@ingram-cloud/sdk 1.2.0 → 1.5.0

package/dist/zod/budgets.js

@@ -12,6 +12,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { pageOut } from "./_page.js";
 /** What a budget caps; `agent`/`smith`/`customer` budgets carry the id in
  *  `scope_id` (an agent design, a single smith, or one of your customers). */
 export const BudgetScope = z.enum(["tenant", "agent", "smith", "customer"]);
@@ -40,9 +41,7 @@ export const BudgetStatusOut = BudgetOut.extend({
     pct: z.number(),
     over: z.boolean(),
 }).meta({ id: "BudgetStatusOut" });
-export const BudgetListOut = z
-    .object({ data: z.array(BudgetOut) })
-    .meta({ id: "BudgetListOut" });
+export const BudgetListOut = pageOut(BudgetOut, "BudgetListOut");
 // ── Request bodies ──────────────────────────────────────────────────────────
 export const BudgetIn = z
     .object({

package/dist/zod/connections.js

@@ -18,6 +18,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { pageOut } from "./_page.js";
 /** OAuth token material the tenant pushes in; IC stores it encrypted and never
  *  echoes it back. Only `kind: "oauth_tokens"` is accepted. */
 export const Credential = z
@@ -41,9 +42,7 @@ export const ConnectionOut = z
     created_at: z.string().nullable(),
 })
     .meta({ id: "ConnectionOut" });
-export const ConnectionListOut = z
-    .object({ data: z.array(ConnectionOut) })
-    .meta({ id: "ConnectionListOut" });
+export const ConnectionListOut = pageOut(ConnectionOut, "ConnectionListOut");
 // ── Request bodies ──────────────────────────────────────────────────────────
 export const ConnectionIn = z
     .object({

package/dist/zod/conversations.js

@@ -17,7 +17,7 @@
  * endpoint.
  */
 import { z } from "zod";
-import { pageOut } from "./_page.js";
+import { oaiListOut } from "./_page.js";
 /** A conversation — the OpenAI Conversations object + IC extensions. */
 export const ConversationOut = z
     .object({
@@ -35,7 +35,8 @@ export const ConversationOut = z
     metadata: z.record(z.string(), z.unknown()),
 })
     .meta({ id: "ConversationOut" });
-export const ConversationListOut = pageOut(ConversationOut, "ConversationListOut");
+/** The conversation list, in OpenAI's `list` envelope (page with `?after=`). */
+export const ConversationListOut = oaiListOut(ConversationOut, "ConversationListOut");
 /** The delete acknowledgement, in OpenAI's `*.deleted` shape. */
 export const ConversationDeleted = z
     .object({
@@ -66,15 +67,7 @@ export const ConversationItem = z
 })
     .meta({ id: "ConversationItem" });
 /** A conversation's items, in OpenAI's `list` envelope (not the IC cursor page). */
-export const ConversationItemListOut = z
-    .object({
-    object: z.literal("list"),
-    data: z.array(ConversationItem),
-    first_id: z.string().nullable(),
-    last_id: z.string().nullable(),
-    has_more: z.boolean(),
-})
-    .meta({ id: "ConversationItemListOut" });
+export const ConversationItemListOut = oaiListOut(ConversationItem, "ConversationItemListOut");
 /** Create body — OpenAI accepts `metadata`; `title` is the IC extension. */
 export const ConversationCreate = z
     .object({

package/dist/zod/deployments.js

@@ -103,3 +103,35 @@ export const DeploymentPatch = z
     owner_email: z.string().nullish(),
 })
     .meta({ id: "DeploymentPatch" });
+// ── Inbound events ───────────────────────────────────────────────────────────
+/**
+ * One message as it arrived, before anything interpreted it — the immutable
+ * ingest record behind every channel-triggered run, in CloudEvents terms
+ * (`source` / `type` / `subject` / `data`).
+ *
+ * It is recorded before resolution, so an event that matched no smith is here
+ * too, with `smith_id: ""` — "the webhook fired and nothing happened" is a
+ * readable answer, not an absence. `idempotency_key` is the provider's own
+ * delivery id (`Message-Id`, `X-GitHub-Delivery`); a re-delivery of the same key
+ * records once, so this log is also the dedup ledger. `""` throughout means the
+ * source supplied nothing, never "unknown".
+ */
+export const InboundEventOut = z
+    .object({
+    id: z.string(),
+    /** The channel it arrived on: `email`, `telegram`, `slack`, `whatsapp`, … */
+    source: z.string(),
+    /** The provider's event name (`email.received`); `""` if it names none. */
+    type: z.string(),
+    /** The addressed resource — inbox address, channel, repo. */
+    subject: z.string(),
+    /** The provider's delivery id, and this log's dedup key. */
+    idempotency_key: z.string(),
+    /** The smith it woke; `""` when the sender resolved to none. */
+    smith_id: z.string(),
+    /** The provider payload as received. */
+    data: z.record(z.string(), z.unknown()),
+    created_at: z.string().nullable(),
+})
+    .meta({ id: "InboundEventOut" });
+export const InboundEventListOut = pageOut(InboundEventOut, "InboundEventListOut");

package/dist/zod/files.js

@@ -11,6 +11,7 @@
  * listed.
  */
 import { z } from "zod";
+import { oaiListOut } from "./_page.js";
 /** OpenAI's upload purposes. Vector-store source files are `assistants`. */
 export const FilePurpose = z.enum([
     "assistants",
@@ -36,15 +37,7 @@ export const FileOut = z
 })
     .meta({ id: "FileOut" });
 /** Files, in OpenAI's `list` envelope (not the IC cursor page). */
-export const FileListOut = z
-    .object({
-    object: z.literal("list"),
-    data: z.array(FileOut),
-    first_id: z.string().nullable(),
-    last_id: z.string().nullable(),
-    has_more: z.boolean(),
-})
-    .meta({ id: "FileListOut" });
+export const FileListOut = oaiListOut(FileOut, "FileListOut");
 /** The delete acknowledgement, in OpenAI's `*.deleted` shape. */
 export const FileDeleted = z
     .object({

package/dist/zod/index.js

@@ -8,9 +8,11 @@
  * when the last one lands, the generated file and the `openapi-zod-client` step
  * are deleted and this becomes the sole `schemas` source.
  */
+export * from "./_actor.js";
 export * from "./_page.js";
 export * from "./agents.js";
 export * from "./approvals.js";
+export * from "./billing.js";
 export * from "./budgets.js";
 export * from "./catalog.js";
 export * from "./connections.js";
@@ -26,6 +28,7 @@ export * from "./observability.js";
 export * from "./projects.js";
 export * from "./runs.js";
 export * from "./schedules.js";
+export * from "./skills.js";
 export * from "./slack.js";
 export * from "./smith-revisions.js";
 export * from "./smiths.js";

package/dist/zod/mcp.js

@@ -14,6 +14,7 @@
  * emit as `$ref` components rather than inlined objects.
  */
 import { z } from "zod";
+import { pageOut } from "./_page.js";
 /** One approval-policy rule: a name glob that gates matching tools behind a
  *  human approval. `require` is always `"approval"` today (the only supported
  *  value); arg-conditional (`when`) gating is rejected, not stored. */
@@ -66,26 +67,29 @@ export const McpServerOut = z
     tool_allowlist: z.array(z.string()).nullish(),
     approval_policy: z.array(ApprovalRule).optional(),
     tools: z.array(McpTool),
+    /** How many tools this registration currently holds — what a run is offered,
+     *  before the allow-list gate each tool's own `enabled` reports. Same number on
+     *  a read as on the register/refresh response that produced it. */
+    tools_discovered: z.number().int(),
     tools_refreshed_at: z.string().nullable(),
-    /** `degraded` when the edge failed discovery or its secret can't be decoded
-     *  at run time; otherwise the stored lifecycle status. */
+    /** `degraded` when the edge failed discovery, its secret can't be decoded at
+     *  run time, or its last `tools/call` failed at the transport level;
+     *  otherwise the stored lifecycle status. */
     status: z.string(),
-    /** Last discovery/runtime-load failure, or null when the edge is healthy. */
+    /** Last discovery/runtime-load failure, or null when discovery is healthy. */
     discovery_error: z.string().nullable(),
+    /** Last transport-level `tools/call` failure (network / HTTP status), or
+     *  null. Discovery can succeed while calls fail — this catches that. Cleared
+     *  by a successful call or a re-PUT. */
+    last_call_error: z.string().nullable(),
+    last_call_error_at: z.string().nullable(),
     created_at: z.string().nullable(),
 })
     .meta({ id: "McpServerOut" });
-export const McpServerListOut = z
-    .object({ data: z.array(McpServerOut) })
-    .meta({ id: "McpServerListOut" });
-/** Register/replace and refresh echo the server back plus the count of tools
- *  discovered in the just-run `tools/list`. */
-export const McpServerWriteOut = McpServerOut.extend({
-    tools_discovered: z.number().int(),
-}).meta({ id: "McpServerWriteOut" });
+export const McpServerListOut = pageOut(McpServerOut, "McpServerListOut");
 // ── Request bodies ──────────────────────────────────────────────────────────
-/** Auth block on a register/replace body. `secret` is write-only (a static
- *  bearer) — never echoed back. */
+/** Auth block on a register/replace body. `kind` is `none` | `bearer` | `oauth`;
+ *  `secret` (the shared bearer token) is write-only — never echoed back. */
 export const McpAuthIn = z
     .object({
     kind: z.string().nullish(),
@@ -95,7 +99,9 @@ export const McpAuthIn = z
 })
     .meta({ id: "McpAuthIn" });
 /** Register or replace a server: supply a raw `url` + `auth`, or a `catalog`
- *  slug (catalog defaults are stamped down, body fields override). */
+ *  slug (catalog defaults are stamped down, body fields override). PUT is a
+ *  full replace and `auth.kind` is required unless a catalog preset supplies
+ *  it — there is no implicit `none`. */
 export const McpServerIn = z
     .object({
     url: z.string().nullish(),

package/dist/zod/observability.js

@@ -23,14 +23,7 @@ import { pageOut } from "./_page.js";
 /** Span kinds emitted by the observability backend. `retrieval` covers vector-store
  *  search (the hosted `file_search` tool, and externally-pushed RAG spans). */
 export const ICSpanKindEnum = z
-    .enum([
-    "run",
-    "model_call",
-    "tool_call",
-    "memory_op",
-    "retrieval",
-    "runtime_event",
-])
+    .enum(["run", "model_call", "tool_call", "memory_op", "retrieval", "runtime_event"])
     .meta({ id: "SpanKind" });
 /** A single timed unit of work inside a trace. */
 export const SpanOut = z
@@ -61,8 +54,12 @@ export const SpanNodeOut = SpanOut.extend({
 export const TraceOut = z
     .object({
     id: z.string(),
-    smith_id: z.string(),
+    /** Null for a trace no smith owns — an external `/v1/traces:ingest` under a
+     *  tenant token attributes to none. Such a trace is tenant-scope only: a
+     *  smith-bound token cannot read it. */
+    smith_id: z.string().nullable(),
     app_id: z.string().nullable(),
+    run_id: z.string().nullable(),
     root_kind: ICSpanKindEnum,
     name: z.string(),
     status: z.string(),
@@ -81,24 +78,32 @@ export const TraceDetailOut = TraceOut.extend({
 }).meta({ id: "TraceDetailOut" });
 export const TraceListOut = pageOut(TraceOut, "TraceListOut");
 /** Aggregated usage grouped by app, smith, model, or customer. */
+/** The token/cost amounts a usage bucket reports. `tokens` is the grand total
+ *  (input + output); `input_tokens` is the input slice, and `cache_read_tokens`
+ *  / `cache_write_tokens` are sub-slices of input (reads served from the
+ *  provider's prompt cache, writes billed at the cache-write premium). The cache
+ *  hit rate is `cache_read_tokens / input_tokens`. */
+const UsageAmounts = z.object({
+    tokens: z.number(),
+    input_tokens: z.number(),
+    cache_read_tokens: z.number(),
+    cache_write_tokens: z.number(),
+    cost: z.number(),
+    run_count: z.number(),
+});
 export const UsageBreakdownOut = z
     .object({
     group_by: z.enum(["app", "smith", "model", "customer"]),
-    totals: z.object({
-        tokens: z.number(),
-        cost: z.number(),
-        run_count: z.number(),
-    }),
-    groups: z.array(z.object({
+    totals: UsageAmounts,
+    groups: z.array(z
+        .object({
         app: z.string().nullable().optional(),
         smith: z.string().nullable().optional(),
         model: z.string().nullable().optional(),
         // Customer-grouped views label unassigned usage `principal:<smith id>`.
         customer: z.string().nullable().optional(),
-        tokens: z.number(),
-        cost: z.number(),
-        run_count: z.number(),
-    })),
+    })
+        .extend(UsageAmounts.shape)),
     /** Custom billable events aggregated per meter over the same filters. */
     meters: z
         .array(z.object({
@@ -131,3 +136,18 @@ export const UsageEventListOut = z
     has_more: z.boolean(),
 })
     .meta({ id: "UsageEventListOut" });
+// ── Span ingestion (POST /v1/traces:ingest) ─────────────────────────────────
+/** The request body for span ingestion (externally-pushed spans / OTel).
+ *
+ *  Deliberately permissive: the handler normalizes rather than rejects — an
+ *  unrecognized `kind` degrades to `runtime_event`, missing ids and timestamps
+ *  are generated. Validating {@link ICSpanIn} here would 422 exactly the sloppy
+ *  exporter payloads the endpoint exists to absorb. `ICSpanIn` documents the
+ *  shape for callers; the wire stays open. */
+export const TraceIngestIn = z
+    .object({ spans: z.array(z.record(z.string(), z.unknown())).optional() })
+    .meta({ id: "TraceIngestIn" });
+/** The 202 ack for span ingestion: how many spans were written. */
+export const TraceIngestOut = z
+    .object({ accepted: z.number().int() })
+    .meta({ id: "TraceIngestOut" });

package/dist/zod/projects.js

@@ -12,6 +12,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { pageOut } from "./_page.js";
 export const ProjectOut = z
     .object({
     id: z.string(),
@@ -24,9 +25,7 @@ export const ProjectOut = z
     archived_at: z.string().nullable(),
 })
     .meta({ id: "ProjectOut" });
-export const ProjectListOut = z
-    .object({ data: z.array(ProjectOut) })
-    .meta({ id: "ProjectListOut" });
+export const ProjectListOut = pageOut(ProjectOut, "ProjectListOut");
 /**
  * The secret minted when an org mints a project (tenant-admin) token. Shape
  * matches `mintToken`'s return; the `tenant` module owns the canonical
@@ -52,7 +51,8 @@ export const ProjectIn = z
     .meta({ id: "ProjectIn" });
 export const ProjectTokenIn = z
     .object({
-    ttl_seconds: z.number().int().nullish(),
+    // Same bounds as `TokenIn.ttl_seconds` — this mints a `tenant:*` token too.
+    ttl_seconds: z.number().int().positive().max(315_360_000).nullish(),
     name: z.string().nullish(),
 })
     .meta({ id: "ProjectTokenIn" });

package/dist/zod/runs.js

@@ -20,6 +20,7 @@
  * are deliberately not modelled.
  */
 import { z } from "zod";
+import { Actor } from "./_actor.js";
 import { pageOut } from "./_page.js";
 /** One message in a run's `input`. `content` is a plain string for a text-only
  *  turn, or an array of content parts (`{type:"text"|"file"|"image", …}`) for a
@@ -28,10 +29,7 @@ import { pageOut } from "./_page.js";
 export const InputMessage = z
     .object({
     role: z.string(),
-    content: z.union([
-        z.string(),
-        z.array(z.record(z.string(), z.unknown())),
-    ]),
+    content: z.union([z.string(), z.array(z.record(z.string(), z.unknown()))]),
 })
     .meta({ id: "InputMessage" });
 /** One run's own token usage (the `usage` map on a run). Distinct from the
@@ -49,6 +47,16 @@ export const RunUsage = z
     cost: z.number().optional(),
 })
     .meta({ id: "RunUsage" });
+/** One thing that went wrong during a run without ending it — today, a tool source
+ *  the run could not reach. A run that lost its tools still answers, and the answer
+ *  is shaped like a healthy one, so this rides the run's own summary fields rather
+ *  than a nested metadata key nobody reads. */
+export const RunWarning = z
+    .object({
+    code: z.string(),
+    message: z.string(),
+})
+    .meta({ id: "RunWarning" });
 export const RunOut = z
     .object({
     id: z.string(),
@@ -75,8 +83,12 @@ export const RunOut = z
     })
         .nullable(),
     stop_reason: z.string().nullable(),
+    // Always present, `[]` on a clean run: absence must never read as "fine".
+    warnings: z.array(RunWarning),
     usage: RunUsage.nullable(),
     metadata: z.record(z.string(), z.unknown()).optional(),
+    /** Who started this run. Null on runs created before attribution shipped. */
+    actor: Actor.nullable(),
     created_at: z.string().nullable(),
     updated_at: z.string().nullable(),
 })

package/dist/zod/schedules.js

@@ -13,6 +13,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { pageOut } from "./_page.js";
 /** A schedule's stored input: messages replayed as the run input on each fire. */
 const ScheduleInput = z.array(z.record(z.string(), z.unknown()));
 export const ScheduleOut = z
@@ -25,17 +26,13 @@ export const ScheduleOut = z
     input: ScheduleInput,
     /** Thread the fired runs append to; null mints a fresh thread per fire. */
     thread_id: z.string().nullable(),
-    /** Max overlapping fired runs before new fires are skipped. */
-    max_concurrent: z.number().int(),
     enabled: z.boolean(),
     next_fire_at: z.string().nullable(),
     last_fire_at: z.string().nullable(),
     created_at: z.string().nullable(),
 })
     .meta({ id: "ScheduleOut" });
-export const ScheduleListOut = z
-    .object({ data: z.array(ScheduleOut) })
-    .meta({ id: "ScheduleListOut" });
+export const ScheduleListOut = pageOut(ScheduleOut, "ScheduleListOut");
 /** `POST .../:sid/run_now` — the fire is enqueued onto the smith's serial delivery
  *  lane (not run inline), so the response acknowledges the queued delivery rather
  *  than a completed run. Poll `/v1/events` or the smith's runs for the outcome. */
@@ -54,7 +51,6 @@ export const ScheduleIn = z
     timezone: z.string().default("UTC"),
     input: ScheduleInput.default([]),
     thread_id: z.string().nullish(),
-    max_concurrent: z.number().int().default(1),
     enabled: z.boolean().default(true),
 })
     .meta({ id: "ScheduleIn" });
@@ -65,7 +61,6 @@ export const SchedulePatch = z
     timezone: z.string().nullish(),
     input: ScheduleInput.nullish(),
     thread_id: z.string().nullish(),
-    max_concurrent: z.number().int().nullish(),
     enabled: z.boolean().nullish(),
 })
     .meta({ id: "SchedulePatch" });

package/dist/zod/skills.js

@@ -0,0 +1,73 @@
+/**
+ * Agent Skills (#175) — a folder anchored by SKILL.md, per the Agent Skills
+ * specification, stored as an immutable version and attached to an agent.
+ *
+ * A version's bytes never appear on the wire: `files` lists each path with its
+ * size and content hash, so a tenant can see exactly what they installed.
+ */
+import { z } from "zod";
+/** One file in a skill version, as the caller uploaded it. */
+export const SkillFile = z
+    .object({
+    path: z.string(),
+    size: z.number().int(),
+    sha256: z.string(),
+    media_type: z.string(),
+})
+    .meta({ id: "SkillFile" });
+/** One published agent version that froze a reference to this skill version.
+ *  A frozen reference is the only kind that blocks a delete, so this is the
+ *  list a `409 skill_in_use` would name. */
+export const SkillReference = z
+    .object({ agent_id: z.string(), version: z.number().int() })
+    .meta({ id: "SkillReference" });
+/** An immutable published version of a skill. */
+export const SkillVersion = z
+    .object({
+    skill_id: z.string(),
+    version: z.number().int(),
+    description: z.string(),
+    license: z.string().nullable(),
+    compatibility: z.unknown().nullable(),
+    metadata: z.record(z.string(), z.unknown()).nullable(),
+    references: z.array(z.string()),
+    scripts: z.array(z.string()),
+    assets: z.array(z.string()),
+    files: z.array(SkillFile),
+    /** Published agent versions holding this one frozen. Always present, `[]`
+     *  when nothing does. */
+    referenced_by: z.array(SkillReference),
+    bytes: z.number().int(),
+    created_at: z.string(),
+})
+    .meta({ id: "SkillVersion" });
+/** The skill resource. `default_version` is what an agent gets when it names none. */
+export const Skill = z
+    .object({
+    id: z.string(),
+    object: z.literal("skill"),
+    name: z.string(),
+    description: z.string(),
+    default_version: z.number().int(),
+    created_at: z.string(),
+    updated_at: z.string(),
+})
+    .meta({ id: "Skill" });
+export const SkillListOut = z
+    .object({ object: z.literal("list"), data: z.array(Skill) })
+    .meta({ id: "SkillListOut" });
+export const SkillVersionListOut = z
+    .object({ object: z.literal("list"), data: z.array(SkillVersion) })
+    .meta({ id: "SkillVersionListOut" });
+/** Move the skill's `default_version` to an existing version. */
+export const SkillUpdateIn = z
+    .object({ default_version: z.number().int().positive() })
+    .meta({ id: "SkillUpdateIn" });
+/** One skill reference in an agent's `skills` config. Omitted `version` resolves
+ *  to the skill's `default_version` and is frozen at publish. */
+export const SkillRef = z
+    .object({
+    skill_id: z.string(),
+    version: z.number().int().positive().optional(),
+})
+    .meta({ id: "SkillRef" });

package/dist/zod/smith-revisions.js

@@ -16,6 +16,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { pageOut } from "./_page.js";
 /** An immutable snapshot of a smith's effective behaviour config at one revision. */
 export const SmithRevisionOut = z
     .object({
@@ -25,17 +26,18 @@ export const SmithRevisionOut = z
         model: z.string().nullish(),
         enabled_hosted_tools: z.array(z.string()).optional(),
         vector_store_ids: z.array(z.string()).optional(),
-        auto_memory: z.boolean().optional(),
-        memory_consolidation: z.boolean().optional(),
+        mcp_servers: z.array(z.string()).nullish(),
+        // Nullish: a snapshot taken while the smith inherited a sparse agent
+        // version carries null (= the default) for these.
+        auto_memory: z.boolean().nullish(),
+        memory_consolidation: z.boolean().nullish(),
     }),
     created_by: z.string().nullish(),
     note: z.string().nullish(),
     created_at: z.string().nullish(),
 })
     .meta({ id: "SmithRevisionOut" });
-export const RevisionListOut = z
-    .object({ data: z.array(SmithRevisionOut) })
-    .meta({ id: "RevisionListOut" });
+export const RevisionListOut = pageOut(SmithRevisionOut, "RevisionListOut");
 // ── Request bodies ──────────────────────────────────────────────────────────
 export const RestoreIn = z
     .object({ note: z.string().nullish() })

package/dist/zod/smiths.js

@@ -17,6 +17,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { SkillRef } from "./skills.js";
 // ── Smith response ───────────────────────────────────────────────────────────
 export const SmithOut = z
     .object({
@@ -36,6 +37,9 @@ export const SmithOut = z
     rendered_instructions: z.string().nullish(),
     enabled_hosted_tools: z.array(z.string()).optional(),
     vector_store_ids: z.array(z.string()).optional(),
+    /** Registered MCP servers this smith's runs load, by name. Null = all. */
+    mcp_servers: z.array(z.string()).nullish(),
+    skills: z.array(SkillRef).optional(),
     auto_memory: z.boolean().optional(),
     memory_consolidation: z.boolean().optional(),
     /** How the config resolved: by reference, with overrides, or embedded. */
@@ -55,6 +59,8 @@ export const SmithOut = z
         instructions: z.string().nullable(),
         enabled_hosted_tools: z.array(z.string()),
         vector_store_ids: z.array(z.string()),
+        mcp_servers: z.array(z.string()).nullable(),
+        skills: z.array(SkillRef),
         auto_memory: z.boolean().nullable(),
         memory_consolidation: z.boolean().nullable(),
     })
@@ -85,6 +91,9 @@ export const SmithCreate = z
     instructions: z.string().nullish(),
     enabled_hosted_tools: z.array(z.string()).nullish(),
     vector_store_ids: z.array(z.string()).nullish(),
+    /** Scope this smith's runs to these registered MCP servers (by name). */
+    mcp_servers: z.array(z.string()).nullish(),
+    skills: z.array(SkillRef).nullish(),
     auto_memory: z.boolean().nullish(),
     memory_consolidation: z.boolean().nullish(),
 })
@@ -102,6 +111,11 @@ export const SmithPatch = z
     instructions: z.string().nullish(),
     enabled_hosted_tools: z.array(z.string()).nullish(),
     vector_store_ids: z.array(z.string()).nullish(),
+    /** Scope this smith's runs to these registered MCP servers (by name).
+     *  Null clears the per-smith override (re-inherit the agent's value). */
+    mcp_servers: z.array(z.string()).nullish(),
+    /** Null clears the per-smith override (re-inherit the agent's value). */
+    skills: z.array(SkillRef).nullish(),
     auto_memory: z.boolean().nullish(),
     memory_consolidation: z.boolean().nullish(),
 })

package/dist/zod/tenant.js

@@ -12,6 +12,7 @@
  * `#/components/schemas/<id>` rather than inlining it.
  */
 import { z } from "zod";
+import { Actor } from "./_actor.js";
 import { pageOut } from "./_page.js";
 // ── Events (poll mirror of the webhook firehose) ─────────────────────────────
 /** One event in the `/v1/events` feed — the `{v:1}` envelope (sans `tenant_id`,
@@ -24,6 +25,8 @@ export const EventOut = z
     type: z.string(),
     smith_id: z.string().nullable(),
     data: z.record(z.string(), z.unknown()),
+    /** Who acted. Null on events recorded before attribution shipped. */
+    actor: Actor.nullable(),
     created_at: z.string().nullable(),
 })
     .meta({ id: "EventOut" });
@@ -50,9 +53,7 @@ export const WebhookCreateOut = z
 })
     .meta({ id: "WebhookCreateOut" });
 /** The patch/delete-adjacent ack shape (just the id). */
-export const WebhookIdOut = z
-    .object({ id: z.string() })
-    .meta({ id: "WebhookIdOut" });
+export const WebhookIdOut = z.object({ id: z.string() }).meta({ id: "WebhookIdOut" });
 export const WebhookIn = z
     .object({
     url: z.string(),
@@ -67,6 +68,23 @@ export const WebhookPatch = z
     active: z.boolean().nullish(),
 })
     .meta({ id: "WebhookPatch" });
+/** Rotate a webhook's signing secret. `grace_seconds` keeps the outgoing secret
+ *  valid for an overlap window (default 24h, 0 = cut over immediately, max 7d);
+ *  during it every delivery is signed with both the new and old secret. */
+export const WebhookRotateIn = z
+    .object({
+    grace_seconds: z.number().int().min(0).max(604800).default(86400),
+})
+    .meta({ id: "WebhookRotateIn" });
+/** The rotate response — the new signing `secret` is returned EXACTLY ONCE, here.
+ *  `previous_secret_expires_at` is when the old secret stops being accepted. */
+export const WebhookRotateOut = z
+    .object({
+    id: z.string(),
+    secret: z.string(),
+    previous_secret_expires_at: z.string().nullable(),
+})
+    .meta({ id: "WebhookRotateOut" });
 /** One persisted delivery attempt record for a webhook — the audit trail behind
  *  durable, retried delivery. `status` is `pending` | `succeeded` | `dead`. */
 export const WebhookDeliveryOut = z
@@ -125,7 +143,9 @@ export const TokenIn = z
     scope: z.string().default("smith"),
     smith_id: z.string().nullish(),
     permissions: z.array(z.string()).nullish(),
-    ttl_seconds: z.number().int().nullish(),
+    // Positive and bounded: `0` used to read as "no expiry" and mint a permanent
+    // admin token, and a ttl past year 275760 overflows the `Date` we serialize.
+    ttl_seconds: z.number().int().positive().max(315_360_000).nullish(),
     name: z.string().nullish(),
 })
     .meta({ id: "TokenIn" });
@@ -270,3 +290,20 @@ export const HostedToolOut = z
 export const HostedToolsListOut = z
     .object({ data: z.array(HostedToolOut) })
     .meta({ id: "HostedToolsListOut" });
+// ── Sandbox secrets (env a tenant's sandboxes carry) ─────────────────────────
+/** One secret by name. The value is NEVER echoed — only that it is set. */
+export const SandboxSecretOut = z
+    .object({
+    name: z.string(),
+    updated_at: z.string().nullable(),
+})
+    .meta({ id: "SandboxSecretOut" });
+export const SandboxSecretListOut = z
+    .object({ data: z.array(SandboxSecretOut) })
+    .meta({ id: "SandboxSecretListOut" });
+export const SandboxSecretIn = z
+    .object({ value: z.string() })
+    .meta({ id: "SandboxSecretIn" });
+export const SandboxSecretConfiguredOut = z
+    .object({ name: z.string(), configured: z.boolean() })
+    .meta({ id: "SandboxSecretConfiguredOut" });