@kindgi/client 0.1.3 → 0.1.4-rc.0

package/dist/index.d.cts

@@ -218,8 +218,54 @@ export interface Page<T> {
  * The brand prevents mixing free-form strings with validated semver values.
  */
 export type Semver = Brand<string, "Semver">;
+/**
+ * Why the runtime registered a version of an agent or flow under another
+ * number than its definition names. Versions never change, so a deploy
+ * whose definition's version is registered already with other content
+ * registers the next free version in its line instead:
+ *
+ * - `pins-changed`: the definition's version is registered with other
+ *   pins (a block it uses has a new version);
+ * - `unpinned`: the definition's version was published before pins
+ *   existed, so it has none;
+ * - `version-taken`: the definition's version holds another definition;
+ * - `edited`: derived from an existing version with some data-block pins
+ *   swapped (an expert's edit), not from a definition at all.
+ */
+export type VersionDerivationReason = "pins-changed" | "unpinned" | "version-taken" | "edited";
+/** The version a version was registered in place of (or derived from), and why. */
+export interface VersionDerivation {
+	/** The version the definition names, or the one an edit derived from. */
+	readonly version: string;
+	readonly reason: VersionDerivationReason;
+	/** For an edit: a short label for the version (e.g. "warmer tone"). */
+	readonly label?: string;
+	/** For an edit: who made it (`user:<id>`, or the token for a key). */
+	readonly by?: string;
+}
 /** Terminal states are `completed`, `failed`, `cancelled`. */
 export type RunStatus = "pending" | "running" | "suspended" | "completed" | "failed" | "cancelled";
+/**
+ * The exact version of each block a flow version runs: its lockfile.
+ *
+ * A flow names its tools by id (a tool node's `ref`, a fanout branch's
+ * `handler`) and its agents by id, with an exact `config.version` or
+ * none. When a version of the flow is published, the runtime pins each
+ * tool, and each agent that names no version, to its latest version
+ * then, and every run of that flow version uses those versions. So a
+ * new tool or agent version reaches the flow only through a new flow
+ * version.
+ *
+ * Set by the runtime at publish, never authored. A flow version
+ * published before pins existed has none and binds the latest versions
+ * per run.
+ */
+export interface FlowPins {
+	/** Tool id → the exact version this flow version runs. */
+	readonly tools: Readonly<Record<string, string>>;
+	/** Agent id → the exact version its agent nodes that name none run. */
+	readonly agents: Readonly<Record<string, string>>;
+}
 /**
  * A path into the run's addressable state. Dot-separated segments, always
  * starting with a recognized root. Path syntax is deliberately narrow — no
@@ -928,6 +974,20 @@ export interface Flow {
 	 * `$end` edge (the lowest-id taken one when several fire).
 	 */
 	readonly output?: FlowOutputSpec;
+	/**
+	 * The exact tool and agent versions this flow version runs, resolved by
+	 * the runtime when the version was published (see `FlowPins`). Never
+	 * authored: `loadFlow` refuses it. Absent on a flow version published
+	 * before pins existed; it binds the latest versions per run.
+	 */
+	readonly pins?: FlowPins;
+	/** `flowPinsDigest(pins)`, recorded when the version was published. */
+	readonly pinsDigest?: string;
+	/**
+	 * Set by the runtime on a version a deploy registered under another
+	 * number than the definition's (see `VersionDerivation`). Never authored.
+	 */
+	readonly derivedFrom?: VersionDerivation;
 }
 /**
  * A flow's declared output: what the run returns, built from the
@@ -1172,6 +1232,29 @@ export interface ToolHitlRule {
 	readonly mode: ToolHitlMode;
 	readonly requiredRole?: ReviewerRole;
 }
+/**
+ * The exact version of each block an agent version runs: its lockfile.
+ *
+ * An agent names its tools by range (`{ id: 'acme.lookup', version:
+ * '^1.0.0' }`), like `package.json`. When a version of the agent is
+ * published, the runtime resolves each range once, and every run of that
+ * version uses the versions recorded here. So a new tool version reaches
+ * an agent only through a new agent version, and two runs of one agent
+ * version always run the same blocks.
+ *
+ * Set by the runtime at publish, never authored. A version published
+ * before pins existed has none and resolves its ranges per run.
+ */
+export interface AgentPins {
+	/** Tool id → the exact version this agent version runs. */
+	readonly tools: Readonly<Record<string, string>>;
+	/** Prompt block id → exact version. Empty until the agent references prompt blocks. */
+	readonly prompts: Readonly<Record<string, string>>;
+	/** Settings block id → exact version. Empty until the agent references settings blocks. */
+	readonly settings: Readonly<Record<string, string>>;
+}
+/** The version an agent version was registered in place of, and why. */
+export type AgentDerivation = VersionDerivation;
 type AgentId$1 = Brand<string, "AgentId">;
 /**
  * A single message inside a conversation. Persisted as a `Fact` in
@@ -1269,6 +1352,20 @@ export interface ToolRef {
 	readonly id: string;
 	readonly version: string;
 }
+/**
+ * A prompt block an agent's instructions come from: its id and a semver
+ * range, resolved like a tool's (`pickVersion`) and pinned when the
+ * agent version is published.
+ */
+export interface PromptRef {
+	readonly prompt: string;
+	readonly version: string;
+}
+/** A settings block an agent reads: its id and a semver range, pinned at publish. */
+export interface BlockRef {
+	readonly id: string;
+	readonly version: string;
+}
 /**
  * Per-agent behavior for multi-turn conversations. The agent chooses:
  *   - How many prior messages to load (`historyLimit`; unset = all).
@@ -1413,8 +1510,13 @@ export interface Agent {
 	 * unresolved reference fails the turn at invoke time
 	 * (`model-invocation-failed` whose `cause` is the `missing-parameter`
 	 * render error), never a silent empty string.
+	 *
+	 * Or a prompt block, by range (`{ prompt: 'acme.intake-prompt',
+	 * version: '^1.0.0' }`): its template renders here instead, with the
+	 * parameters it declares, and the version that runs is pinned when the
+	 * agent version is published (`pins.prompts`).
 	 */
-	readonly instructions: string;
+	readonly instructions: string | PromptRef;
 	/**
 	 * Typed parameters the caller supplies at invoke time. The UI reads
 	 * this to build a "configure agent" form; the runtime validates each
@@ -1526,6 +1628,35 @@ export interface Agent {
 	 * A tenant's `tool-errors` policy can lower it. See `ToolErrorsSpec`.
 	 */
 	readonly toolErrors?: ToolErrorsSpec;
+	/**
+	 * The exact block versions this agent version runs, resolved by the
+	 * runtime when the version was published (see `AgentPins`). Never
+	 * authored: `defineAgent` doesn't take it. Absent on an agent defined
+	 * in code and on a version published before pins existed; its tool
+	 * ranges then resolve per run.
+	 */
+	readonly pins?: AgentPins;
+	/**
+	 * Settings blocks the agent reads, by range. Each block's values reach
+	 * its tools as `ToolContext.settings[<block id>]` and its templates as
+	 * `settings.<block id>.<key>`; the versions are pinned at publish
+	 * (`pins.settings`).
+	 */
+	readonly settings?: readonly BlockRef[];
+	/**
+	 * A settings block of model settings (`MODEL_SETTINGS_SCHEMA`:
+	 * `temperature`, `maxOutputTokens`) the turn's model calls use. Pinned
+	 * at publish with the other settings.
+	 */
+	readonly modelSettings?: BlockRef;
+	/** `pinsDigest(pins)`, recorded when the version was published. */
+	readonly pinsDigest?: string;
+	/**
+	 * Set by the runtime on a version it registered under another number
+	 * than the definition's, when a deploy couldn't register that number
+	 * as it was (see `AgentDerivation`). Never authored.
+	 */
+	readonly derivedFrom?: AgentDerivation;
 }
 /** A retrieved fact + the retrieval intent that pulled it. */
 export interface RetrievedFact {
@@ -1616,8 +1747,16 @@ export interface DefineAgentSpec {
 	 * The system prompt. Sent to the model with every turn as the
 	 * baseline instructions. Load-bearing — this is where you shape
 	 * the agent's behavior (persona, output format, tool-use policy).
+	 *
+	 * Or a prompt block by range (`{ prompt: 'acme.intake-prompt',
+	 * version: '^1.0.0' }`), whose template and parameters are used
+	 * instead; then `parameters` stays unset (the block declares them).
 	 */
-	readonly instructions: string;
+	readonly instructions: string | PromptRef;
+	/** Settings blocks the agent reads, by range (see `Agent.settings`). */
+	readonly settings?: readonly BlockRef[];
+	/** A model-settings block, by range (see `Agent.modelSettings`). */
+	readonly modelSettings?: BlockRef;
 	/**
 	 * Required capabilities the agent needs from a `ModelProvider`.
 	 * Typically one entry: `[{ needs: [{ feature: 'tool-use' }] }]`
@@ -1812,6 +1951,11 @@ export interface ToolCompletedEvent {
 	readonly invocationId: string;
 	readonly output: unknown;
 	readonly durationMs: number;
+	/**
+	 * In a replay turn: whether the tool ran (`live`), the past run's result
+	 * was used (`recorded`), or the call was refused (`refused`).
+	 */
+	readonly replay?: "live" | "recorded" | "refused";
 }
 export interface ToolFailedEvent {
 	readonly kind: "tool.failed";
@@ -3772,6 +3916,130 @@ export interface ClientOptions {
 	/** Overridable fetch impl for testing. Defaults to global `fetch`. */
 	readonly fetch?: typeof fetch;
 }
+/** The verdict of a judgment. */
+export type Verdict = "yes" | "no";
+/**
+ * Where a judge class applies: the whole tenant, one project, or one
+ * agent in a project. Matches `@kindgi/api/openapi.json#JudgeClassScope`.
+ */
+export type JudgeClassScope = {
+	readonly kind: "tenant";
+} | {
+	readonly kind: "project";
+	readonly projectId: string;
+} | {
+	readonly kind: "agent";
+	readonly projectId: string;
+	readonly agentId: string;
+};
+/** Matches `@kindgi/api/openapi.json#JudgeClass`. */
+export interface JudgeClass {
+	readonly id: string;
+	readonly tenantId: string;
+	readonly scope: JudgeClassScope;
+	/** The deployment's own word for the class: "expert", "user", "arbitrator". */
+	readonly name: string;
+	/** How much a judgment of this class counts, relative to the others (≥ 0). */
+	readonly weight: number;
+	readonly description?: string;
+	readonly createdAt: Timestamp;
+	readonly updatedAt: Timestamp;
+	/** Set when the class was retired. */
+	readonly unregisteredAt?: Timestamp;
+}
+/** Input for `POST /v1/judge-classes` per `#CreateJudgeClassBody`. */
+export interface CreateJudgeClassInput {
+	readonly scope: JudgeClassScope;
+	readonly name: string;
+	readonly weight: number;
+	readonly description?: string;
+}
+/** Input for `PATCH /v1/judge-classes/{judgeClassId}` per `#UpdateJudgeClassBody`. */
+export interface UpdateJudgeClassInput {
+	readonly weight?: number;
+	readonly description?: string;
+}
+/** What a judged run ran: an agent at a version, or a flow at a version. */
+export interface JudgedSubject {
+	readonly kind: "agent" | "flow";
+	readonly id: string;
+	readonly version: string;
+}
+/** The judged item of a run's output. */
+export interface JudgedItem {
+	/** Your stable id for the item, e.g. a matched case's id. */
+	readonly key: string;
+	/** Where the item is in the run's output, as a JSON Pointer (RFC 6901), e.g. `/matches/2`. */
+	readonly pointer?: string;
+	/** The item's position in a ranked list (0 = first). */
+	readonly rank?: number;
+}
+/** Who asserted a judgment: the authenticated caller, never a typed name. */
+export interface JudgmentAssertedBy {
+	readonly kind: "user" | "service";
+	readonly id: string;
+}
+/** Matches `@kindgi/api/openapi.json#Judgment`. */
+export interface Judgment {
+	readonly id: string;
+	readonly tenantId: string;
+	readonly projectId: string;
+	readonly runId: string;
+	readonly subject: JudgedSubject;
+	readonly item: JudgedItem;
+	readonly verdict: Verdict;
+	readonly reason?: string;
+	/** Absent when the judgment is unclassified (it counts with weight 1). */
+	readonly judgeClassId?: string;
+	readonly assertedBy: JudgmentAssertedBy;
+	/** An app's opaque id for its end user who judged, when it judged on their behalf. */
+	readonly participantId?: string;
+	readonly createdAt: Timestamp;
+	/** Set when the judgment was removed or superseded. */
+	readonly unregisteredAt?: Timestamp;
+	/** The judgment that replaced this one. */
+	readonly supersededBy?: string;
+}
+/**
+ * What a judged agent turn read besides its input, captured when it was
+ * first judged: the conversation before it and what its retrievals returned.
+ */
+export interface JudgedRunContext {
+	/** The conversation's messages before the turn, oldest first (at most the last 200). */
+	readonly history?: readonly unknown[];
+	/** Whether older messages were left out of `history`. */
+	readonly historyTruncated?: boolean;
+	/** What the turn's retrievals returned. */
+	readonly retrieved?: unknown;
+}
+/** The stored copy of a judged run's input and output. */
+export interface JudgedRunCopy {
+	readonly runId: string;
+	readonly subject: JudgedSubject;
+	readonly input: unknown;
+	/** Absent for runs judged before context was captured, and for flow runs. */
+	readonly context?: JudgedRunContext;
+	readonly output: unknown;
+	readonly capturedAt: Timestamp;
+}
+/** Matches `@kindgi/api/openapi.json#JudgmentWithCopies`. */
+export interface JudgmentWithCopies extends Judgment {
+	/** The run's input and output as they were when it was first judged. */
+	readonly run: JudgedRunCopy;
+	/** The judged item's value, when the judgment pointed at it. */
+	readonly itemValue?: unknown;
+}
+/** Input for `POST /v1/judgments` per `#CreateJudgmentBody`. */
+export interface CreateJudgmentInput {
+	readonly runId: string;
+	readonly item: JudgedItem;
+	readonly verdict: Verdict;
+	readonly reason?: string;
+	/** Optional. When given it must exist and apply to the run. */
+	readonly judgeClassId?: string;
+	/** Your opaque id for the end user who judged, when judging on their behalf. */
+	readonly participantId?: string;
+}
 /** Signature the resource clients call into. */
 export interface Transport {
 	/** Base URL, no trailing slash. */
@@ -4001,6 +4269,14 @@ declare namespace Schemas {
 		 */
 		parentNodeId?: string;
 		agent?: RunAgent;
+		/**
+		 * Set on a replay run (an eval run re-running a past run): the run it replays.
+		 */
+		replayOf?: string;
+		/**
+		 * Set on a replay run: the eval run that started it.
+		 */
+		evalRunId?: string;
 		/**
 		 * Only in the response to `POST /v1/runs`, when the deployment issues public run tokens: a read-only token for this run (and its descendants) to hand to a browser, for `GET /v1/runs/{runId}/progress` and its stream.
 		 */
@@ -4110,6 +4386,14 @@ declare namespace Schemas {
 			 */
 			parentNodeId?: string;
 			agent?: RunAgent;
+			/**
+			 * Set on a replay run (an eval run re-running a past run): the run it replays.
+			 */
+			replayOf?: string;
+			/**
+			 * Set on a replay run: the eval run that started it.
+			 */
+			evalRunId?: string;
 			/**
 			 * Only in the response to `POST /v1/runs`, when the deployment issues public run tokens: a read-only token for this run (and its descendants) to hand to a browser, for `GET /v1/runs/{runId}/progress` and its stream.
 			 */
@@ -4539,156 +4823,630 @@ declare namespace Schemas {
 		nextCursor?: string;
 		hasMore: boolean;
 	};
-	export type PromptParameter = {
+	/**
+	 * Where a judge class applies: the whole tenant, one project, or one agent in a project.
+	 */
+	export type JudgeClassScope = {
+		kind: "tenant";
+	} | {
+		kind: "project";
+		projectId: string;
+	} | {
+		kind: "agent";
+		projectId: string;
+		agentId: string;
+	};
+	export type JudgeClass = {
+		id: string;
+		tenantId: string;
+		scope: JudgeClassScope;
+		/**
+		 * The deployment's own word for the class: "expert", "user", "arbitrator".
+		 */
 		name: string;
+		/**
+		 * How much a judgment of this class counts, relative to the others.
+		 */
+		weight: number;
 		description?: string;
-		type: "string" | "number" | "boolean" | "date";
-		required?: boolean;
+		createdAt: string;
+		updatedAt: string;
 		/**
-		 * Default value used when the caller omits this parameter.
+		 * Set when the class was retired.
 		 */
-		default?: unknown;
+		unregisteredAt?: string;
 	};
-	export type RetrievalIntent = {
-		types: Array<string>;
-		scope: "same-conversation" | "same-project" | "tenant";
-		limit?: number;
-		mode?: "keyword" | "semantic" | "both";
+	export type JudgeClassCollectionPage = {
+		data: Array<JudgeClass>;
+		/**
+		 * Opaque cursor. Treat as opaque on the client.
+		 */
+		nextCursor?: string;
+		hasMore: boolean;
 	};
-	export type ConversationPolicy = Partial<{
-		historyLimit: number;
-		autoCloseAfterInactiveSeconds: number;
-		hitlAfterTurns: number;
-	}>;
-	export type TurnBudget = Partial<{
-		maxSteps: number;
-		maxCostUsd: number;
-		maxWallMs: number;
+	export type CreateJudgeClassBody = {
+		scope: JudgeClassScope;
+		name: string;
+		weight: number;
+		description?: string;
+	};
+	export type UpdateJudgeClassBody = Partial<{
+		weight: number;
+		description: string;
 	}>;
+	export type UnregisterJudgeClassResult = {
+		judgeClassId: string;
+		unregistered: true;
+	};
 	/**
-	 * Capability declaration — see `@kindgi/capabilities`. Additional properties are permitted so new capability kinds do not require a wire change.
-	 */
-	export type Capability = Record<string, unknown>;
-	/**
-	 * Typed tool reference. `version` is a semver **range** (npm-style: `1.2.3` exact pin, `^1.2.3` compatible-updates, `~1.2.3` patch-updates-only, `>=1.0.0 <2.0.0` explicit range). Dispatch resolves the range to a concrete active version via `semver.maxSatisfying` at run start. No implicit "latest" — every tool ref names both id and range.
+	 * What a judged run ran: an agent at a version, or a flow at a version.
 	 */
-	export type ToolRef = {
+	export type JudgedSubject = {
+		kind: "agent" | "flow";
 		id: string;
 		version: string;
 	};
-	export type AgentOutputSpec = {
+	/**
+	 * The judged item of a run's output.
+	 */
+	export type JudgedItem = {
 		/**
-		 * JSON Schema (draft 2020-12) the final answer must match.
+		 * The caller's stable id for the item.
 		 */
-		schema: Record<string, unknown>;
+		key: string;
 		/**
-		 * A name for the output, shown to the model and in errors. Default `output`.
+		 * Where the item is in the run's output, as a JSON Pointer (RFC 6901), e.g. `/matches/2`. `""` is the whole output.
 		 */
-		name?: string;
+		pointer?: string;
 		/**
-		 * How many times the model is asked to repair an invalid answer. Default 1.
+		 * The item's position in a ranked list (0 = first).
 		 */
-		maxRepairs?: number;
+		rank?: number;
 	};
-	export type ToolErrorsSpec = Partial<{
-		/**
-		 * Failed calls sent back to the model per turn. Default 1.
-		 */
-		maxRetries: number;
+	/**
+	 * Who asserted a judgment: the authenticated caller, never a typed name.
+	 */
+	export type JudgmentAssertedBy = {
+		kind: "user" | "service";
 		/**
-		 * Which failures are sent back: arguments that don't fit the input schema (`invalid-arguments`), a tool the agent doesn't have (`unknown-tool`), a tool that ran and failed (`tool-error`). Default `invalid-arguments`, `unknown-tool`.
+		 * A user id, or for a service token its token or session id.
 		 */
-		retryOn: Array<"invalid-arguments" | "unknown-tool" | "tool-error">;
-	}>;
-	export type Agent = {
+		id: string;
+	};
+	export type Judgment = {
+		id: string;
+		tenantId: string;
+		projectId: string;
+		runId: string;
+		subject: JudgedSubject;
+		item: JudgedItem;
+		verdict: "yes" | "no";
+		reason?: string;
 		/**
-		 * AgentId — dotted namespace (e.g. `acme.drafting`).
+		 * The judge class the judgment is recorded under. Absent when unclassified (counts with weight 1).
 		 */
-		id: string;
+		judgeClassId?: string;
+		assertedBy: JudgmentAssertedBy;
 		/**
-		 * Semver.
+		 * The app's opaque id for its end user who judged, when an app judged on their behalf.
 		 */
-		version: string;
-		name: string;
-		description?: string;
-		instructions: string;
-		parameters?: Array<PromptParameter>;
-		capabilities: Array<Capability>;
-		tools: Array<ToolRef>;
-		retrieval: Array<RetrievalIntent>;
-		guardrails: Array<string>;
+		participantId?: string;
+		createdAt: string;
 		/**
-		 * Soft hint — the router prefers this provider by id (e.g. `anthropic`) when at least one of its models satisfies `capabilities.needs` + tenant policy. Combine with `preferredModel` to pin the exact (provider, model) tuple. Falls back to capability-based ranking when the pinned provider is unregistered or filtered out.
+		 * Set when the judgment was removed or superseded.
 		 */
-		preferredProvider?: string;
+		unregisteredAt?: string;
 		/**
-		 * Soft hint at the model level (`ModelInfo.name`, e.g. `claude-sonnet-4-6`). Combined with `preferredProvider`: both set → promote the exact tuple; only `preferredModel` → promote any provider exposing that model; only `preferredProvider` → promote every model of that provider.
+		 * The judgment that replaced this one.
 		 */
-		preferredModel?: string;
-		conversationPolicy?: ConversationPolicy;
-		budget?: TurnBudget;
-		tags?: Array<string>;
-		output?: AgentOutputSpec;
-		toolErrors?: ToolErrorsSpec;
+		supersededBy?: string;
 	};
 	/**
-	 * Full `defineAgent` spec. Validated server-side via `@kindgi/agents.defineAgent` — validation failures return `400 validation-failed` with the issue list under `details.issues`.
+	 * What a judged run needs besides its input to be replayed, captured when it was first judged. For an agent turn: the conversation before it, what its retrievals returned, and the decision at its session approval gate. For a flow run: its tool calls with their results.
 	 */
-	export type PublishAgentBody = {
-		id: string;
-		version: string;
-		name: string;
-		description?: string;
+	export type JudgedRunContext = Partial<{
 		/**
-		 * Project this belongs to (its content scope). Required: missing, or not a project in the caller's tenant → `400 bad-input`.
+		 * The conversation's messages before the turn, oldest first (at most the last 200).
 		 */
-		projectId: string;
-		instructions: string;
-		parameters?: Array<PromptParameter>;
-		capabilities: Array<Capability>;
-		tools: Array<ToolRef>;
-		retrieval: Array<RetrievalIntent>;
-		guardrails: Array<string>;
+		history: Array<unknown>;
 		/**
-		 * Soft hint — the router prefers this provider by id (e.g. `anthropic`) when at least one of its models satisfies `capabilities.needs` + tenant policy. Combine with `preferredModel` to pin the exact (provider, model) tuple.
+		 * Whether older messages were left out of `history`.
 		 */
-		preferredProvider?: string;
+		historyTruncated: boolean;
 		/**
-		 * Soft hint at the model level (`ModelInfo.name`). Combined with `preferredProvider` to pin an exact tuple; alone to select a model across every provider that exposes it.
+		 * What the turn's retrievals returned.
 		 */
-		preferredModel?: string;
-		conversationPolicy?: ConversationPolicy;
-		budget?: TurnBudget;
-		tags?: Array<string>;
-		output?: AgentOutputSpec;
-		toolErrors?: ToolErrorsSpec;
-	};
-	export type PublishAgentResult = {
-		agentId: string;
-		version: string;
-	};
-	export type UnregisterAgentResult = {
-		agentId: string;
-		version: string;
-		unregistered: true;
+		retrieved: unknown;
+		/**
+		 * The reviewer's decision at the turn's session approval gate, when the turn waited on one. A replay of the turn follows it.
+		 */
+		sessionApproval: {
+			approved: boolean;
+			/**
+			 * The reviewer's reason for a rejection.
+			 */
+			rationale?: string;
+		};
+		/**
+		 * For a flow run: what it did, kept at its first judgment so it can be replayed. Every tool call it made with its result (at its tool nodes, in its agent steps' turns and in its sub-flows), at most 500, and its agent steps.
+		 */
+		flow: {
+			calls: Array<{
+				/**
+				 * The run that made it: the flow run, a sub-flow's, or an agent step's turn.
+				 */
+				runId: string;
+				/**
+				 * The tool node that made it, or the agent step whose turn did.
+				 */
+				nodeId?: string;
+				/**
+				 * The loop iteration, in a loop body.
+				 */
+				scope?: string;
+				toolId: string;
+				arguments?: unknown;
+				result?: unknown;
+			}>;
+			steps: Array<{
+				runId: string;
+				nodeId?: string;
+				scope?: string;
+				agentId: string;
+				agentVersion: string;
+				/**
+				 * What the step's turn retrieved.
+				 */
+				retrieved?: unknown;
+			}>;
+			/**
+			 * More calls were made than were kept.
+			 */
+			truncated?: boolean;
+		};
+	}>;
+	/**
+	 * The stored copy of a judged run's input and output, taken when it was first judged.
+	 */
+	export type JudgedRunCopy = {
+		runId: string;
+		subject: JudgedSubject;
+		input: unknown;
+		context?: JudgedRunContext;
+		output: unknown;
+		capturedAt: string;
 	};
-	export type ReinstateAgentVersionResult = {
-		agentId: string;
-		version: string;
+	/**
+	 * A judgment with the stored copies of what was judged.
+	 */
+	export type JudgmentWithCopies = Judgment & {
+		run: JudgedRunCopy;
 		/**
-		 * `true` when this call un-tombstoned the version; `false` when it was already active (idempotent no-op).
+		 * The judged item's value, when the judgment pointed at it.
 		 */
-		wasTombstoned: boolean;
+		itemValue?: unknown;
 	};
-	export type AgentCollectionPage = {
-		data: Array<Agent>;
+	export type JudgmentCollectionPage = {
+		data: Array<Judgment>;
 		/**
-		 * Opaque cursor for the next page. Absent when `hasMore: false`.
+		 * Opaque cursor. Treat as opaque on the client.
 		 */
 		nextCursor?: string;
 		hasMore: boolean;
 	};
-	export type FlowNode = {
+	export type CreateJudgmentBody = {
+		runId: string;
+		item: JudgedItem;
+		verdict: "yes" | "no";
+		reason?: string;
+		/**
+		 * Optional. When given it must exist and apply to the run.
+		 */
+		judgeClassId?: string;
+		/**
+		 * An app's opaque id for its end user, when judging on their behalf.
+		 */
+		participantId?: string;
+	};
+	export type UnregisterJudgmentResult = {
+		judgmentId: string;
+		unregistered: true;
+	};
+	/**
+	 * The judgments of one item of a case's output, summed up.
+	 */
+	export type JudgedItemSummary = {
+		key: string;
+		pointer?: string;
+		rank?: number;
+		/**
+		 * How many judgments said yes.
+		 */
+		yes: number;
+		/**
+		 * How many judgments said no.
+		 */
+		no: number;
+		/**
+		 * The weight behind "yes" (an unclassified judgment counts 1).
+		 */
+		yesWeight: number;
+		/**
+		 * The weight behind all judgments of the item.
+		 */
+		totalWeight: number;
+		/**
+		 * The reasons given, newest first.
+		 */
+		reasons: Array<{
+			verdict: "yes" | "no";
+			reason: string;
+		}>;
+	};
+	/**
+	 * One case of a `judged` eval suite: a copy of a judged run with its items' judgments summed up.
+	 */
+	export type JudgedEvalCase = {
+		/**
+		 * The judged run's id.
+		 */
+		caseId: string;
+		subject: JudgedSubject;
+		input: unknown;
+		context?: JudgedRunContext;
+		output: unknown;
+		items: Array<JudgedItemSummary>;
+	};
+	export type JudgedEvalCaseCollectionPage = {
+		data: Array<JudgedEvalCase>;
+		/**
+		 * Opaque cursor. Treat as opaque on the client.
+		 */
+		nextCursor?: string;
+		hasMore: boolean;
+	};
+	/**
+	 * Name the agent (`agentId`) or the flow (`flowId`) whose judged runs to use.
+	 */
+	export type BuildJudgedSuiteBody = {
+		/**
+		 * Semver version to publish, e.g. `1.0.0`.
+		 */
+		version: string;
+		projectId: string;
+		agentId?: string;
+		/**
+		 * Needs `agentId`.
+		 */
+		agentVersion?: string;
+		flowId?: string;
+		/**
+		 * Runs first judged at or after this time.
+		 */
+		since?: string;
+		/**
+		 * Runs first judged before this time.
+		 */
+		until?: string;
+		/**
+		 * Count only judgments recorded under these judge classes.
+		 */
+		judgeClassIds?: Array<string>;
+		/**
+		 * Leave out runs with fewer counted judgments. Default 1.
+		 */
+		minJudgments?: number;
+		description?: string;
+	};
+	export type BuildJudgedSuiteResult = {
+		suiteId: string;
+		version: string;
+		kind: "judged";
+		caseCount: number;
+		/**
+		 * Whether more judged runs matched than the 1000 cases a set holds.
+		 */
+		truncated: boolean;
+	};
+	export type PromptParameter = {
+		name: string;
+		description?: string;
+		type: "string" | "number" | "boolean" | "date";
+		required?: boolean;
+		/**
+		 * Default value used when the caller omits this parameter.
+		 */
+		default?: unknown;
+	};
+	export type RetrievalIntent = {
+		types: Array<string>;
+		scope: "same-conversation" | "same-project" | "tenant";
+		limit?: number;
+		mode?: "keyword" | "semantic" | "both";
+	};
+	export type ConversationPolicy = Partial<{
+		historyLimit: number;
+		autoCloseAfterInactiveSeconds: number;
+		hitlAfterTurns: number;
+	}>;
+	export type TurnBudget = Partial<{
+		maxSteps: number;
+		maxCostUsd: number;
+		maxWallMs: number;
+	}>;
+	/**
+	 * Capability declaration — see `@kindgi/capabilities`. Additional properties are permitted so new capability kinds do not require a wire change.
+	 */
+	export type Capability = Record<string, unknown>;
+	/**
+	 * Typed tool reference. `version` is a semver **range** (npm-style: `1.2.3` exact pin, `^1.2.3` compatible-updates, `~1.2.3` patch-updates-only, `>=1.0.0 <2.0.0` explicit range). Dispatch resolves the range to a concrete active version via `semver.maxSatisfying` at run start. No implicit "latest" — every tool ref names both id and range.
+	 */
+	export type ToolRef = {
+		id: string;
+		version: string;
+	};
+	export type AgentOutputSpec = {
+		/**
+		 * JSON Schema (draft 2020-12) the final answer must match.
+		 */
+		schema: Record<string, unknown>;
+		/**
+		 * A name for the output, shown to the model and in errors. Default `output`.
+		 */
+		name?: string;
+		/**
+		 * How many times the model is asked to repair an invalid answer. Default 1.
+		 */
+		maxRepairs?: number;
+	};
+	export type ToolErrorsSpec = Partial<{
+		/**
+		 * Failed calls sent back to the model per turn. Default 1.
+		 */
+		maxRetries: number;
+		/**
+		 * Which failures are sent back: arguments that don't fit the input schema (`invalid-arguments`), a tool the agent doesn't have (`unknown-tool`), a tool that ran and failed (`tool-error`). Default `invalid-arguments`, `unknown-tool`.
+		 */
+		retryOn: Array<"invalid-arguments" | "unknown-tool" | "tool-error">;
+	}>;
+	/**
+	 * A prompt block an agent's instructions come from, by id and semver range.
+	 */
+	export type PromptRef = {
+		/**
+		 * The prompt block id.
+		 */
+		prompt: string;
+		/**
+		 * A semver range (`^1.0.0`, `1.2.0`).
+		 */
+		version: string;
+	};
+	/**
+	 * A settings block an agent reads, by id and semver range.
+	 */
+	export type BlockRef = {
+		/**
+		 * The settings block id.
+		 */
+		id: string;
+		/**
+		 * A semver range (`^1.0.0`, `1.2.0`).
+		 */
+		version: string;
+	};
+	/**
+	 * The exact block versions an agent version runs: its lockfile. Set by the runtime when the version is published, never in the publish body: each tool range resolves once to the version every run of that agent version uses, so a new tool version reaches the agent only through a new agent version. Absent on a version published before pins existed (its ranges resolve per run).
+	 */
+	export type AgentPins = {
+		/**
+		 * Tool id → exact version.
+		 */
+		tools: Record<string, string>;
+		/**
+		 * Prompt block id → exact version.
+		 */
+		prompts: Record<string, string>;
+		/**
+		 * Settings block id → exact version.
+		 */
+		settings: Record<string, string>;
+	};
+	/**
+	 * Set by the runtime on an agent or flow version a deploy registered in place of the definition's version, which was registered already with other pins or content (versions never change). Never in the publish body.
+	 */
+	export type VersionDerivation = {
+		/**
+		 * The version the definition names.
+		 */
+		version: string;
+		/**
+		 * `pins-changed`: a block it uses has a new version; `unpinned`: the definition's version was published before pins existed; `version-taken`: the definition's version holds another definition; `edited`: derived from `version` with some data-block pins swapped (`POST /v1/agents/{agentId}/versions`).
+		 */
+		reason: "pins-changed" | "unpinned" | "version-taken" | "edited";
+		/**
+		 * For `edited`: a short label for the version.
+		 */
+		label?: string;
+		/**
+		 * For `edited`: who derived it (`user:<id>`).
+		 */
+		by?: string;
+	};
+	export type Agent = {
+		/**
+		 * AgentId — dotted namespace (e.g. `acme.drafting`).
+		 */
+		id: string;
+		/**
+		 * Semver.
+		 */
+		version: string;
+		name: string;
+		description?: string;
+		/**
+		 * The system prompt (a Liquid template), or a prompt block by range whose template and parameters are used instead (pinned at publish, `pins.prompts`).
+		 */
+		instructions: string | PromptRef;
+		parameters?: Array<PromptParameter>;
+		/**
+		 * Settings blocks the agent reads, by range: tools read them as `ToolContext.settings['<id>']`, templates as `settings["<id>"]`. Pinned at publish (`pins.settings`).
+		 */
+		settings?: Array<BlockRef>;
+		modelSettings?: BlockRef;
+		capabilities: Array<Capability>;
+		tools: Array<ToolRef>;
+		retrieval: Array<RetrievalIntent>;
+		guardrails: Array<string>;
+		/**
+		 * Soft hint — the router prefers this provider by id (e.g. `anthropic`) when at least one of its models satisfies `capabilities.needs` + tenant policy. Combine with `preferredModel` to pin the exact (provider, model) tuple. Falls back to capability-based ranking when the pinned provider is unregistered or filtered out.
+		 */
+		preferredProvider?: string;
+		/**
+		 * Soft hint at the model level (`ModelInfo.name`, e.g. `claude-sonnet-4-6`). Combined with `preferredProvider`: both set → promote the exact tuple; only `preferredModel` → promote any provider exposing that model; only `preferredProvider` → promote every model of that provider.
+		 */
+		preferredModel?: string;
+		conversationPolicy?: ConversationPolicy;
+		budget?: TurnBudget;
+		tags?: Array<string>;
+		output?: AgentOutputSpec;
+		toolErrors?: ToolErrorsSpec;
+		pins?: AgentPins;
+		derivedFrom?: VersionDerivation;
+		/**
+		 * Present only on an unregistered version (`GET …/versions/{version}` reads those too). Unregister stops a version being chosen, not the pins that hold it: a new run naming it is refused, while a resumed run and a published version that pins it still run it.
+		 */
+		unregisteredAt?: string;
+		/**
+		 * Set by the runtime with `pins`: `sha256:<hex>` of the pins' canonical JSON (sorted keys, no whitespace). Two agent versions with the same digest run the same blocks.
+		 */
+		pinsDigest?: string;
+	};
+	/**
+	 * One pin that differs between two versions of an agent or a flow.
+	 */
+	export type PinChange = {
+		kind: "tool" | "prompt" | "setting" | "agent";
+		id: string;
+		/**
+		 * The earlier version's pin; absent when it had none.
+		 */
+		from?: string;
+		/**
+		 * The later version's pin; absent when it has none.
+		 */
+		to?: string;
+	};
+	/**
+	 * The data-block pins to swap, by block id → exact version. Only blocks the version already references; tool pins come from code.
+	 */
+	export type AgentPinSwaps = Partial<{
+		/**
+		 * Prompt block id → exact version.
+		 */
+		prompts: Record<string, string>;
+		/**
+		 * Settings block id → exact version.
+		 */
+		settings: Record<string, string>;
+	}>;
+	/**
+	 * Derive a new agent version from a pinned one with some data-block pins swapped: an expert's edit reaching an agent with no code change.
+	 */
+	export type DeriveAgentVersionBody = {
+		/**
+		 * The version to derive from (it must be pinned).
+		 */
+		from: string;
+		pins: AgentPinSwaps;
+		/**
+		 * A short label for the new version.
+		 */
+		label?: string;
+		/**
+		 * The agent's project, when the runtime doesn't record it on the version.
+		 */
+		projectId?: string;
+	};
+	/**
+	 * The exact tool and agent versions a flow version runs: its lockfile. Set by the runtime when the version is published, never in the publish body: each tool the flow runs, and each agent it runs at no named version, resolves once to its latest version then, which every run of that flow version uses. Absent on a version published before pins existed (it binds the latest versions per run).
+	 */
+	export type FlowPins = {
+		/**
+		 * Tool id → exact version.
+		 */
+		tools: Record<string, string>;
+		/**
+		 * Agent id → exact version, for agent nodes that name no version.
+		 */
+		agents: Record<string, string>;
+	};
+	/**
+	 * Full `defineAgent` spec. Validated server-side via `@kindgi/agents.defineAgent` — validation failures return `400 validation-failed` with the issue list under `details.issues`.
+	 */
+	export type PublishAgentBody = {
+		id: string;
+		version: string;
+		name: string;
+		description?: string;
+		/**
+		 * Project this belongs to (its content scope). Required: missing, or not a project in the caller's tenant → `400 bad-input`.
+		 */
+		projectId: string;
+		/**
+		 * The system prompt (a Liquid template), or a prompt block by range whose template and parameters are used instead (pinned at publish, `pins.prompts`).
+		 */
+		instructions: string | PromptRef;
+		parameters?: Array<PromptParameter>;
+		/**
+		 * Settings blocks the agent reads, by range: tools read them as `ToolContext.settings['<id>']`, templates as `settings["<id>"]`. Pinned at publish (`pins.settings`).
+		 */
+		settings?: Array<BlockRef>;
+		modelSettings?: BlockRef;
+		capabilities: Array<Capability>;
+		tools: Array<ToolRef>;
+		retrieval: Array<RetrievalIntent>;
+		guardrails: Array<string>;
+		/**
+		 * Soft hint — the router prefers this provider by id (e.g. `anthropic`) when at least one of its models satisfies `capabilities.needs` + tenant policy. Combine with `preferredModel` to pin the exact (provider, model) tuple.
+		 */
+		preferredProvider?: string;
+		/**
+		 * Soft hint at the model level (`ModelInfo.name`). Combined with `preferredProvider` to pin an exact tuple; alone to select a model across every provider that exposes it.
+		 */
+		preferredModel?: string;
+		conversationPolicy?: ConversationPolicy;
+		budget?: TurnBudget;
+		tags?: Array<string>;
+		output?: AgentOutputSpec;
+		toolErrors?: ToolErrorsSpec;
+	};
+	export type PublishAgentResult = {
+		agentId: string;
+		version: string;
+	};
+	export type UnregisterAgentResult = {
+		agentId: string;
+		version: string;
+		unregistered: true;
+	};
+	export type ReinstateAgentVersionResult = {
+		agentId: string;
+		version: string;
+		/**
+		 * `true` when this call un-tombstoned the version; `false` when it was already active (idempotent no-op).
+		 */
+		wasTombstoned: boolean;
+	};
+	export type AgentCollectionPage = {
+		data: Array<Agent>;
+		/**
+		 * Opaque cursor for the next page. Absent when `hasMore: false`.
+		 */
+		nextCursor?: string;
+		hasMore: boolean;
+	};
+	export type FlowNode = {
 		id: string;
 		kind: "tool" | "agent" | "loop" | "fanout" | "subgraph";
 		/**
@@ -4731,6 +5489,16 @@ declare namespace Schemas {
 		edges: Array<FlowEdge>;
 		maxParallelism?: number;
 		metadata?: Record<string, unknown>;
+		pins?: FlowPins;
+		/**
+		 * Set by the runtime with `pins`: `sha256:<hex>` of the pins' canonical JSON (sorted keys, no whitespace).
+		 */
+		pinsDigest?: string;
+		derivedFrom?: VersionDerivation;
+		/**
+		 * Present only on an unregistered version (`GET …/versions/{version}` reads those too). Unregister stops a version being chosen, not the pins that hold it: a new run naming it is refused, while a resumed run and a published version that pins it still run it.
+		 */
+		unregisteredAt?: string;
 	};
 	/**
 	 * Full flow definition. Validated server-side via `@kindgi/flow.loadFlow` — validation failures return `400 validation-failed` with the issue list under `details.issues`.
@@ -5741,6 +6509,10 @@ declare namespace Schemas {
 		 * A fallback serves a capability only when no other provider satisfies it (e.g. `kindgi dev`'s scripted `dev-echo`); an agent turn routed to one carries a `fallback-provider` warning. Absent = `false`.
 		 */
 		fallback?: boolean;
+		/**
+		 * Bookkeeping, such as who manages the provider; the router ignores labels. At most 32 keys; a key is 1-63 lowercase letters and digits, with `.`, `-`, `_` or `/` inside; a value is at most 256 characters. The convention key `kindgi.com/managed-by` names the manager (`kindgi-dev`, `kindgi-deploy:<environment>`). Out of bounds: `400 invalid-provider`, reason `invalid-labels`.
+		 */
+		labels?: Record<string, string>;
 	};
 	export type ProviderCollectionPage = {
 		data: Array<ProviderMetadata>;
@@ -6056,7 +6828,18 @@ declare namespace Schemas {
 		tokens: CostTokenTotals;
 	};
 	export type CostAggregateResult = {
+		/**
+		 * The most expensive groups first (`totalUsd` descending, ties by key), at most `limit`.
+		 */
 		groups: Array<CostAggregateGroup>;
+		/**
+		 * How many groups there were before the `limit` cap. Absent from a runtime before 0.1.5.
+		 */
+		totalGroups?: number;
+		/**
+		 * `true` when there were more groups than `limit`: `groups` holds the most expensive ones, and `totalUsd` / `totalRecords` / `tokens` still cover every record. Absent from a runtime before 0.1.5.
+		 */
+		truncated?: boolean;
 		totalUsd: number;
 		totalRecords: number;
 		tokens: CostTokenTotals;
@@ -6178,7 +6961,7 @@ declare namespace Schemas {
 		version: string;
 		wasTombstoned: boolean;
 	};
-	export type EvalKind = "accuracy" | "pairwise" | "regression" | "human-review" | "benchmark" | "custom";
+	export type EvalKind = "accuracy" | "pairwise" | "regression" | "human-review" | "benchmark" | "custom" | "judged";
 	export type EvalSuite = {
 		id: string;
 		tenantId: string;
@@ -6227,6 +7010,79 @@ declare namespace Schemas {
 		version: string;
 		wasTombstoned: boolean;
 	};
+	/**
+	 * `prompt`: a Liquid template an agent renders as its instructions. `settings`: a JSON object tools and templates read.
+	 */
+	export type BlockKind = "prompt" | "settings";
+	export type PromptBlockContent = {
+		/**
+		 * Liquid, rendered as an agent's instructions are (same parameters and auto-injected variables).
+		 */
+		template: string;
+		parameters?: Array<PromptParameter>;
+	};
+	export type SettingsBlockContent = {
+		/**
+		 * What tools read (`ToolContext.settings[<block id>]`) and templates read (`settings.<block id>.<key>`).
+		 */
+		values: Record<string, unknown>;
+		/**
+		 * JSON Schema (draft 2020-12) the values must satisfy. A later version's values must satisfy the latest version's schema too.
+		 */
+		schema?: Record<string, unknown>;
+	};
+	/**
+	 * A data block version: a prompt or settings, versioned like a tool (immutable versions, soft unregister). An agent version pins the block versions it uses when it is published. Belongs to one project and is authorized through it.
+	 */
+	export type Block = {
+		/**
+		 * Dotted lowercase id (e.g. `acme.intake-prompt`).
+		 */
+		id: string;
+		version: string;
+		kind: BlockKind;
+		description?: string;
+		/**
+		 * `PromptBlockContent` for a prompt, `SettingsBlockContent` for settings.
+		 */
+		content: PromptBlockContent | SettingsBlockContent;
+		projectId: string;
+		publishedAt: string;
+		/**
+		 * Present only on an unregistered version; agent versions that pin it still read it.
+		 */
+		unregisteredAt?: string;
+	};
+	export type BlockCollectionPage = {
+		data: Array<Block>;
+		nextCursor?: string;
+		hasMore: boolean;
+	};
+	export type PublishBlockBody = {
+		/**
+		 * Project this belongs to (its content scope). Required: missing, or not a project in the caller's tenant → `400 bad-input`.
+		 */
+		projectId: string;
+		id: string;
+		version: string;
+		kind: BlockKind;
+		description?: string;
+		content: PromptBlockContent | SettingsBlockContent;
+	};
+	export type PublishBlockResult = {
+		blockId: string;
+		version: string;
+	};
+	export type UnregisterBlockResult = {
+		blockId: string;
+		version: string;
+		unregistered: true;
+	};
+	export type ReinstateBlockResult = {
+		blockId: string;
+		version: string;
+		wasTombstoned: boolean;
+	};
 	export type EvalRunStatus = "pending" | "running" | "completed" | "failed" | "cancelled";
 	export type EvalRunAgentRef = {
 		agentId: string;
@@ -6236,6 +7092,30 @@ declare namespace Schemas {
 		flowId: string;
 		version?: string;
 	};
+	/**
+	 * What a comparison compares the candidate against: `'recorded'` (each case's recorded output, what was judged), a version (`{ agentId, version }`, replayed under the same rules), or the version live in a scope (`{ live: { projectId?, segments? } }`). Only `'recorded'` runs today; the others are refused when the run starts.
+	 */
+	export type EvalBaseline = "recorded" | {
+		agentId: string;
+		version: string;
+	} | {
+		live: Partial<{
+			projectId: string;
+			segments: Record<string, string>;
+		}>;
+	};
+	/**
+	 * A comparison eval run's settings (a `judged` suite).
+	 */
+	export type EvalComparison = {
+		baseline: EvalBaseline;
+		/**
+		 * Whether replayed reads use the past run's results when it has them (`recorded`), or run live.
+		 */
+		reads: "recorded" | "live";
+		repetitions: number;
+		k: number;
+	};
 	export type EvalRun = {
 		runId: string;
 		tenantId: string;
@@ -6249,11 +7129,12 @@ declare namespace Schemas {
 		startedAt: string;
 		completedAt?: string;
 		/**
-		 * Kind-specific opaque JSON. For `accuracy`, contains `{ passCount, totalCount, meanScore, perCase[] }`. Other kinds define their own shapes as their dispatchers ship.
+		 * Kind-specific opaque JSON. For `accuracy`, contains `{ passCount, totalCount, meanScore, perCase[] }`. For `judged` (a comparison), `{ summary, perCase[] }`: the summary has the baseline (the versions behind the recorded runs) and the candidate (`{ kind: "agent", agentId, version }` or `{ kind: "flow", flowId, version }`), the case counts (`cases`, `diverged`, `refusedWrites`, `errors`, and `stopped`: flow cases that stopped at a write the replay refused, left out of the metrics), the models that answered, and `metrics` (`weightedYesShare`, `judgedCoverage`, `weightedPrecisionAtK`, each `{ baseline, candidate, delta, n, weight, baselineN, baselineWeight, direction, k?, spread? }`); each case has its replay runs, the scores, the items kept, dropped and new, the tool calls with what happened to each, and `stopped` (what it would have done) when it stopped. Other kinds define their own shapes as their dispatchers ship.
 		 */
 		result?: Record<string, unknown>;
 		error?: string;
 		correlationId?: string;
+		comparison?: EvalComparison;
 	};
 	export type EvalRunCollectionPage = {
 		data: Array<EvalRun>;
@@ -6261,7 +7142,7 @@ declare namespace Schemas {
 		hasMore: boolean;
 	};
 	/**
-	 * Exactly one of `agentRef` or `flowRef` MUST be supplied. `dryRun: true` returns a plan preview without invoking the subject.
+	 * Exactly one of `agentRef` or `flowRef` MUST be supplied. `dryRun: true` returns a plan preview without invoking the subject. For a `judged` suite (a test set), the run is a comparison: `agentRef` or `flowRef` with its `version` is the candidate, replayed on each case without doing anything the past run didn't (a flow stops at a write the replay refuses); `baseline` (default `'recorded'`), `reads` (default `recorded`), `repetitions` (default 1) and `k` (default 10) set how.
 	 */
 	export type StartEvalRunBody = {
 		/**
@@ -6272,6 +7153,10 @@ declare namespace Schemas {
 		flowRef?: EvalRunFlowRef;
 		dryRun?: boolean;
 		correlationId?: string;
+		baseline?: EvalBaseline;
+		reads?: "recorded" | "live";
+		repetitions?: number;
+		k?: number;
 	};
 	export type StartEvalRunResult = {
 		runId: string;
@@ -6443,16 +7328,48 @@ declare namespace Schemas {
 		agents: Array<{
 			id: string;
 			/**
-			 * Absent for guardrails, which have no version.
+			 * The version the agent is registered as.
 			 */
-			version?: string;
+			version: string;
+			/**
+			 * The version the agent's or flow's definition names, present when it differs from `version`: that version was registered already with other pins or content, and versions never change, so the deploy registered the next free version in its line (or an earlier deploy did).
+			 */
+			authoredVersion?: string;
+			/**
+			 * Why `version` differs from `authoredVersion`: `pins-changed` (a tool or agent it uses has a new version), `unpinned` (`authoredVersion` was published before pins existed), `version-taken` (`authoredVersion` is registered with other content).
+			 */
+			reason?: "pins-changed" | "unpinned" | "version-taken";
+			/**
+			 * `true`: this deploy registered `version`; `false`: an earlier deploy did.
+			 */
+			newVersion?: boolean;
+			/**
+			 * For `pins-changed`: the pins that differ from `authoredVersion`'s.
+			 */
+			pinChanges?: Array<PinChange>;
 		}>;
 		flows: Array<{
 			id: string;
 			/**
-			 * Absent for guardrails, which have no version.
+			 * The version the agent is registered as.
 			 */
-			version?: string;
+			version: string;
+			/**
+			 * The version the agent's or flow's definition names, present when it differs from `version`: that version was registered already with other pins or content, and versions never change, so the deploy registered the next free version in its line (or an earlier deploy did).
+			 */
+			authoredVersion?: string;
+			/**
+			 * Why `version` differs from `authoredVersion`: `pins-changed` (a tool or agent it uses has a new version), `unpinned` (`authoredVersion` was published before pins existed), `version-taken` (`authoredVersion` is registered with other content).
+			 */
+			reason?: "pins-changed" | "unpinned" | "version-taken";
+			/**
+			 * `true`: this deploy registered `version`; `false`: an earlier deploy did.
+			 */
+			newVersion?: boolean;
+			/**
+			 * For `pins-changed`: the pins that differ from `authoredVersion`'s.
+			 */
+			pinChanges?: Array<PinChange>;
 		}>;
 	};
 	export type DeploymentRecord = {
@@ -7362,13 +8279,160 @@ declare const MintPublicRunTokenResult: z.ZodObject<{
 	expiresAt: z.ZodISODateTime;
 	runIds: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
+export type JudgedEvalCase = Schemas.JudgedEvalCase;
+declare const JudgedEvalCase: z.ZodObject<{
+	caseId: z.ZodString;
+	subject: z.ZodObject<{
+		kind: z.ZodEnum<{
+			agent: "agent";
+			flow: "flow";
+		}>;
+		id: z.ZodString;
+		version: z.ZodString;
+	}, z.core.$strict>;
+	input: z.ZodUnknown;
+	context: z.ZodOptional<z.ZodObject<{
+		history: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+		historyTruncated: z.ZodOptional<z.ZodBoolean>;
+		retrieved: z.ZodOptional<z.ZodUnknown>;
+		sessionApproval: z.ZodOptional<z.ZodObject<{
+			approved: z.ZodBoolean;
+			rationale: z.ZodOptional<z.ZodString>;
+		}, z.core.$strict>>;
+		flow: z.ZodOptional<z.ZodObject<{
+			calls: z.ZodArray<z.ZodObject<{
+				runId: z.ZodString;
+				nodeId: z.ZodOptional<z.ZodString>;
+				scope: z.ZodOptional<z.ZodString>;
+				toolId: z.ZodString;
+				arguments: z.ZodOptional<z.ZodUnknown>;
+				result: z.ZodOptional<z.ZodUnknown>;
+			}, z.core.$strict>>;
+			steps: z.ZodArray<z.ZodObject<{
+				runId: z.ZodString;
+				nodeId: z.ZodOptional<z.ZodString>;
+				scope: z.ZodOptional<z.ZodString>;
+				agentId: z.ZodString;
+				agentVersion: z.ZodString;
+				retrieved: z.ZodOptional<z.ZodUnknown>;
+			}, z.core.$strict>>;
+			truncated: z.ZodOptional<z.ZodBoolean>;
+		}, z.core.$strict>>;
+	}, z.core.$strict>>;
+	output: z.ZodUnknown;
+	items: z.ZodArray<z.ZodObject<{
+		key: z.ZodString;
+		pointer: z.ZodOptional<z.ZodString>;
+		rank: z.ZodOptional<z.ZodNumber>;
+		yes: z.ZodNumber;
+		no: z.ZodNumber;
+		yesWeight: z.ZodNumber;
+		totalWeight: z.ZodNumber;
+		reasons: z.ZodArray<z.ZodObject<{
+			verdict: z.ZodEnum<{
+				yes: "yes";
+				no: "no";
+			}>;
+			reason: z.ZodString;
+		}, z.core.$strict>>;
+	}, z.core.$strict>>;
+}, z.core.$strict>;
+export type JudgedEvalCaseCollectionPage = Schemas.JudgedEvalCaseCollectionPage;
+declare const JudgedEvalCaseCollectionPage: z.ZodObject<{
+	data: z.ZodArray<z.ZodObject<{
+		caseId: z.ZodString;
+		subject: z.ZodObject<{
+			kind: z.ZodEnum<{
+				agent: "agent";
+				flow: "flow";
+			}>;
+			id: z.ZodString;
+			version: z.ZodString;
+		}, z.core.$strict>;
+		input: z.ZodUnknown;
+		context: z.ZodOptional<z.ZodObject<{
+			history: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+			historyTruncated: z.ZodOptional<z.ZodBoolean>;
+			retrieved: z.ZodOptional<z.ZodUnknown>;
+			sessionApproval: z.ZodOptional<z.ZodObject<{
+				approved: z.ZodBoolean;
+				rationale: z.ZodOptional<z.ZodString>;
+			}, z.core.$strict>>;
+			flow: z.ZodOptional<z.ZodObject<{
+				calls: z.ZodArray<z.ZodObject<{
+					runId: z.ZodString;
+					nodeId: z.ZodOptional<z.ZodString>;
+					scope: z.ZodOptional<z.ZodString>;
+					toolId: z.ZodString;
+					arguments: z.ZodOptional<z.ZodUnknown>;
+					result: z.ZodOptional<z.ZodUnknown>;
+				}, z.core.$strict>>;
+				steps: z.ZodArray<z.ZodObject<{
+					runId: z.ZodString;
+					nodeId: z.ZodOptional<z.ZodString>;
+					scope: z.ZodOptional<z.ZodString>;
+					agentId: z.ZodString;
+					agentVersion: z.ZodString;
+					retrieved: z.ZodOptional<z.ZodUnknown>;
+				}, z.core.$strict>>;
+				truncated: z.ZodOptional<z.ZodBoolean>;
+			}, z.core.$strict>>;
+		}, z.core.$strict>>;
+		output: z.ZodUnknown;
+		items: z.ZodArray<z.ZodObject<{
+			key: z.ZodString;
+			pointer: z.ZodOptional<z.ZodString>;
+			rank: z.ZodOptional<z.ZodNumber>;
+			yes: z.ZodNumber;
+			no: z.ZodNumber;
+			yesWeight: z.ZodNumber;
+			totalWeight: z.ZodNumber;
+			reasons: z.ZodArray<z.ZodObject<{
+				verdict: z.ZodEnum<{
+					yes: "yes";
+					no: "no";
+				}>;
+				reason: z.ZodString;
+			}, z.core.$strict>>;
+		}, z.core.$strict>>;
+	}, z.core.$strict>>;
+	nextCursor: z.ZodOptional<z.ZodString>;
+	hasMore: z.ZodBoolean;
+}, z.core.$strict>;
+export type BuildJudgedSuiteBody = Schemas.BuildJudgedSuiteBody;
+declare const BuildJudgedSuiteBody: z.ZodObject<{
+	version: z.ZodString;
+	projectId: z.ZodString;
+	agentId: z.ZodOptional<z.ZodString>;
+	agentVersion: z.ZodOptional<z.ZodString>;
+	flowId: z.ZodOptional<z.ZodString>;
+	since: z.ZodOptional<z.ZodISODateTime>;
+	until: z.ZodOptional<z.ZodISODateTime>;
+	judgeClassIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+	minJudgments: z.ZodOptional<z.ZodNumber>;
+	description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type BuildJudgedSuiteResult = Schemas.BuildJudgedSuiteResult;
+declare const BuildJudgedSuiteResult: z.ZodObject<{
+	suiteId: z.ZodString;
+	version: z.ZodString;
+	kind: z.ZodLiteral<"judged">;
+	caseCount: z.ZodNumber;
+	truncated: z.ZodBoolean;
+}, z.core.$strict>;
 type Agent$1 = Schemas.Agent;
 declare const Agent$1: z.ZodObject<{
 	id: z.ZodString;
 	version: z.ZodString;
 	name: z.ZodString;
 	description: z.ZodOptional<z.ZodString>;
-	instructions: z.ZodString;
+	instructions: z.ZodUnion<readonly [
+		z.ZodString,
+		z.ZodObject<{
+			prompt: z.ZodString;
+			version: z.ZodString;
+		}, z.core.$strict>
+	]>;
 	parameters: z.ZodOptional<z.ZodArray<z.ZodObject<{
 		name: z.ZodString;
 		description: z.ZodOptional<z.ZodString>;
@@ -7381,6 +8445,14 @@ declare const Agent$1: z.ZodObject<{
 		required: z.ZodOptional<z.ZodBoolean>;
 		default: z.ZodOptional<z.ZodUnknown>;
 	}, z.core.$strict>>>;
+	settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+	}, z.core.$strict>>>;
+	modelSettings: z.ZodOptional<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+	}, z.core.$strict>>;
 	capabilities: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	tools: z.ZodArray<z.ZodObject<{
 		id: z.ZodString;
@@ -7427,6 +8499,34 @@ declare const Agent$1: z.ZodObject<{
 			"unknown-tool": "unknown-tool";
 		}>>>;
 	}, z.core.$strict>>;
+	pins: z.ZodOptional<z.ZodObject<{
+		tools: z.ZodRecord<z.ZodString, z.ZodString>;
+		prompts: z.ZodRecord<z.ZodString, z.ZodString>;
+		settings: z.ZodRecord<z.ZodString, z.ZodString>;
+	}, z.core.$strict>>;
+	derivedFrom: z.ZodOptional<z.ZodObject<{
+		version: z.ZodString;
+		reason: z.ZodEnum<{
+			"pins-changed": "pins-changed";
+			unpinned: "unpinned";
+			"version-taken": "version-taken";
+			edited: "edited";
+		}>;
+		label: z.ZodOptional<z.ZodString>;
+		by: z.ZodOptional<z.ZodString>;
+	}, z.core.$strict>>;
+	unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+	pinsDigest: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type DeriveAgentVersionBody = Schemas.DeriveAgentVersionBody;
+declare const DeriveAgentVersionBody: z.ZodObject<{
+	from: z.ZodString;
+	pins: z.ZodObject<{
+		prompts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+		settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+	}, z.core.$strict>;
+	label: z.ZodOptional<z.ZodString>;
+	projectId: z.ZodOptional<z.ZodUUID>;
 }, z.core.$strict>;
 export type UnregisterAgentResult = Schemas.UnregisterAgentResult;
 declare const UnregisterAgentResult: z.ZodObject<{
@@ -7441,7 +8541,13 @@ declare const AgentCollectionPage: z.ZodObject<{
 		version: z.ZodString;
 		name: z.ZodString;
 		description: z.ZodOptional<z.ZodString>;
-		instructions: z.ZodString;
+		instructions: z.ZodUnion<readonly [
+			z.ZodString,
+			z.ZodObject<{
+				prompt: z.ZodString;
+				version: z.ZodString;
+			}, z.core.$strict>
+		]>;
 		parameters: z.ZodOptional<z.ZodArray<z.ZodObject<{
 			name: z.ZodString;
 			description: z.ZodOptional<z.ZodString>;
@@ -7454,6 +8560,14 @@ declare const AgentCollectionPage: z.ZodObject<{
 			required: z.ZodOptional<z.ZodBoolean>;
 			default: z.ZodOptional<z.ZodUnknown>;
 		}, z.core.$strict>>>;
+		settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+			id: z.ZodString;
+			version: z.ZodString;
+		}, z.core.$strict>>>;
+		modelSettings: z.ZodOptional<z.ZodObject<{
+			id: z.ZodString;
+			version: z.ZodString;
+		}, z.core.$strict>>;
 		capabilities: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 		tools: z.ZodArray<z.ZodObject<{
 			id: z.ZodString;
@@ -7500,6 +8614,24 @@ declare const AgentCollectionPage: z.ZodObject<{
 				"unknown-tool": "unknown-tool";
 			}>>>;
 		}, z.core.$strict>>;
+		pins: z.ZodOptional<z.ZodObject<{
+			tools: z.ZodRecord<z.ZodString, z.ZodString>;
+			prompts: z.ZodRecord<z.ZodString, z.ZodString>;
+			settings: z.ZodRecord<z.ZodString, z.ZodString>;
+		}, z.core.$strict>>;
+		derivedFrom: z.ZodOptional<z.ZodObject<{
+			version: z.ZodString;
+			reason: z.ZodEnum<{
+				"pins-changed": "pins-changed";
+				unpinned: "unpinned";
+				"version-taken": "version-taken";
+				edited: "edited";
+			}>;
+			label: z.ZodOptional<z.ZodString>;
+			by: z.ZodOptional<z.ZodString>;
+		}, z.core.$strict>>;
+		unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+		pinsDigest: z.ZodOptional<z.ZodString>;
 	}, z.core.$strict>>;
 	nextCursor: z.ZodOptional<z.ZodString>;
 	hasMore: z.ZodBoolean;
@@ -7538,6 +8670,7 @@ declare const ProviderMetadata: z.ZodObject<{
 	description: z.ZodOptional<z.ZodString>;
 	capabilityKind: z.ZodOptional<z.ZodString>;
 	fallback: z.ZodOptional<z.ZodBoolean>;
+	labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strict>;
 export type ProviderCollectionPage = Schemas.ProviderCollectionPage;
 declare const ProviderCollectionPage: z.ZodObject<{
@@ -7574,6 +8707,7 @@ declare const ProviderCollectionPage: z.ZodObject<{
 		description: z.ZodOptional<z.ZodString>;
 		capabilityKind: z.ZodOptional<z.ZodString>;
 		fallback: z.ZodOptional<z.ZodBoolean>;
+		labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 	}, z.core.$strict>>;
 	nextCursor: z.ZodOptional<z.ZodString>;
 	hasMore: z.ZodBoolean;
@@ -7613,6 +8747,7 @@ declare const RegisterProviderBody: z.ZodObject<{
 		description: z.ZodOptional<z.ZodString>;
 		capabilityKind: z.ZodOptional<z.ZodString>;
 		fallback: z.ZodOptional<z.ZodBoolean>;
+		labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 	}, z.core.$strict>;
 	adapter_id: z.ZodString;
 	secret_ref: z.ZodOptional<z.ZodObject<{
@@ -7675,6 +8810,7 @@ declare const EvalKind: z.ZodEnum<{
 	"human-review": "human-review";
 	benchmark: "benchmark";
 	custom: "custom";
+	judged: "judged";
 }>;
 export type EvalSuite = Schemas.EvalSuite;
 declare const EvalSuite: z.ZodObject<{
@@ -7688,6 +8824,7 @@ declare const EvalSuite: z.ZodObject<{
 		"human-review": "human-review";
 		benchmark: "benchmark";
 		custom: "custom";
+		judged: "judged";
 	}>;
 	description: z.ZodOptional<z.ZodString>;
 	spec: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -7705,6 +8842,7 @@ declare const EvalSuiteCollectionPage: z.ZodObject<{
 			"human-review": "human-review";
 			benchmark: "benchmark";
 			custom: "custom";
+			judged: "judged";
 		}>;
 		description: z.ZodOptional<z.ZodString>;
 		spec: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -7725,6 +8863,7 @@ declare const PublishEvalSuiteBody: z.ZodObject<{
 		"human-review": "human-review";
 		benchmark: "benchmark";
 		custom: "custom";
+		judged: "judged";
 	}>;
 	description: z.ZodOptional<z.ZodString>;
 	spec: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -7746,6 +8885,132 @@ declare const ReinstateEvalSuiteVersionResult: z.ZodObject<{
 	version: z.ZodString;
 	wasTombstoned: z.ZodBoolean;
 }, z.core.$strict>;
+export type BlockKind = Schemas.BlockKind;
+export declare const BlockKind: z.ZodEnum<{
+	prompt: "prompt";
+	settings: "settings";
+}>;
+export type Block = Schemas.Block;
+export declare const Block: z.ZodObject<{
+	id: z.ZodString;
+	version: z.ZodString;
+	kind: z.ZodEnum<{
+		prompt: "prompt";
+		settings: "settings";
+	}>;
+	description: z.ZodOptional<z.ZodString>;
+	content: z.ZodUnion<readonly [
+		z.ZodObject<{
+			template: z.ZodString;
+			parameters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+				name: z.ZodString;
+				description: z.ZodOptional<z.ZodString>;
+				type: z.ZodEnum<{
+					string: "string";
+					number: "number";
+					boolean: "boolean";
+					date: "date";
+				}>;
+				required: z.ZodOptional<z.ZodBoolean>;
+				default: z.ZodOptional<z.ZodUnknown>;
+			}, z.core.$strict>>>;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+			schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+		}, z.core.$strict>
+	]>;
+	projectId: z.ZodUUID;
+	publishedAt: z.ZodISODateTime;
+	unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type BlockCollectionPage = Schemas.BlockCollectionPage;
+declare const BlockCollectionPage: z.ZodObject<{
+	data: z.ZodArray<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+		kind: z.ZodEnum<{
+			prompt: "prompt";
+			settings: "settings";
+		}>;
+		description: z.ZodOptional<z.ZodString>;
+		content: z.ZodUnion<readonly [
+			z.ZodObject<{
+				template: z.ZodString;
+				parameters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+					name: z.ZodString;
+					description: z.ZodOptional<z.ZodString>;
+					type: z.ZodEnum<{
+						string: "string";
+						number: "number";
+						boolean: "boolean";
+						date: "date";
+					}>;
+					required: z.ZodOptional<z.ZodBoolean>;
+					default: z.ZodOptional<z.ZodUnknown>;
+				}, z.core.$strict>>>;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+				schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+			}, z.core.$strict>
+		]>;
+		projectId: z.ZodUUID;
+		publishedAt: z.ZodISODateTime;
+		unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+	}, z.core.$strict>>;
+	nextCursor: z.ZodOptional<z.ZodString>;
+	hasMore: z.ZodBoolean;
+}, z.core.$strict>;
+export type PublishBlockBody = Schemas.PublishBlockBody;
+declare const PublishBlockBody: z.ZodObject<{
+	projectId: z.ZodUUID;
+	id: z.ZodString;
+	version: z.ZodString;
+	kind: z.ZodEnum<{
+		prompt: "prompt";
+		settings: "settings";
+	}>;
+	description: z.ZodOptional<z.ZodString>;
+	content: z.ZodUnion<readonly [
+		z.ZodObject<{
+			template: z.ZodString;
+			parameters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+				name: z.ZodString;
+				description: z.ZodOptional<z.ZodString>;
+				type: z.ZodEnum<{
+					string: "string";
+					number: "number";
+					boolean: "boolean";
+					date: "date";
+				}>;
+				required: z.ZodOptional<z.ZodBoolean>;
+				default: z.ZodOptional<z.ZodUnknown>;
+			}, z.core.$strict>>>;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+			schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+		}, z.core.$strict>
+	]>;
+}, z.core.$strict>;
+export type PublishBlockResult = Schemas.PublishBlockResult;
+export declare const PublishBlockResult: z.ZodObject<{
+	blockId: z.ZodString;
+	version: z.ZodString;
+}, z.core.$strict>;
+export type UnregisterBlockResult = Schemas.UnregisterBlockResult;
+export declare const UnregisterBlockResult: z.ZodObject<{
+	blockId: z.ZodString;
+	version: z.ZodString;
+	unregistered: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type ReinstateBlockResult = Schemas.ReinstateBlockResult;
+export declare const ReinstateBlockResult: z.ZodObject<{
+	blockId: z.ZodString;
+	version: z.ZodString;
+	wasTombstoned: z.ZodBoolean;
+}, z.core.$strict>;
 export type EvalRunStatus = Schemas.EvalRunStatus;
 declare const EvalRunStatus: z.ZodEnum<{
 	pending: "pending";
@@ -7767,6 +9032,7 @@ declare const EvalRun: z.ZodObject<{
 		"human-review": "human-review";
 		benchmark: "benchmark";
 		custom: "custom";
+		judged: "judged";
 	}>;
 	agentRef: z.ZodOptional<z.ZodObject<{
 		agentId: z.ZodString;
@@ -7789,6 +9055,27 @@ declare const EvalRun: z.ZodObject<{
 	result: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	error: z.ZodOptional<z.ZodString>;
 	correlationId: z.ZodOptional<z.ZodString>;
+	comparison: z.ZodOptional<z.ZodObject<{
+		baseline: z.ZodUnion<readonly [
+			z.ZodLiteral<"recorded">,
+			z.ZodObject<{
+				agentId: z.ZodString;
+				version: z.ZodString;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				live: z.ZodObject<{
+					projectId: z.ZodOptional<z.ZodString>;
+					segments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+				}, z.core.$strict>;
+			}, z.core.$strict>
+		]>;
+		reads: z.ZodEnum<{
+			recorded: "recorded";
+			live: "live";
+		}>;
+		repetitions: z.ZodNumber;
+		k: z.ZodNumber;
+	}, z.core.$strict>>;
 }, z.core.$strict>;
 export type EvalRunCollectionPage = Schemas.EvalRunCollectionPage;
 declare const EvalRunCollectionPage: z.ZodObject<{
@@ -7804,6 +9091,7 @@ declare const EvalRunCollectionPage: z.ZodObject<{
 			"human-review": "human-review";
 			benchmark: "benchmark";
 			custom: "custom";
+			judged: "judged";
 		}>;
 		agentRef: z.ZodOptional<z.ZodObject<{
 			agentId: z.ZodString;
@@ -7826,6 +9114,27 @@ declare const EvalRunCollectionPage: z.ZodObject<{
 		result: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 		error: z.ZodOptional<z.ZodString>;
 		correlationId: z.ZodOptional<z.ZodString>;
+		comparison: z.ZodOptional<z.ZodObject<{
+			baseline: z.ZodUnion<readonly [
+				z.ZodLiteral<"recorded">,
+				z.ZodObject<{
+					agentId: z.ZodString;
+					version: z.ZodString;
+				}, z.core.$strict>,
+				z.ZodObject<{
+					live: z.ZodObject<{
+						projectId: z.ZodOptional<z.ZodString>;
+						segments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+					}, z.core.$strict>;
+				}, z.core.$strict>
+			]>;
+			reads: z.ZodEnum<{
+				recorded: "recorded";
+				live: "live";
+			}>;
+			repetitions: z.ZodNumber;
+			k: z.ZodNumber;
+		}, z.core.$strict>>;
 	}, z.core.$strict>>;
 	nextCursor: z.ZodOptional<z.ZodString>;
 	hasMore: z.ZodBoolean;
@@ -7843,6 +9152,25 @@ declare const StartEvalRunBody: z.ZodObject<{
 	}, z.core.$strict>>;
 	dryRun: z.ZodOptional<z.ZodBoolean>;
 	correlationId: z.ZodOptional<z.ZodString>;
+	baseline: z.ZodOptional<z.ZodUnion<readonly [
+		z.ZodLiteral<"recorded">,
+		z.ZodObject<{
+			agentId: z.ZodString;
+			version: z.ZodString;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			live: z.ZodObject<{
+				projectId: z.ZodOptional<z.ZodString>;
+				segments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+			}, z.core.$strict>;
+		}, z.core.$strict>
+	]>>;
+	reads: z.ZodOptional<z.ZodEnum<{
+		recorded: "recorded";
+		live: "live";
+	}>>;
+	repetitions: z.ZodOptional<z.ZodNumber>;
+	k: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type StartEvalRunResult = Schemas.StartEvalRunResult;
 declare const StartEvalRunResult: z.ZodObject<{
@@ -8041,11 +9369,47 @@ declare const DeploymentRecord: z.ZodObject<{
 		}, z.core.$strict>>;
 		agents: z.ZodArray<z.ZodObject<{
 			id: z.ZodString;
-			version: z.ZodOptional<z.ZodString>;
+			version: z.ZodString;
+			authoredVersion: z.ZodOptional<z.ZodString>;
+			reason: z.ZodOptional<z.ZodEnum<{
+				"pins-changed": "pins-changed";
+				unpinned: "unpinned";
+				"version-taken": "version-taken";
+			}>>;
+			newVersion: z.ZodOptional<z.ZodBoolean>;
+			pinChanges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+				kind: z.ZodEnum<{
+					tool: "tool";
+					prompt: "prompt";
+					agent: "agent";
+					setting: "setting";
+				}>;
+				id: z.ZodString;
+				from: z.ZodOptional<z.ZodString>;
+				to: z.ZodOptional<z.ZodString>;
+			}, z.core.$strict>>>;
 		}, z.core.$strict>>;
 		flows: z.ZodArray<z.ZodObject<{
 			id: z.ZodString;
-			version: z.ZodOptional<z.ZodString>;
+			version: z.ZodString;
+			authoredVersion: z.ZodOptional<z.ZodString>;
+			reason: z.ZodOptional<z.ZodEnum<{
+				"pins-changed": "pins-changed";
+				unpinned: "unpinned";
+				"version-taken": "version-taken";
+			}>>;
+			newVersion: z.ZodOptional<z.ZodBoolean>;
+			pinChanges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+				kind: z.ZodEnum<{
+					tool: "tool";
+					prompt: "prompt";
+					agent: "agent";
+					setting: "setting";
+				}>;
+				id: z.ZodString;
+				from: z.ZodOptional<z.ZodString>;
+				to: z.ZodOptional<z.ZodString>;
+			}, z.core.$strict>>>;
 		}, z.core.$strict>>;
 	}, z.core.$strict>;
 }, z.core.$strict>;
@@ -8090,11 +9454,47 @@ declare const DeploymentCollectionPage: z.ZodObject<{
 			}, z.core.$strict>>;
 			agents: z.ZodArray<z.ZodObject<{
 				id: z.ZodString;
-				version: z.ZodOptional<z.ZodString>;
+				version: z.ZodString;
+				authoredVersion: z.ZodOptional<z.ZodString>;
+				reason: z.ZodOptional<z.ZodEnum<{
+					"pins-changed": "pins-changed";
+					unpinned: "unpinned";
+					"version-taken": "version-taken";
+				}>>;
+				newVersion: z.ZodOptional<z.ZodBoolean>;
+				pinChanges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+					kind: z.ZodEnum<{
+						tool: "tool";
+						prompt: "prompt";
+						agent: "agent";
+						setting: "setting";
+					}>;
+					id: z.ZodString;
+					from: z.ZodOptional<z.ZodString>;
+					to: z.ZodOptional<z.ZodString>;
+				}, z.core.$strict>>>;
 			}, z.core.$strict>>;
 			flows: z.ZodArray<z.ZodObject<{
 				id: z.ZodString;
-				version: z.ZodOptional<z.ZodString>;
+				version: z.ZodString;
+				authoredVersion: z.ZodOptional<z.ZodString>;
+				reason: z.ZodOptional<z.ZodEnum<{
+					"pins-changed": "pins-changed";
+					unpinned: "unpinned";
+					"version-taken": "version-taken";
+				}>>;
+				newVersion: z.ZodOptional<z.ZodBoolean>;
+				pinChanges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+					kind: z.ZodEnum<{
+						tool: "tool";
+						prompt: "prompt";
+						agent: "agent";
+						setting: "setting";
+					}>;
+					id: z.ZodString;
+					from: z.ZodOptional<z.ZodString>;
+					to: z.ZodOptional<z.ZodString>;
+				}, z.core.$strict>>>;
 			}, z.core.$strict>>;
 		}, z.core.$strict>;
 	}, z.core.$strict>>;
@@ -9046,7 +10446,17 @@ export interface AgentVersionsClient {
 	 * @wire POST /v1/agents/:agentId/versions/:version/unregister
 	 */
 	unregister(agentId: AgentId, version: Semver, options?: MutationOptions): Promise<UnregisterAgentResult>;
+	/**
+	 * Derive a new version from a pinned one with some data-block pins
+	 * swapped (an expert's edit, no code change). Numbered the next free
+	 * patch after the agent's highest version. Needs `publish` on the agent.
+	 *
+	 * @wire POST /v1/agents/:agentId/versions
+	 */
+	derive(agentId: AgentId, input: DeriveAgentVersionInput, options?: MutationOptions): Promise<Agent$1>;
 }
+/** Body of `POST /v1/agents/{agentId}/versions`. */
+export type DeriveAgentVersionInput = DeriveAgentVersionBody;
 export interface ListAgentsFilter {
 	readonly limit?: number;
 	readonly cursor?: string;
@@ -9435,6 +10845,59 @@ export interface AuthProvidersClient {
 		readonly idempotencyKey?: string;
 	}): Promise<IdentityProviderUnregisterOutcome>;
 }
+export type BlockPage = BlockCollectionPage;
+/**
+ * The block fields of `POST /v1/blocks`. The project travels as
+ * `PublishBlockOptions.projectId`, so the input stays the block itself.
+ */
+export type PublishBlockInput = Omit<PublishBlockBody, "projectId">;
+export interface PublishBlockOptions {
+	/** The project the block belongs to. Its versions all stay there. */
+	readonly projectId: string;
+	readonly idempotencyKey?: string;
+}
+export interface ListBlocksFilter {
+	readonly limit?: number;
+	readonly cursor?: string;
+	readonly kind?: BlockKind;
+	/** Prefix match on the block id. */
+	readonly name?: string;
+	/** Only the blocks of this project, or of every project in this org. */
+	readonly scope?: ScopeRef;
+}
+export interface ListBlockVersionsFilter {
+	readonly limit?: number;
+	readonly cursor?: string;
+	/** Include unregistered versions, each with `unregisteredAt`. */
+	readonly includeTombstoned?: boolean;
+}
+export interface BlocksClient {
+	/**
+	 * Publish a block version into a project. Needs `write` on it.
+	 *
+	 * @wire POST /v1/blocks
+	 */
+	publish(input: PublishBlockInput, options: PublishBlockOptions): Promise<PublishBlockResult>;
+	/** @wire GET /v1/blocks */
+	list(filter?: ListBlocksFilter): Promise<BlockPage>;
+	/** @wire GET /v1/blocks/:blockId */
+	get(blockId: string): Promise<Block>;
+	readonly versions: BlockVersionsClient;
+}
+export interface BlockVersionsClient {
+	/** @wire GET /v1/blocks/:blockId/versions */
+	list(blockId: string, filter?: ListBlockVersionsFilter): Promise<BlockPage>;
+	/** @wire GET /v1/blocks/:blockId/versions/:version */
+	get(blockId: string, version: string): Promise<Block>;
+	/** @wire POST /v1/blocks/:blockId/versions/:version/unregister */
+	unregister(blockId: string, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<UnregisterBlockResult>;
+	/** @wire POST /v1/blocks/:blockId/versions/:version/reinstate */
+	reinstate(blockId: string, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<ReinstateBlockResult>;
+}
 /**
  * Capabilities resource — capability declarations + model router +
  * provider configuration.
@@ -9927,6 +11390,16 @@ export type PublishSuiteInput = Omit<PublishEvalSuiteBody, "projectId">;
 export type PublishSuiteResult = PublishEvalSuiteResult;
 export type UnregisterSuiteVersionResult = UnregisterEvalSuiteResult;
 export type ReinstateSuiteVersionResult = ReinstateEvalSuiteVersionResult;
+/** Body of `POST /v1/eval-suites/{suiteId}/versions/from-judgments`. */
+export type BuildFromJudgmentsInput = BuildJudgedSuiteBody;
+export type BuildFromJudgmentsResult = BuildJudgedSuiteResult;
+/** One case of a `judged` suite: a copy of a judged run with its items' judgments summed up. */
+export type SuiteCase = JudgedEvalCase;
+export type SuiteCasePage = JudgedEvalCaseCollectionPage;
+export interface ListSuiteCasesQuery {
+	readonly limit?: number;
+	readonly cursor?: string;
+}
 export interface PublishSuiteOptions {
 	/** Project the suite is published into. `POST /v1/eval-suites` requires it. */
 	readonly projectId: string;
@@ -9958,6 +11431,22 @@ export interface EvalSuitesClient {
 	list(filter?: ListSuitesFilter): Promise<SuitePage>;
 	/** @wire GET /v1/eval-suites/:suiteId */
 	get(suiteId: string): Promise<Suite>;
+	/**
+	 * Publish a `judged` suite version whose cases are copies of judged runs
+	 * of an agent or flow, with each item's judgments summed up. Needs
+	 * `admin` on `input.projectId`.
+	 *
+	 * @wire POST /v1/eval-suites/:suiteId/versions/from-judgments
+	 */
+	buildFromJudgments(suiteId: string, input: BuildFromJudgmentsInput, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<BuildFromJudgmentsResult>;
+	/**
+	 * The cases of a `judged` suite version, in stored order.
+	 *
+	 * @wire GET /v1/eval-suites/:suiteId/versions/:version/cases
+	 */
+	listCases(suiteId: string, version: string, query?: ListSuiteCasesQuery): Promise<SuiteCasePage>;
 	readonly versions: EvalSuiteVersionsClient;
 }
 export interface EvalSuiteVersionsClient {
@@ -10290,6 +11779,114 @@ export interface IdentityUsersClient {
 		readonly idempotencyKey?: string;
 	}): Promise<RevokeSessionsOutcome>;
 }
+/**
+ * Judge classes resource: the deployment's named kinds of judge
+ * ("expert", "user", ...), each with a weight, scoped to the tenant, a
+ * project, or an agent in a project.
+ */
+export interface JudgeClassesClient {
+	/**
+	 * Create a class. Names are unique among the live classes of a scope
+	 * (`409 judge-class-name-taken`).
+	 *
+	 * @wire `POST /v1/judge-classes` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes/post`.
+	 */
+	create(input: CreateJudgeClassInput, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<JudgeClass>;
+	/**
+	 * Live classes, newest first. `scope` narrows to one scope.
+	 *
+	 * @wire `GET /v1/judge-classes` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes/get`.
+	 */
+	list(filter?: JudgeClassFilter): Promise<Page<JudgeClass>>;
+	/**
+	 * One class, also a retired one (`unregisteredAt` set).
+	 *
+	 * @wire `GET /v1/judge-classes/{judgeClassId}` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes~1{judgeClassId}/get`.
+	 */
+	get(judgeClassId: string): Promise<JudgeClass>;
+	/**
+	 * Change a live class's weight or description.
+	 *
+	 * @wire `PATCH /v1/judge-classes/{judgeClassId}` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes~1{judgeClassId}/patch`.
+	 */
+	update(judgeClassId: string, input: UpdateJudgeClassInput, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<JudgeClass>;
+	/**
+	 * Retire a class: no new judgments may name it.
+	 *
+	 * @wire `POST /v1/judge-classes/{judgeClassId}/unregister` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes~1{judgeClassId}~1unregister/post`.
+	 */
+	unregister(judgeClassId: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<void>;
+}
+export interface JudgeClassFilter {
+	readonly limit?: number;
+	readonly cursor?: Cursor;
+	readonly scope?: JudgeClassScope;
+}
+/**
+ * Judgments resource: yes or no, with an optional reason, about one item
+ * of a finished run's output.
+ *
+ * Who judged comes from the token you call with, never from the input.
+ * Judging again as the same caller for the same run, item key and
+ * `participantId` supersedes the earlier judgment, which stays as history.
+ */
+export interface JudgmentsClient {
+	/**
+	 * Judge an item of a finished run.
+	 *
+	 * @wire `POST /v1/judgments` — see `@kindgi/api/openapi.json#/paths/~1v1~1judgments/post`.
+	 */
+	create(input: CreateJudgmentInput, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<Judgment>;
+	/**
+	 * Live judgments, newest first.
+	 *
+	 * @wire `GET /v1/judgments` — see `@kindgi/api/openapi.json#/paths/~1v1~1judgments/get`.
+	 */
+	list(filter?: JudgmentFilter): Promise<Page<Judgment>>;
+	/**
+	 * One judgment with the stored copies of what was judged.
+	 *
+	 * @wire `GET /v1/judgments/{judgmentId}` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judgments~1{judgmentId}/get`.
+	 */
+	get(judgmentId: string): Promise<JudgmentWithCopies>;
+	/**
+	 * Remove a judgment. Unknown ids fail with `404 judgment-not-found`.
+	 *
+	 * @wire `POST /v1/judgments/{judgmentId}/unregister` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judgments~1{judgmentId}~1unregister/post`.
+	 */
+	unregister(judgmentId: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<void>;
+}
+export interface JudgmentFilter {
+	readonly limit?: number;
+	readonly cursor?: Cursor;
+	readonly runId?: string;
+	readonly agentId?: string;
+	/** Needs `agentId`. */
+	readonly agentVersion?: string;
+	readonly flowId?: string;
+	readonly verdict?: Verdict;
+	readonly judgeClassId?: string;
+	readonly participantId?: string;
+	/** Narrow to a project (or org). */
+	readonly scope?: ScopeRef;
+}
 /**
  * MCP resource — Model Context Protocol interop.
  *
@@ -11104,6 +12701,10 @@ export interface ListRunsFilter {
 	readonly topLevel?: boolean;
 	/** Only this agent's turns, at any version (turns from before 0.1.3 don't name their agent). */
 	readonly agentId?: AgentId | string;
+	/** Replay runs (an eval run re-running a past run): `exclude` (the default) leaves them out, `include` lists them too, `only` lists just them. */
+	readonly replays?: "exclude" | "include" | "only";
+	/** Only the replay runs of this eval run (implies replays are included). */
+	readonly evalRunId?: string;
 	/** Include each run's `output` (omitted from lists by default). */
 	readonly includeOutput?: boolean;
 }
@@ -12198,7 +13799,11 @@ export interface KindgiClient {
 	readonly compliance: ComplianceClient;
 	readonly audit: AuditResourceClient;
 	readonly evalSuites: EvalSuitesClient;
+	/** Data blocks: versioned prompts and settings an agent version pins. */
+	readonly blocks: BlocksClient;
 	readonly evalRuns: EvalRunsClient;
+	readonly judgments: JudgmentsClient;
+	readonly judgeClasses: JudgeClassesClient;
 	readonly users: UsersClient;
 	readonly identity: IdentityClient;
 	readonly auth: AuthClient;