NextCursor fetches the page after this one; empty on the last page.
+     */
+    next_cursor?: string;
 }
 /**
  * ArtifactViewerDTO is what the user capability tells a page about whoever
@@ -2064,6 +2114,21 @@ export interface ResourceStatusDTO {
     status: any;
     updated_at: string;
 }
+/**
+ * ResourceImages is the display-image set every listable resource carries
+ * (apps, agents, artifacts): a card image for grids, a thumbnail for dense
+ * rows, a banner for headers.
+ */
+export interface ResourceImages {
+    card: string;
+    thumbnail: string;
+    banner: string;
+    /**
+     * Dark holds the same slots for a dark theme. Nil means the slots above
+     * serve both themes.
+     */
+    dark?: ResourceImages;
+}
 /**
  * AvailabilityResponse answers "can I use this name?" — for page slugs, team
  * usernames and voucher codes alike.
@@ -2268,6 +2333,10 @@ export interface ChatMessageDTO extends BaseModelDTO, PermissionModelDTO {
     tools?: Tool[];
     tool_call_id?: string;
     tool_invocations?: ToolInvocationDTO[];
+    /**
+     * CompactionMeta is what a compaction (role compaction) retired.
+     */
+    compaction_meta?: CompactionMeta;
 }
 /**
  * PolicyRuleDTO is one rule, typed form Kind[selector](specifier).
@@ -2520,6 +2589,12 @@ export interface CredentialDTO extends BaseModelDTO, PermissionModelDTO {
     account_identifier?: string;
     account_name?: string;
     scopes: StringSlice;
+    /**
+     * AllowedScopes, on an OAuth app row (grant credentials), is every
+     * scope a login through it may request; absent when any scope may be
+     * (a team's own client by default). Never set on a login.
+     */
+    allowed_scopes?: StringSlice;
     expires_at?: string;
     vault_id?: string;
     metadata?: {
@@ -2527,17 +2602,34 @@ export interface CredentialDTO extends BaseModelDTO, PermissionModelDTO {
     };
     is_primary: boolean;
     error_message?: string;
+    /**
+     * Secrets are the secret rows linked to the credential (a key's values),
+     * by row and key, never by value. Filled on the vault's api_key configs
+     * and the admin provider tree.
+     */
+    secrets?: CredentialSecretRef[];
 }
 /**
- * ProviderSummary is the company a credential slug belongs to: the
+ * CredentialSecretRef names one secret linked to a credential: the row's
+ * id, the key it is stored under and when its value last changed.
+ */
+export interface CredentialSecretRef {
+    id: string;
+    key: string;
+    updated_at: string;
+}
+/**
+ * CompanySummary is the company a credential slug belongs to: the
  * providers row's identity, for grouping and display.
  */
-export interface ProviderSummary {
+export interface CompanySummary {
     slug: string;
     name: string;
     icon_url?: string;
     website?: string;
     docs_url?: string;
+    terms_url?: string;
+    privacy_url?: string;
 }
 /**
  * CredentialConfigDTO is the merged view: provider catalog + credential state.
@@ -2546,14 +2638,14 @@ export interface CredentialConfigDTO {
     slug: string;
     /**
      * Provider is the credential slug (what Credential.Provider stores):
-     * one way to authenticate. The company it belongs to is ProviderInfo.
+     * one way to authenticate. The company it belongs to is Company.
      */
     provider: string;
     /**
-     * ProviderInfo is the company this slug belongs to, for grouping: the
-     * providers row its auth scheme names, else the slug's own identity.
+     * Company is the company this slug belongs to, for grouping: the
+     * companies row its auth provider names, else the slug's own identity.
      */
-    provider_info?: ProviderSummary;
+    company?: CompanySummary;
     type: string;
     name: string;
     short_name: string;
@@ -2579,10 +2671,10 @@ export interface CredentialConfigDTO {
      */
     app?: CredentialDTO;
     /**
-     * AuthSchemeID is set when the provider is one the team defined
-     * itself (models.AuthScheme), so the UI can offer edit and remove.
+     * AuthProviderID is set when the provider is one the team defined
+     * itself (models.AuthProvider), so the UI can offer edit and remove.
      */
-    auth_scheme_id?: string;
+    auth_provider_id?: string;
     /**
      * Credential is the login used where no account is named: the caller's
      * own, else the workspace's default account.
@@ -2594,6 +2686,12 @@ export interface CredentialConfigDTO {
      * connected.
      */
     accounts?: (CredentialDTO | undefined)[];
+    /**
+     * MultiAccount: several accounts of this provider can be connected side
+     * by side, each addressed by its account_id; the default (is_primary) is
+     * used where none is named.
+     */
+    multi_account: boolean;
 }
 /**
  * SecretFieldConfig defines a secret field for the UI
@@ -2713,9 +2811,38 @@ export interface EngineDTO extends BaseModelDTO, PermissionModelDTO {
     api_url: string;
     status: EngineStatus;
     engine_version: string;
+    /**
+     * EnginePin is the version the engine is held on; empty follows stable.
+     */
+    engine_pin?: string;
+    /**
+     * Capabilities are what the engine last reported it can do.
+     */
+    capabilities?: EngineCapabilities;
     system_info?: SystemInfo;
     workers: (WorkerDTO | undefined)[];
 }
+/**
+ * EngineUpdateRequest names the release an engine should install: "stable",
+ * "canary", or a version such as v1.9.3. Empty is stable.
+ */
+export interface EngineUpdateRequest {
+    version?: string;
+}
+/**
+ * EngineRelease is one published engine build.
+ */
+export interface EngineRelease {
+    version: string;
+    release_date?: string;
+}
+/**
+ * EngineReleasesResponse is the head of each engine release channel.
+ */
+export interface EngineReleasesResponse {
+    stable?: EngineRelease;
+    canary?: EngineRelease;
+}
 /**
  * EngineSummary is a lightweight engine response embedded in tasks.
  */
@@ -2794,6 +2921,19 @@ export interface WorkerRAM {
     worker_id: string;
     total: number;
 }
+/**
+ * EngineCapability is something an engine can do beyond the base contract
+ * every engine meets. An engine reports the ones it has (EngineTelemetry);
+ * a task lists the ones it needs (Task.Requires); the scheduler only sends
+ * a task to an engine that has every one it needs.
+ */
+export type EngineCapability = "egress_gateway";
+export declare const EngineCapabilityEgressGateway: EngineCapability;
+/**
+ * EngineCapabilities is a set of capabilities, kept as a list. Nil and
+ * empty are the same: nothing beyond the base contract.
+ */
+export type EngineCapabilities = EngineCapability[];
 /**
  * EntitlementDTO for API responses
  */
@@ -4641,6 +4781,26 @@ export interface SecretDTO extends BaseModelDTO, PermissionModelDTO {
      * a plain secret.
      */
     credential_id?: string;
+    /**
+     * The four below are read from the credential a listing preloads; a
+     * row read without it leaves them empty.
+     * Provider is the slug of the credential the secret belongs to.
+     */
+    provider?: string;
+    /**
+     * ProviderName is that credential's display name ("Anthropic").
+     */
+    provider_name?: string;
+    /**
+     * Label is the credential's account identifier: a key's label.
+     */
+    label?: string;
+    /**
+     * CredentialDefault is whether the credential is its owner's default.
+     * Always serialised: a linked non-default row and an unlabelled row
+     * must not read the same.
+     */
+    credential_default: boolean;
 }
 /**
  * SensitiveString is a string type that prevents accidental exposure of secrets.
@@ -5536,58 +5696,58 @@ export declare const GPUTypeNvidia: GPUType;
 export declare const GPUTypeAMD: GPUType;
 export declare const GPUTypeApple: GPUType;
 /**
- * AuthSchemeKind is how a provider authenticates: the kinds of an OpenAPI
+ * AuthMethodKind is how a provider authenticates: the kinds of an OpenAPI
  * Security Scheme Object (oauth2, apiKey, http), named the same so a
  * vendor's spec maps onto a scheme without translation.
  */
-export type AuthSchemeKind = "oauth2" | "api_key" | "http" | "oauth2_authorization_code";
+export type AuthMethodKind = "oauth2" | "api_key" | "http" | "oauth2_authorization_code";
 /**
- * AuthSchemeOAuth2 is OAuth 2.0; Flow says which grant.
+ * AuthMethodOAuth2 is OAuth 2.0; Flow says which grant.
  */
-export declare const AuthSchemeOAuth2: AuthSchemeKind;
+export declare const AuthMethodOAuth2: AuthMethodKind;
 /**
- * AuthSchemeAPIKey is one or more keys a person pastes, sent as a
+ * AuthMethodAPIKey is one or more keys a person pastes, sent as a
  * header or query parameter.
  */
-export declare const AuthSchemeAPIKey: AuthSchemeKind;
+export declare const AuthMethodAPIKey: AuthMethodKind;
 /**
- * AuthSchemeHTTP is a pasted secret sent as an HTTP auth scheme
+ * AuthMethodHTTP is a pasted secret sent as an HTTP auth provider
  * (Authorization: Bearer or Basic).
  */
-export declare const AuthSchemeHTTP: AuthSchemeKind;
+export declare const AuthMethodHTTP: AuthMethodKind;
 /**
- * Deprecated: the kind is AuthSchemeOAuth2 with AuthSchemeFlowAuthorizationCode.
+ * Deprecated: the kind is AuthMethodOAuth2 with AuthMethodFlowAuthorizationCode.
  * Same value, so comparisons keep working; rows still stored as
  * "oauth2_authorization_code" are read as oauth2 (UnmarshalJSON).
  */
-export declare const AuthSchemeOAuth2AuthorizationCode: "oauth2";
+export declare const AuthMethodOAuth2AuthorizationCode: "oauth2";
 /**
- * AuthSchemeFlow is the OAuth 2.0 grant an oauth2 scheme uses.
+ * AuthMethodFlow is the OAuth 2.0 grant an oauth2 scheme uses.
  */
-export type AuthSchemeFlow = "authorization_code" | "client_credentials";
+export type AuthMethodFlow = "authorization_code" | "client_credentials";
 /**
- * AuthSchemeFlowAuthorizationCode is the user-consent flow: authorization
+ * AuthMethodFlowAuthorizationCode is the user-consent flow: authorization
  * endpoint → code → token endpoint, optionally with PKCE. The default.
  */
-export declare const AuthSchemeFlowAuthorizationCode: AuthSchemeFlow;
+export declare const AuthMethodFlowAuthorizationCode: AuthMethodFlow;
 /**
- * AuthSchemeFlowClientCredentials is server-to-server: the app's client
+ * AuthMethodFlowClientCredentials is server-to-server: the app's client
  * id and secret are exchanged at the token endpoint, no redirect, no
  * user. The login is the app's own.
  */
-export declare const AuthSchemeFlowClientCredentials: AuthSchemeFlow;
+export declare const AuthMethodFlowClientCredentials: AuthMethodFlow;
 /**
- * AuthSchemeAPIKeyIn is where an api_key scheme's key travels.
+ * AuthMethodAPIKeyIn is where an api_key scheme's key travels.
  */
-export type AuthSchemeAPIKeyIn = "header" | "query";
-export declare const AuthSchemeAPIKeyInHeader: AuthSchemeAPIKeyIn;
-export declare const AuthSchemeAPIKeyInQuery: AuthSchemeAPIKeyIn;
+export type AuthMethodAPIKeyIn = "header" | "query";
+export declare const AuthMethodAPIKeyInHeader: AuthMethodAPIKeyIn;
+export declare const AuthMethodAPIKeyInQuery: AuthMethodAPIKeyIn;
 /**
- * AuthSchemeHTTPScheme is the Authorization scheme of an http scheme.
+ * AuthMethodHTTPScheme is the Authorization scheme of an http scheme.
  */
-export type AuthSchemeHTTPScheme = "bearer" | "basic";
-export declare const AuthSchemeHTTPBearer: AuthSchemeHTTPScheme;
-export declare const AuthSchemeHTTPBasic: AuthSchemeHTTPScheme;
+export type AuthMethodHTTPScheme = "bearer" | "basic";
+export declare const AuthMethodHTTPBearer: AuthMethodHTTPScheme;
+export declare const AuthMethodHTTPBasic: AuthMethodHTTPScheme;
 /**
  * SecretField is one value a person pastes to connect an api_key or http
  * scheme: its vault key and how the form asks for it. Several fields make
@@ -5601,62 +5761,62 @@ export interface SecretField {
     optional?: boolean;
 }
 /**
- * AuthSchemeClientAuth is how client_id/client_secret reach the token
+ * AuthMethodClientAuth is how client_id/client_secret reach the token
  * endpoint. Most providers accept either; a few insist on one.
  */
-export type AuthSchemeClientAuth = "basic" | "body" | "none";
+export type AuthMethodClientAuth = "basic" | "body" | "none";
 /**
- * AuthSchemeClientAuthBasic sends them as an HTTP Basic Authorization
+ * AuthMethodClientAuthBasic sends them as an HTTP Basic Authorization
  * header (RFC 6749 §2.3.1, the default).
  */
-export declare const AuthSchemeClientAuthBasic: AuthSchemeClientAuth;
+export declare const AuthMethodClientAuthBasic: AuthMethodClientAuth;
 /**
- * AuthSchemeClientAuthBody sends them as form fields in the request body.
+ * AuthMethodClientAuthBody sends them as form fields in the request body.
  */
-export declare const AuthSchemeClientAuthBody: AuthSchemeClientAuth;
+export declare const AuthMethodClientAuthBody: AuthMethodClientAuth;
 /**
- * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * AuthMethodClientAuthNone is a public client (RFC 8414
  * token_endpoint_auth_method "none"): the client id goes in the body,
  * there is no secret, and PKCE is what proves the client. Its OAuth app
  * is complete with a client id alone (a dynamically registered client,
  * or a Client ID Metadata Document URL).
  */
-export declare const AuthSchemeClientAuthNone: AuthSchemeClientAuth;
+export declare const AuthMethodClientAuthNone: AuthMethodClientAuth;
 /**
- * AuthSchemeTokenRequest is the token request's body encoding.
+ * AuthMethodTokenRequest is the token request's body encoding.
  */
-export type AuthSchemeTokenRequest = "form" | "json";
-export declare const AuthSchemeTokenRequestForm: AuthSchemeTokenRequest;
-export declare const AuthSchemeTokenRequestJSON: AuthSchemeTokenRequest;
+export type AuthMethodTokenRequest = "form" | "json";
+export declare const AuthMethodTokenRequestForm: AuthMethodTokenRequest;
+export declare const AuthMethodTokenRequestJSON: AuthMethodTokenRequest;
 /**
- * AuthSchemeRefresh is when an access token is refreshed.
+ * AuthMethodRefresh is when an access token is refreshed.
  */
-export type AuthSchemeRefresh = "" | "always";
+export type AuthMethodRefresh = "" | "always";
 /**
- * AuthSchemeRefreshWhenExpiring refreshes within five minutes of the
+ * AuthMethodRefreshWhenExpiring refreshes within five minutes of the
  * reported expiry; a token with no expiry is treated as long-lived
  * (Slack without token rotation, Notion).
  */
-export declare const AuthSchemeRefreshWhenExpiring: AuthSchemeRefresh;
+export declare const AuthMethodRefreshWhenExpiring: AuthMethodRefresh;
 /**
- * AuthSchemeRefreshAlways refreshes on every read: the provider reports
+ * AuthMethodRefreshAlways refreshes on every read: the provider reports
  * no expiry but the token does expire (Salesforce's session timeout is
  * per org and not reported).
  */
-export declare const AuthSchemeRefreshAlways: AuthSchemeRefresh;
+export declare const AuthMethodRefreshAlways: AuthMethodRefresh;
 /**
- * AuthSchemeRevokeStyle is how the token reaches the revoke endpoint.
+ * AuthMethodRevokeStyle is how the token reaches the revoke endpoint.
  */
-export type AuthSchemeRevokeStyle = "bearer" | "query" | "form";
-export declare const AuthSchemeRevokeBearer: AuthSchemeRevokeStyle;
-export declare const AuthSchemeRevokeQuery: AuthSchemeRevokeStyle;
-export declare const AuthSchemeRevokeForm: AuthSchemeRevokeStyle;
+export type AuthMethodRevokeStyle = "bearer" | "query" | "form";
+export declare const AuthMethodRevokeBearer: AuthMethodRevokeStyle;
+export declare const AuthMethodRevokeQuery: AuthMethodRevokeStyle;
+export declare const AuthMethodRevokeForm: AuthMethodRevokeStyle;
 /**
- * AuthSchemeRevoke is the optional token revocation on disconnect.
+ * AuthMethodRevoke is the optional token revocation on disconnect.
  */
-export interface AuthSchemeRevoke {
+export interface AuthMethodRevoke {
     url: string;
-    style: AuthSchemeRevokeStyle;
+    style: AuthMethodRevokeStyle;
     /**
      * ClientAuth also sends client_id and client_secret in the form
      * (Discord).
@@ -5664,13 +5824,13 @@ export interface AuthSchemeRevoke {
     client_auth?: boolean;
 }
 /**
- * AuthSchemeAppKey is one key of the OAuth app a login goes through. The
+ * AuthMethodAppKey is one key of the OAuth app a login goes through. The
  * client id and secret are implied (PREFIX_CLIENT_ID, PREFIX_CLIENT_SECRET);
  * listing them only overrides their label and placeholder. Other keys
  * (bot_token, signing_secret, tenant_id) are optional extras the app holds,
  * read back by name in templates as {app.<name>} and by hooks.
  */
-export interface AuthSchemeAppKey {
+export interface AuthMethodAppKey {
     /**
      * Name is the key's role: client_id, client_secret, bot_token, …
      */
@@ -5688,13 +5848,13 @@ export interface AuthSchemeAppKey {
     optional?: boolean;
 }
 /**
- * AuthSchemeLookup is a call made after the token exchange, with the new
+ * AuthMethodLookup is a call made after the token exchange, with the new
  * access token as bearer; its decoded response becomes a document root of
  * its name for the identity, metadata and later lookups ({user.email},
  * {resources.0.id}). userinfo_url is shorthand for the lookup named user.
  * URL, body and headers are templates.
  */
-export interface AuthSchemeLookup {
+export interface AuthMethodLookup {
     name: string;
     url: string;
     method?: string;
@@ -5709,11 +5869,11 @@ export interface AuthSchemeLookup {
     };
 }
 /**
- * AuthSchemeCapability is something an app can ask for from this provider,
+ * AuthMethodCapability is something an app can ask for from this provider,
  * satisfied by a connection holding its scopes. Scopes are in the scheme's
  * own (friendly) names, the ones a credential stores.
  */
-export interface AuthSchemeCapability {
+export interface AuthMethodCapability {
     key: string;
     scopes?: string[];
     satisfies?: string[];
@@ -5721,10 +5881,10 @@ export interface AuthSchemeCapability {
     description?: string;
 }
 /**
- * AuthSchemeSpec is one way to authenticate against a provider, as data.
+ * AuthMethod is one way to authenticate against a provider, as data.
  * Everything a standard OAuth2 provider needs is a field; where a provider
  * deviates in a way data cannot express, the spec names a hook and Go
- * supplies it (authprovider.RegisterTokenResponseHook and friends).
+ * supplies it (authmethod.RegisterTokenResponseHook and friends).
  * Templates: URLs, headers, lookup bodies, identifier, name, metadata and
  * env values are strings with {{path}} placeholders. A path is read from
  * the flow's document, which grows as the flow goes:
@@ -5742,12 +5902,12 @@ export interface AuthSchemeCapability {
  * path present. A template none of whose placeholders resolve renders "":
  * omitted from env and metadata, blank as identifier or name.
  */
-export interface AuthSchemeSpec {
-    kind: AuthSchemeKind;
+export interface AuthMethod {
+    kind: AuthMethodKind;
     /**
      * Flow is the oauth2 grant; empty means authorization_code.
      */
-    flow?: AuthSchemeFlow;
+    flow?: AuthMethodFlow;
     /**
      * Fields are what a person pastes (api_key and http kinds).
      */
@@ -5757,13 +5917,13 @@ export interface AuthSchemeSpec {
      * header or query parameter of that name. ValuePrefix is prepended to
      * the value ("Bearer "). Not needed to connect; read by injection.
      */
-    in?: AuthSchemeAPIKeyIn;
+    in?: AuthMethodAPIKeyIn;
     param_name?: string;
     value_prefix?: string;
     /**
      * Scheme and BearerFormat describe an http kind's Authorization header.
      */
-    scheme?: AuthSchemeHTTPScheme;
+    scheme?: AuthMethodHTTPScheme;
     bearer_format?: string;
     authorization_endpoint?: string;
     scopes?: string[];
@@ -5855,7 +6015,7 @@ export interface AuthSchemeSpec {
     callback?: string;
     /**
      * Profile names the authorization server's deviations from the specs
-     * (authprovider.AuthServerProfile: endpoints placed by app fields,
+     * (authmethod.AuthServerProfile: endpoints placed by app fields,
      * scopes on refresh, actionable errors, admin consent). Empty = none.
      */
     profile?: string;
@@ -5866,8 +6026,8 @@ export interface AuthSchemeSpec {
      * with a form POST.
      */
     revocation_endpoint?: string;
-    client_auth?: AuthSchemeClientAuth;
-    token_request?: AuthSchemeTokenRequest;
+    client_auth?: AuthMethodClientAuth;
+    token_request?: AuthMethodTokenRequest;
     /**
      * Headers go on every request to the provider (User-Agent for Reddit,
      * Notion-Version); values are templates ({{client_id}} for Twitch's
@@ -5881,8 +6041,8 @@ export interface AuthSchemeSpec {
      * not the RFC 6749 shape (Slack's nested authed_user). Empty = standard.
      */
     token_response_hook?: string;
-    refresh?: AuthSchemeRefresh;
-    revoke?: AuthSchemeRevoke;
+    refresh?: AuthMethodRefresh;
+    revoke?: AuthMethodRevoke;
     /**
      * UserInfoURL is fetched with the new access token; the response is the
      * identity document (user.*). UserInfoURLPath instead reads that URL
@@ -5892,7 +6052,7 @@ export interface AuthSchemeSpec {
      */
     userinfo_url?: string;
     userinfo_url_path?: string;
-    lookups?: AuthSchemeLookup[];
+    lookups?: AuthMethodLookup[];
     /**
      * Identifier is the connected account's stable, human-readable id
      * ("{{user.email}}", "@{{user.data.username}}"); Name its display name.
@@ -5929,14 +6089,14 @@ export interface AuthSchemeSpec {
      * AppKeys are the OAuth app's keys beyond the implied client id and
      * secret, and label overrides for those.
      */
-    app_keys?: AuthSchemeAppKey[];
+    app_keys?: AuthMethodAppKey[];
     /**
      * VarsHook names Go code that turns the app's extra keys into the
      * {var} values substituted into the URLs (Microsoft's tenant,
      * Salesforce's sandbox host).
      */
     vars_hook?: string;
-    capabilities?: AuthSchemeCapability[];
+    capabilities?: AuthMethodCapability[];
 }
 /**
  * Visibility represents the visibility level of a resource
@@ -5954,9 +6114,15 @@ export declare const VisibilityUnlisted: Visibility;
 /**
  * Permission represents a permission level for access checks.
  */
-export type Permission = "read" | "write" | "use";
+export type Permission = "read" | "write" | "interact" | "use";
 export declare const PermRead: Permission;
 export declare const PermWrite: Permission;
+/**
+ * PermInteract changes what a page's people keep in it (an artifact's
+ * shared data) without editing the page. Write covers interact, and
+ * interact covers read; public and unlisted visibility grant read only.
+ */
+export declare const PermInteract: Permission;
 /**
  * PermUse is execute intent: run an app, load a skill/knowledge into an
  * agent context, invoke an MCP tool. Distinct from read — a public
@@ -6627,8 +6793,11 @@ export interface ResponseFormat {
  * assignment.
  * Which model runs is not a setting: the app is the model. An app that
  * fronts several models (a router) declares its own `model` input.
+ * Field order is schema order: the generated pydantic model, and the input
+ * form built from its JSON schema, list fields as they are declared here.
  */
 export interface LLMSettings {
+    system_prompt: string;
     context_size: number;
     temperature?: number;
     top_p?: number;
@@ -6642,23 +6811,24 @@ export interface LLMSettings {
     max_tokens?: number;
     reasoning_effort?: string;
     reasoning_max_tokens?: number;
-    system_prompt: string;
     tools?: Tool[];
     tool_choice?: ToolChoice;
     response_format?: ResponseFormat;
 }
 /**
- * LLMInput is the input envelope for an LLM provider task: the settings plus
- * the conversation, with the current turn split out of the context.
+ * LLMInput is the input envelope for an LLM provider task: the conversation,
+ * with the current turn split out of the context, plus the settings.
+ * Field order is schema order (see LLMSettings): the turn comes first, the
+ * settings last, so an input form shows what to say before how to say it.
  */
 export interface LLMInput extends LLMSettings {
-    context: LLMContextMessage[];
-    role?: ChatMessageRole;
     text?: string;
-    reasoning?: string;
-    attachments?: FileRef[];
     images?: string[];
     files?: string[];
+    attachments?: FileRef[];
+    context: LLMContextMessage[];
+    role?: ChatMessageRole;
+    reasoning?: string;
     tool_call_id?: string;
 }
 /**
@@ -7768,6 +7938,16 @@ export interface ContextInjection {
      */
     items?: string[];
 }
+/**
+ * CompactionMeta is stored on ChatMessage for context compaction markers.
+ */
+export interface CompactionMeta {
+    compacted_up_to_order: number;
+    compacted_count: number;
+    estimated_tokens: number;
+    method?: string;
+    analysis?: string;
+}
 /**
  * ToolCallEventData is the typed payload for agent.tool_call events.
  */