@kindgi/client 0.1.4-rc.1 → 0.1.4-rc.3

package/dist/index.d.cts

@@ -243,6 +243,20 @@ export interface VersionDerivation {
 	/** For an edit: who made it (`user:<id>`, or the token for a key). */
 	readonly by?: string;
 }
+/**
+ * What every list call answers: the wire's page — `data`, `hasMore` and
+ * `nextCursor` — as the API and the Python client have it. `items` is the
+ * same list under the name the client used first: readable, but not an
+ * own enumerable property, so a page serializes with its list once.
+ */
+export interface ListPage<T> extends Page<T> {
+	readonly data: readonly T[];
+	/** Whether there's another page (`nextCursor` names it). */
+	readonly hasMore: boolean;
+	readonly nextCursor?: Cursor;
+	/** @deprecated Use `data`; removed in 0.2. */
+	readonly items: readonly T[];
+}
 /** Terminal states are `completed`, `failed`, `cancelled`. */
 export type RunStatus = "pending" | "running" | "suspended" | "completed" | "failed" | "cancelled";
 /**
@@ -1176,7 +1190,7 @@ export interface SourceRefresh {
  * configured once per type in the memory implementation. There is no
  * per-fact retrieval hint.
  */
-export interface Fact<TContent = unknown> {
+interface Fact<TContent = unknown> {
 	readonly id: FactId;
 	/**
 	 * Fact type identifier. Packs define their own; a few general-purpose
@@ -1226,7 +1240,7 @@ declare const REVIEWER_ROLES: readonly [
 	"senior",
 	"admin"
 ];
-export type ReviewerRole = (typeof REVIEWER_ROLES)[number];
+type ReviewerRole = (typeof REVIEWER_ROLES)[number];
 /** A tool's gate, and the reviewer role its approvals need. */
 export interface ToolHitlRule {
 	readonly mode: ToolHitlMode;
@@ -1268,8 +1282,8 @@ type AgentId$1 = Brand<string, "AgentId">;
  *   - `system`    — a system-authored instruction (rare; e.g. HITL
  *                   intervention, out-of-band context injection).
  */
-export type MessageRole = "user" | "agent" | "tool" | "system";
-export interface ConversationMessage {
+type MessageRole = "user" | "agent" | "tool" | "system";
+interface ConversationMessage {
 	/**
 	 * Monotonic index within the conversation. Assigned by the writer.
 	 * Combined with `conversationId` this gives a stable ordering
@@ -1880,7 +1894,7 @@ export interface CheckResult {
 	readonly attributes?: Readonly<Record<string, unknown>>;
 }
 /** Result of evaluating a guardrail against a trace, including action to take. */
-export interface EvaluationResult {
+interface EvaluationResult {
 	readonly guardrailId: GuardrailId;
 	readonly result: CheckResult;
 	/** The action the caller should apply — pre-computed from `guardrail.action`. */
@@ -3390,6 +3404,74 @@ export interface Policy {
 export type PolicyKind = "access-control" | "model-routing" | "adapter-allowlist" | "rate-limit" | "retention" | "compliance" | "tool-errors" | "hitl";
 /** @deprecated The wire has no policy status; policies are selected by `kind`. */
 export type PolicyStatus = "draft" | "active" | "archived";
+/**
+ * A tombstoning domain a `retention` policy can cover; `*` is the
+ * tenant-wide default. Wire enum — matches
+ * `@kindgi/api/openapi.json#RetentionDomain`.
+ */
+export type RetentionDomain = "org" | "agent" | "flow" | "tool" | "eval_suite" | "guardrail" | "mcp_endpoint" | "env" | "secret" | "run" | "policy" | "judgment" | "judge_class" | "provider" | "*";
+/**
+ * One tombstoned row and when a sweep purges it. Matches
+ * `@kindgi/api/openapi.json#RetentionScheduledItem`.
+ */
+export interface RetentionScheduledItem {
+	readonly domain: RetentionDomain;
+	/** The row's id in its domain. */
+	readonly id: string;
+	readonly unregisteredAt: string;
+	/** `unregisteredAt` plus the policy's grace. */
+	readonly purgeAt: string;
+	/** Whether a sweep would purge it now. */
+	readonly pastGrace: boolean;
+	/** The retention policy that applies. */
+	readonly policyId: string;
+	readonly policyVersion: string;
+	/** `-1`: a hold, never purged. */
+	readonly graceSeconds: number;
+}
+/**
+ * A domain more than one retention policy covers. Publishing refuses a
+ * second policy for a domain (`409 policy-scope-taken`), so only
+ * policies stored before that rule can do this. Matches
+ * `@kindgi/api/openapi.json#RetentionPolicyConflict`.
+ */
+export interface RetentionPolicyConflict {
+	readonly domain: RetentionDomain;
+	/** Every policy id that covers the domain, sorted. */
+	readonly policyIds: readonly string[];
+	/**
+	 * The one that applies: the policy whose latest version is highest,
+	 * and on equal versions the lower policy id. Unregister the others.
+	 */
+	readonly appliedPolicyId: string;
+}
+/** Matches `@kindgi/api/openapi.json#RetentionScheduledPage`. */
+export interface RetentionScheduledPage {
+	readonly data: readonly RetentionScheduledItem[];
+	/** Some domain has more scheduled rows than this page returned (`limit` is per domain). */
+	readonly hasMore: boolean;
+	/** Pass as `cursor` for the next page. Absent when `hasMore` is false, or the runtime can't continue. */
+	readonly nextCursor?: string;
+	/** Covered domains this deployment can't purge (no adapter). */
+	readonly domainsMissingAdapter: readonly RetentionDomain[];
+	/** Domains no retention policy covers: their tombstones are kept. */
+	readonly unpolicedDomains: readonly RetentionDomain[];
+	readonly conflicts?: readonly RetentionPolicyConflict[];
+}
+/** Matches `@kindgi/api/openapi.json#RetentionSweepResult`. */
+export interface RetentionSweepResult {
+	readonly perDomain: readonly {
+		readonly domain: RetentionDomain;
+		readonly purged: number;
+		/** Rows past grace this call left (the `maxPerDomain` cap); sweep again. */
+		readonly remaining: number;
+		readonly policyId?: string;
+		/** This deployment can't purge the domain (no adapter). */
+		readonly missingAdapter?: true;
+	}[];
+	readonly totalPurged: number;
+	readonly conflicts?: readonly RetentionPolicyConflict[];
+}
 /**
  * Wire body for `POST /v1/policies` per
  * `@kindgi/api/openapi.json#PublishPolicyBody`: `{ kind, description,
@@ -3932,6 +4014,18 @@ export type JudgeClassScope = {
 	readonly projectId: string;
 	readonly agentId: string;
 };
+/**
+ * Who may assert a judge class. Each field narrows it; a caller must meet
+ * all that are set. Matches `@kindgi/api/openapi.json#JudgeClassAssertableBy`.
+ */
+export interface JudgeClassAssertableBy {
+	/** The lowest reviewer role that may assert it: `standard`, `senior` or `admin`. */
+	readonly minReviewerRole?: "standard" | "senior" | "admin";
+	/** People (`user`), service tokens (`service`), or both. */
+	readonly principalKinds?: readonly ("user" | "service")[];
+	/** Only these user or token ids. */
+	readonly principalIds?: readonly string[];
+}
 /** Matches `@kindgi/api/openapi.json#JudgeClass`. */
 export interface JudgeClass {
 	readonly id: string;
@@ -3942,6 +4036,8 @@ export interface JudgeClass {
 	/** How much a judgment of this class counts, relative to the others (≥ 0). */
 	readonly weight: number;
 	readonly description?: string;
+	/** Who may assert it; absent: anyone who may judge the run. */
+	readonly assertableBy?: JudgeClassAssertableBy;
 	readonly createdAt: Timestamp;
 	readonly updatedAt: Timestamp;
 	/** Set when the class was retired. */
@@ -3953,11 +4049,14 @@ export interface CreateJudgeClassInput {
 	readonly name: string;
 	readonly weight: number;
 	readonly description?: string;
+	readonly assertableBy?: JudgeClassAssertableBy;
 }
 /** Input for `PATCH /v1/judge-classes/{judgeClassId}` per `#UpdateJudgeClassBody`. */
 export interface UpdateJudgeClassInput {
 	readonly weight?: number;
 	readonly description?: string;
+	/** A new restriction; `null` lifts it. */
+	readonly assertableBy?: JudgeClassAssertableBy | null;
 }
 /** What a judged run ran: an agent at a version, or a flow at a version. */
 export interface JudgedSubject {
@@ -3991,6 +4090,11 @@ export interface Judgment {
 	readonly reason?: string;
 	/** Absent when the judgment is unclassified (it counts with weight 1). */
 	readonly judgeClassId?: string;
+	/**
+	 * `true` when the class was restricted (`assertableBy`) when the judgment
+	 * was recorded, so the judge was checked against it.
+	 */
+	readonly restricted?: true;
 	readonly assertedBy: JudgmentAssertedBy;
 	/** An app's opaque id for its end user who judged, when it judged on their behalf. */
 	readonly participantId?: string;
@@ -4063,14 +4167,16 @@ export interface Transport {
 	 */
 	authHeaders(): Readonly<Record<string, string>>;
 }
+/** One query parameter's value: an array repeats the key (`segment=a&segment=b`). */
+export type QueryValue = string | number | boolean | readonly string[] | undefined;
 export interface TransportRequest {
 	readonly method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 	/** Path beginning with `/` (e.g. `/v1/agents`). Combined with `apiUrl`. */
 	readonly path: string;
 	/** JSON body (serialized here). Omitted for `GET`/`DELETE` without body. */
 	readonly body?: unknown;
-	/** Query parameters. `undefined` values are dropped. */
-	readonly query?: Readonly<Record<string, string | number | boolean | undefined>>;
+	/** Query parameters. `undefined` values are dropped; an array repeats its key, in order. */
+	readonly query?: Readonly<Record<string, QueryValue>>;
 	/** Extra headers merged after `Authorization` + `Content-Type`. */
 	readonly headers?: Readonly<Record<string, string>>;
 	/** Overrides the client-level timeout. */
@@ -4125,7 +4231,7 @@ export interface AdaptersClient {
 	 * @wire `GET /v1/adapters` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1adapters/get`.
 	 */
-	list(filter?: AdapterFilter): Promise<Page<Adapter>>;
+	list(filter?: AdapterFilter): Promise<ListPage<Adapter>>;
 	/**
 	 * Fetch a single wired adapter.
 	 *
@@ -4224,6 +4330,45 @@ declare namespace Schemas {
 	export type HealthResult = {
 		ok: true;
 	};
+	/**
+	 * The agent's default for the whole tenant.
+	 */
+	export type LiveScopeTenant = {
+		kind: "tenant";
+	};
+	/**
+	 * An org's projects.
+	 */
+	export type LiveScopeOrg = {
+		kind: "org";
+		orgId: string;
+	};
+	/**
+	 * One project.
+	 */
+	export type LiveScopeProject = {
+		kind: "project";
+		projectId: string;
+	};
+	export type ScopeSegment = {
+		/**
+		 * Lowercase, like an identifier: `company`, `contact-role`.
+		 */
+		key: string;
+		value: string;
+	};
+	/**
+	 * A segment path within a project: it covers every run whose path starts with it.
+	 */
+	export type LiveScopeSegment = {
+		kind: "segment";
+		projectId: string;
+		path: Array<ScopeSegment>;
+	};
+	/**
+	 * Where a live version is pinned, from least to most specific: tenant, org, project, segment path. A run takes the most specific pin that covers it.
+	 */
+	export type LiveScope = LiveScopeTenant | LiveScopeOrg | LiveScopeProject | LiveScopeSegment;
 	/**
 	 * Set on an agent's turn (an agent run, or the turn a flow's agent step started): the agent, the version that ran and the conversation. Absent on other runs, and on turns that ran before Kindgi 0.1.3.
 	 */
@@ -4237,6 +4382,241 @@ declare namespace Schemas {
 		 */
 		version: string;
 		conversationId: string;
+		/**
+		 * Why this version ran: named by the caller (`explicit`); held by the flow version a flow's agent step runs in (`flow-pin`: the node's `config.version`, else the version the flow version pinned when it was published); the conversation's own (`conversation`); the version live for the run's scope (`live`); or the latest, nothing being live (`latest`). Absent on runs from before Kindgi 0.1.4.
+		 */
+		via?: "explicit" | "flow-pin" | "conversation" | "live" | "latest";
+		liveScope?: LiveScope;
+	};
+	export type LiveVersionResolution = {
+		agentId: string;
+		/**
+		 * The version a run would use (semver).
+		 */
+		version: string;
+		/**
+		 * A live pin chose it, or nothing is live on the way up and it is the latest.
+		 */
+		via: "live" | "latest";
+		liveScope?: LiveScope;
+	};
+	export type LivePin = {
+		agentId: string;
+		scope: LiveScope;
+		version: string;
+		/**
+		 * The promotion that set it.
+		 */
+		promotionId: string;
+		setAt: string;
+	};
+	export type LivePinList = {
+		data: Array<LivePin>;
+	};
+	export type GatePolicyRef = {
+		id: string;
+		version: string;
+	};
+	/**
+	 * One of a gate's checks, as the promotion records it.
+	 */
+	export type GateCheck = {
+		/**
+		 * Stable: `comparison.required`, `comparison.status`, `comparison.freshness`, `comparison.suite`, `sameContents`, `baselineIsLive`, `scopeCovered`, `evidence.<metric>.minCases|minWeight|baselineMinCases|baselineMinWeight`, `metric.<metric>.k|minCandidate|maxDrop`, `replay.maxDiverged|maxErrors|maxRefusedWrites|maxStopped`, `classWeights.restrictedOnly`.
+		 */
+		name: string;
+		passed: boolean;
+		/**
+		 * A plain sentence: what was found against what the policy asks.
+		 */
+		message: string;
+		value?: number | string;
+		threshold?: number | string;
+	};
+	/**
+	 * One change of a scope's live version, kept for good: what was live before, what is after, who asked and why.
+	 */
+	export type Promotion = {
+		id: string;
+		agentId: string;
+		scope: LiveScope;
+		action: "promote" | "rollback" | "unpin";
+		/**
+		 * The scope's own pin before; null when it had none.
+		 */
+		fromVersion: string | null;
+		/**
+		 * The scope's own pin after; null after an unpin.
+		 */
+		toVersion: string | null;
+		requestedBy: {
+			kind: "user" | "service";
+			id: string;
+		};
+		reason?: string;
+		/**
+		 * The comparison the change was judged on.
+		 */
+		evalRunId?: string;
+		createdAt: string;
+		/**
+		 * A `promote` row's state: it changes once, from `pending-approval` to its final state. Absent on rollback and unpin rows, and on promotions made before gates (`promoted`).
+		 */
+		status?: "promoted" | "pending-approval" | "refused" | "superseded" | "rejected" | "expired";
+		/**
+		 * The gate policy that applied; null when none did. Absent before gates.
+		 */
+		policy?: GatePolicyRef | null;
+		checks?: Array<GateCheck>;
+		/**
+		 * The approval a `pending-approval` promotion waits on (kept once decided).
+		 */
+		approvalId?: string;
+		/**
+		 * When a `pending-approval` promotion reached its final state.
+		 */
+		resolvedAt?: string;
+	};
+	export type PromotionPage = {
+		data: Array<Promotion>;
+		hasMore: boolean;
+		nextCursor?: string;
+	};
+	/**
+	 * The approval a passing promotion waits for.
+	 */
+	export type GateApproval = {
+		role: "standard" | "senior" | "admin";
+		count: number;
+		/**
+		 * Whoever asked for the promotion may not approve it.
+		 */
+		separateApprover: boolean;
+	};
+	/**
+	 * What a promotion must show. Every part is optional; an empty spec checks nothing. A promotion must name a comparison (`evalRunId`) exactly when the spec has `comparison`, `evidence`, `metrics`, `replay` or `onlyRestrictedClasses`. Unknown keys are refused.
+	 */
+	export type GatePolicySpec = Partial<{
+		comparison: Partial<{
+			maxAgeHours: number;
+			suite: {
+				id: string;
+				version?: string;
+			};
+		}>;
+		/**
+		 * The judged evidence behind each gated metric; for a metric with `maxDrop`, the baseline's too.
+		 */
+		evidence: Partial<{
+			minCases: number;
+			minWeight: number;
+		}>;
+		metrics: Array<{
+			name: "weightedYesShare" | "judgedCoverage" | "weightedPrecisionAtK";
+			/**
+			 * `weightedPrecisionAtK` only: the summary's `k` must be this.
+			 */
+			k?: number;
+			minCandidate?: number;
+			/**
+			 * How far the candidate may fall below the baseline (the live version).
+			 */
+			maxDrop?: number;
+		}>;
+		/**
+		 * Each knob left out of the block is 0. No block: no replay checks.
+		 */
+		replay: Partial<{
+			maxDiverged: number;
+			maxErrors: number;
+			maxRefusedWrites: number;
+			maxStopped: number;
+		}>;
+		/**
+		 * A passing promotion waits for a reviewer.
+		 */
+		approvals: Partial<{
+			/**
+			 * Default `senior`.
+			 */
+			role: "standard" | "senior" | "admin";
+			/**
+			 * Default `true`.
+			 */
+			separateApprover: boolean;
+		}>;
+		/**
+		 * Only restricted judge classes count: the comparison must be weighted `restricted-only`, so a class anyone may assert can't move the gate.
+		 */
+		onlyRestrictedClasses: boolean;
+	}>;
+	export type GatePolicy = {
+		id: string;
+		version: string;
+		agentId: string;
+		scope: LiveScope;
+		spec: GatePolicySpec;
+		description?: string;
+		createdAt: string;
+		unregisteredAt?: string;
+	};
+	export type GatePolicyPage = {
+		data: Array<GatePolicy>;
+		hasMore: boolean;
+		nextCursor?: string;
+	};
+	export type PublishGatePolicyBody = {
+		/**
+		 * Yours to choose, e.g. `acme.drafting-prod`.
+		 */
+		id: string;
+		version: string;
+		agentId: string;
+		scope: LiveScope;
+		spec: GatePolicySpec;
+		description?: string;
+	};
+	export type GatePolicyResolution = {
+		/**
+		 * The policy that gates a promotion for the scope; null when none does.
+		 */
+		policy: GatePolicy | null;
+	};
+	/**
+	 * What the gate would say about a promotion. Nothing is recorded.
+	 */
+	export type PromotionCheck = {
+		outcome: "would-promote" | "needs-approval" | "gate-failed";
+		/**
+		 * The policy that applies; null when none does.
+		 */
+		policy: GatePolicyRef | null;
+		checks: Array<GateCheck>;
+		approval?: GateApproval;
+	};
+	export type PromoteBody = {
+		/**
+		 * The agent version to make live (registered, active).
+		 */
+		version: string;
+		scope: LiveScope;
+		reason?: string;
+		/**
+		 * The comparison this promotion was judged on.
+		 */
+		evalRunId?: string;
+	};
+	export type RollbackBody = {
+		scope: LiveScope;
+		/**
+		 * An earlier version to go back to; omit → the scope's previous live version.
+		 */
+		toVersion?: string;
+		reason?: string;
+	};
+	export type UnpinBody = {
+		scope: LiveScope;
+		reason?: string;
 	};
 	/**
 	 * Agents and tools a flow runs at other exact versions than the flow version's pins ("this flow, with `acme.scorer` at 0.4.0"), without publishing a new flow version: a comparison's flow candidate (`versions` on the start body and the run's `comparison`), and the flow runs that replay it (a run's `versions`). Each id must be an agent or tool the flow uses.
@@ -4291,6 +4671,10 @@ declare namespace Schemas {
 		 */
 		evalRunId?: string;
 		versions?: FlowVersionOverrides;
+		/**
+		 * The segment path the run was started with (coarse to fine), which picks live agent versions. A child run has its parent's. Absent when there was none.
+		 */
+		segments?: Array<ScopeSegment>;
 		/**
 		 * Only in the response to `POST /v1/runs`, when the deployment issues public run tokens: a read-only token for this run (and its descendants) to hand to a browser, for `GET /v1/runs/{runId}/progress` and its stream.
 		 */
@@ -4309,13 +4693,17 @@ declare namespace Schemas {
 		 */
 		agent: string;
 		/**
-		 * Semver; omit → latest.
+		 * Semver. Omit → the conversation's own version for a follow-up turn, else the version live for the run's scope, else the latest.
 		 */
 		agentVersion?: string;
 		/**
 		 * Project to run under; omit → the tenant's Default project.
 		 */
 		projectId?: string;
+		/**
+		 * The run's segment path below its project, coarse to fine (an app-defined finer scope, e.g. company then role). A version live on a prefix of it serves the run.
+		 */
+		segments?: Array<ScopeSegment>;
 		/**
 		 * Opaque payload forwarded to the agent binding.
 		 */
@@ -4343,6 +4731,10 @@ declare namespace Schemas {
 		 * Project to run under; omit → the tenant's Default project.
 		 */
 		projectId?: string;
+		/**
+		 * The run's segment path below its project, coarse to fine (an app-defined finer scope, e.g. company then role). A version live on a prefix of it serves the run.
+		 */
+		segments?: Array<ScopeSegment>;
 		/**
 		 * Opaque payload forwarded to the flow runtime.
 		 */
@@ -4409,6 +4801,10 @@ declare namespace Schemas {
 			 */
 			evalRunId?: string;
 			versions?: FlowVersionOverrides;
+			/**
+			 * The segment path the run was started with (coarse to fine), which picks live agent versions. A child run has its parent's. Absent when there was none.
+			 */
+			segments?: Array<ScopeSegment>;
 			/**
 			 * Only in the response to `POST /v1/runs`, when the deployment issues public run tokens: a read-only token for this run (and its descendants) to hand to a browser, for `GET /v1/runs/{runId}/progress` and its stream.
 			 */
@@ -4724,6 +5120,16 @@ declare namespace Schemas {
 		 * True when the approval had a `waitTokenId` + terminal accept/reject and the run waitpoint was completed as part of this call.
 		 */
 		waitpointResolved: boolean;
+		/**
+		 * How the run went on, when this call resumed it (the runtime resumes inline): `ok`, or `failed` with the run's error, e.g. `tool-version-unresolvable` when a tool version the turn started with is gone. The decision stands either way.
+		 */
+		resume?: {
+			kind: "ok";
+		} | {
+			kind: "failed";
+			code: string;
+			message: string;
+		};
 	};
 	/**
 	 * Reviewer roster row. Deactivation is soft (audit trail survives offboarding). `deactivatedAt` present → reviewer no longer receives approvals.
@@ -4851,6 +5257,23 @@ declare namespace Schemas {
 		projectId: string;
 		agentId: string;
 	};
+	/**
+	 * Who may assert the class: every part that is set must hold. A class with one is restricted: a judgment recorded while it is carries `restricted`, and a comparison weighted `restricted-only` counts only those.
+	 */
+	export type JudgeClassAssertableBy = Partial<{
+		/**
+		 * The caller's reviewer role is at least this (its token's, or the roster's).
+		 */
+		minReviewerRole: "standard" | "senior" | "admin";
+		/**
+		 * Users, service tokens, or both.
+		 */
+		principalKinds: Array<"user" | "service">;
+		/**
+		 * Only these principals: user ids, or service token ids.
+		 */
+		principalIds: Array<string>;
+	}>;
 	export type JudgeClass = {
 		id: string;
 		tenantId: string;
@@ -4864,6 +5287,7 @@ declare namespace Schemas {
 		 */
 		weight: number;
 		description?: string;
+		assertableBy?: JudgeClassAssertableBy;
 		createdAt: string;
 		updatedAt: string;
 		/**
@@ -4884,10 +5308,15 @@ declare namespace Schemas {
 		name: string;
 		weight: number;
 		description?: string;
+		assertableBy?: JudgeClassAssertableBy;
 	};
 	export type UpdateJudgeClassBody = Partial<{
 		weight: number;
 		description: string;
+		/**
+		 * Who may assert the class; `null` lifts the restriction.
+		 */
+		assertableBy: JudgeClassAssertableBy | null;
 	}>;
 	export type UnregisterJudgeClassResult = {
 		judgeClassId: string;
@@ -4941,6 +5370,7 @@ declare namespace Schemas {
 		 * The judge class the judgment is recorded under. Absent when unclassified (counts with weight 1).
 		 */
 		judgeClassId?: string;
+		restricted?: true;
 		assertedBy: JudgmentAssertedBy;
 		/**
 		 * The app's opaque id for its end user who judged, when an app judged on their behalf.
@@ -5090,6 +5520,13 @@ declare namespace Schemas {
 		 * The weight behind all judgments of the item.
 		 */
 		totalWeight: number;
+		/**
+		 * The same weights, counting only judgments recorded while their class was restricted (`Judgment.restricted`), for a comparison weighted `restricted-only`. Absent from a test set built before restrictions.
+		 */
+		restricted?: {
+			yesWeight: number;
+			totalWeight: number;
+		};
 		/**
 		 * The reasons given, newest first.
 		 */
@@ -6919,7 +7356,7 @@ declare namespace Schemas {
 		kind: PolicyKind;
 		description?: string;
 		/**
-		 * Kind-specific policy body. For `access-control`, matches `@kindgi/specs/policy.schema.json` (rules + defaults). For `model-routing`, matches `TenantPolicy` from `@kindgi/capabilities` (providers.allow / providers.deny / models.allow / models.deny / regionAllow / maxCostPerCallUsd / maxTokensPerCall). For `tool-errors`, `ToolErrorsSpec` (maxRetries / retryOn). For `hitl`, `HitlSpec` from `@kindgi/policy-contract` (maxTimeoutMs / minReviewerRole / tools — per tool id a mode or `{ mode, requiredRole }`); it only tightens an agent's approvals. `tool-errors` and `hitl` specs are validated on publish. For other kinds, the shape is defined by the runtime consumer.
+		 * Kind-specific policy body. For `access-control`, matches `@kindgi/specs/policy.schema.json` (rules + defaults). For `model-routing`, matches `TenantPolicy` from `@kindgi/capabilities` (providers.allow / providers.deny / models.allow / models.deny / regionAllow / maxCostPerCallUsd / maxTokensPerCall). For `tool-errors`, `ToolErrorsSpec` (maxRetries / retryOn). For `hitl`, `HitlSpec` from `@kindgi/policy-contract` (maxTimeoutMs / minReviewerRole / tools — per tool id a mode or `{ mode, requiredRole }`); it only tightens an agent's approvals. For `retention`, `{ v: 1, doc: RetentionSpec }` from `@kindgi/policy-contract` (domain / graceSeconds / mode, which must be `purge`); a tenant has one retention policy per domain, plus one for `*`. `tool-errors`, `hitl` and `retention` specs are validated on publish. For other kinds, the shape is defined by the runtime consumer.
 		 */
 		spec: Record<string, unknown>;
 	};
@@ -6938,7 +7375,7 @@ declare namespace Schemas {
 		kind: PolicyKind;
 		description?: string;
 		/**
-		 * Kind-specific policy body. For `access-control`, matches `@kindgi/specs/policy.schema.json` (rules + defaults). For `model-routing`, matches `TenantPolicy` from `@kindgi/capabilities` (providers.allow / providers.deny / models.allow / models.deny / regionAllow / maxCostPerCallUsd / maxTokensPerCall). For `tool-errors`, `ToolErrorsSpec` (maxRetries / retryOn). For `hitl`, `HitlSpec` from `@kindgi/policy-contract` (maxTimeoutMs / minReviewerRole / tools — per tool id a mode or `{ mode, requiredRole }`); it only tightens an agent's approvals. `tool-errors` and `hitl` specs are validated on publish. For other kinds, the shape is defined by the runtime consumer.
+		 * Kind-specific policy body. For `access-control`, matches `@kindgi/specs/policy.schema.json` (rules + defaults). For `model-routing`, matches `TenantPolicy` from `@kindgi/capabilities` (providers.allow / providers.deny / models.allow / models.deny / regionAllow / maxCostPerCallUsd / maxTokensPerCall). For `tool-errors`, `ToolErrorsSpec` (maxRetries / retryOn). For `hitl`, `HitlSpec` from `@kindgi/policy-contract` (maxTimeoutMs / minReviewerRole / tools — per tool id a mode or `{ mode, requiredRole }`); it only tightens an agent's approvals. For `retention`, `{ v: 1, doc: RetentionSpec }` from `@kindgi/policy-contract` (domain / graceSeconds / mode, which must be `purge`); a tenant has one retention policy per domain, plus one for `*`. `tool-errors`, `hitl` and `retention` specs are validated on publish. For other kinds, the shape is defined by the runtime consumer.
 		 */
 		spec: Record<string, unknown>;
 		/**
@@ -6976,6 +7413,99 @@ declare namespace Schemas {
 		version: string;
 		wasTombstoned: boolean;
 	};
+	export type RetentionDomain = "org" | "agent" | "flow" | "tool" | "eval_suite" | "guardrail" | "mcp_endpoint" | "env" | "secret" | "run" | "policy" | "judgment" | "judge_class" | "provider" | "*";
+	export type RetentionPolicyConflict = {
+		domain: RetentionDomain;
+		/**
+		 * Every policy id that covers the domain, sorted.
+		 */
+		policyIds: Array<string>;
+		/**
+		 * The one that applies: the policy whose latest version is highest, and on equal versions the lower policy id. Unregister the others.
+		 */
+		appliedPolicyId: string;
+	};
+	export type RetentionScheduledItem = {
+		domain: RetentionDomain;
+		/**
+		 * The tombstoned row's id in its domain.
+		 */
+		id: string;
+		unregisteredAt: string;
+		/**
+		 * `unregisteredAt` plus the policy's grace: when a sweep purges the row.
+		 */
+		purgeAt: string;
+		/**
+		 * Whether a sweep would purge the row now.
+		 */
+		pastGrace: boolean;
+		/**
+		 * The retention policy that applies.
+		 */
+		policyId: string;
+		policyVersion: string;
+		/**
+		 * The policy's grace, in seconds (`-1`: a hold, never purged).
+		 */
+		graceSeconds: number;
+	};
+	export type RetentionScheduledPage = {
+		data: Array<RetentionScheduledItem>;
+		/**
+		 * Some domain has more scheduled rows than this page returned (`limit` is per domain). Always sent from 0.1.4; a runtime before it sends none.
+		 */
+		hasMore?: boolean;
+		/**
+		 * The `cursor` for the next page. Absent when `hasMore: false`, or when the runtime cannot continue a page.
+		 */
+		nextCursor?: string;
+		/**
+		 * Domains a retention policy covers that this deployment can't purge (no adapter is wired).
+		 */
+		domainsMissingAdapter: Array<RetentionDomain>;
+		/**
+		 * Domains no retention policy covers: their tombstones are kept.
+		 */
+		unpolicedDomains: Array<RetentionDomain>;
+		/**
+		 * Domains more than one retention policy covers. Absent or empty: none.
+		 */
+		conflicts?: Array<RetentionPolicyConflict>;
+	};
+	export type RetentionSweepBody = Partial<{
+		domain: RetentionDomain;
+		/**
+		 * The most rows one call purges per domain (default 500); the rest are `remaining`.
+		 */
+		maxPerDomain: number;
+	}>;
+	export type RetentionSweepDomainBody = Partial<{
+		/**
+		 * The most rows this call purges (default 500); the rest are `remaining`.
+		 */
+		maxPerDomain: number;
+	}>;
+	export type RetentionSweepResult = {
+		perDomain: Array<{
+			domain: RetentionDomain;
+			purged: number;
+			/**
+			 * Rows past grace this call left (the `maxPerDomain` cap); sweep again.
+			 */
+			remaining: number;
+			/**
+			 * The retention policy that applied.
+			 */
+			policyId?: string;
+			missingAdapter?: true;
+		}>;
+		totalPurged: number;
+		/**
+		 * Domains more than one retention policy covers. Absent or empty: none.
+		 */
+		conflicts?: Array<RetentionPolicyConflict>;
+	};
 	export type EvalKind = "accuracy" | "pairwise" | "regression" | "human-review" | "benchmark" | "custom" | "judged";
 	export type EvalSuite = {
 		id: string;
@@ -7108,7 +7638,7 @@ declare namespace Schemas {
 		version?: string;
 	};
 	/**
-	 * What a comparison compares the candidate against: `'recorded'` (each case's recorded output, what was judged), a version (`{ agentId, version }`, replayed under the same rules), or the version live in a scope (`{ live: { projectId?, segments? } }`). Only `'recorded'` runs today; the others are refused when the run starts.
+	 * What a comparison compares the candidate against: `'recorded'` (each case's recorded output, what was judged), a version (`{ agentId, version }`, replayed under the same rules), or the version live in a scope (`{ live: { projectId?, segments? } }`, `segments` a path in the project, coarse to fine). Only `'recorded'` runs today; the others are refused when the run starts.
 	 */
 	export type EvalBaseline = "recorded" | {
 		agentId: string;
@@ -7116,7 +7646,10 @@ declare namespace Schemas {
 	} | {
 		live: Partial<{
 			projectId: string;
-			segments: Record<string, string>;
+			/**
+			 * A segment path in `projectId`, coarse to fine, as live versions resolve it. Needs `projectId`.
+			 */
+			segments: Array<ScopeSegment>;
 		}>;
 	};
 	/**
@@ -7131,6 +7664,10 @@ declare namespace Schemas {
 		repetitions: number;
 		k: number;
 		versions?: FlowVersionOverrides;
+		/**
+		 * Which judgments count: each at its class's weight (`as-recorded`, the default), or only those recorded while their class was restricted (`Judgment.restricted`), the others weighing 0 (`restricted-only`).
+		 */
+		classWeights?: "as-recorded" | "restricted-only";
 	};
 	/**
 	 * One metric, the recorded runs beside the candidate. `null` where a side had no judged evidence; `n` / `weight` are the candidate's evidence (cases with judged items, and the judgment weight behind them), `baselineN` / `baselineWeight` the recorded side's.
@@ -7160,6 +7697,10 @@ declare namespace Schemas {
 		kind: "agent";
 		agentId: string;
 		version: string;
+		/**
+		 * The version's pinsDigest: what it ran, as a promotion gate checks. Absent for a version published before pins, and from a comparison recorded before it.
+		 */
+		pinsDigest?: string;
 	} | {
 		kind: "flow";
 		flowId: string;
@@ -7220,7 +7761,11 @@ declare namespace Schemas {
 		 */
 		stopped: number;
 		reads: "recorded" | "live";
-		sampling: {
+		/**
+		 * Which judgments counted. Absent from a comparison recorded before restricted classes: `as-recorded`.
+		 */
+		classWeights?: "as-recorded" | "restricted-only";
+		sampling: {
 			/**
 			 * The models that answered the candidate's replays, and how many replays each.
 			 */
@@ -7366,6 +7911,10 @@ declare namespace Schemas {
 		repetitions?: number;
 		k?: number;
 		versions?: FlowVersionOverrides;
+		/**
+		 * Which judgments count: each at its class's weight (`as-recorded`, the default), or only those recorded while their class was restricted (`Judgment.restricted`), the others weighing 0 (`restricted-only`).
+		 */
+		classWeights?: "as-recorded" | "restricted-only";
 	};
 	export type StartEvalRunResult = {
 		runId: string;
@@ -7412,6 +7961,10 @@ declare namespace Schemas {
 	};
 	export type IdentityProviderCollectionPage = {
 		data: Array<IdentityProviderConfig>;
+		/**
+		 * Always `false`: the list comes whole. Absent from older servers.
+		 */
+		hasMore?: boolean;
 	};
 	export type RegisterIdentityProviderResult = {
 		providerId: string;
@@ -8031,6 +8584,10 @@ declare namespace Schemas {
 	};
 	export type EnvCollectionPage = {
 		data: Array<EnvRecord>;
+		/**
+		 * Whether there's another page. Absent from older servers: there is one when `nextCursor` is set.
+		 */
+		hasMore?: boolean;
 		nextCursor?: string;
 	};
 	export type EnvSetRequest = {
@@ -8046,10 +8603,18 @@ declare namespace Schemas {
 	};
 	export type SecretCollectionPage = {
 		data: Array<SecretRecord>;
+		/**
+		 * Whether there's another page. Absent from older servers: there is one when `nextCursor` is set.
+		 */
+		hasMore?: boolean;
 		nextCursor?: string;
 	};
 	export type SecretVersionCollectionPage = {
 		data: Array<SecretVersionRecord>;
+		/**
+		 * Whether there's another page. Absent from older servers: there is one when `nextCursor` is set.
+		 */
+		hasMore?: boolean;
 		nextCursor?: string;
 	};
 	export type SecretSetRequest = {
@@ -8421,8 +8986,645 @@ declare namespace Schemas {
 	};
 	// </Schemas>
 }
+export type ScopeSegment = Schemas.ScopeSegment;
+declare const ScopeSegment: z.ZodObject<{
+	key: z.ZodString;
+	value: z.ZodString;
+}, z.core.$strict>;
+export type LiveScope = Schemas.LiveScope;
+declare const LiveScope: z.ZodDiscriminatedUnion<[
+	z.ZodObject<{
+		kind: z.ZodLiteral<"tenant">;
+	}, z.core.$strict>,
+	z.ZodObject<{
+		kind: z.ZodLiteral<"org">;
+		orgId: z.ZodUUID;
+	}, z.core.$strict>,
+	z.ZodObject<{
+		kind: z.ZodLiteral<"project">;
+		projectId: z.ZodUUID;
+	}, z.core.$strict>,
+	z.ZodObject<{
+		kind: z.ZodLiteral<"segment">;
+		projectId: z.ZodUUID;
+		path: z.ZodArray<z.ZodObject<{
+			key: z.ZodString;
+			value: z.ZodString;
+		}, z.core.$strict>>;
+	}, z.core.$strict>
+], "kind">;
+export type LiveVersionResolution = Schemas.LiveVersionResolution;
+declare const LiveVersionResolution: z.ZodObject<{
+	agentId: z.ZodString;
+	version: z.ZodString;
+	via: z.ZodEnum<{
+		live: "live";
+		latest: "latest";
+	}>;
+	liveScope: z.ZodOptional<z.ZodDiscriminatedUnion<[
+		z.ZodObject<{
+			kind: z.ZodLiteral<"tenant">;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"org">;
+			orgId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"project">;
+			projectId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"segment">;
+			projectId: z.ZodUUID;
+			path: z.ZodArray<z.ZodObject<{
+				key: z.ZodString;
+				value: z.ZodString;
+			}, z.core.$strict>>;
+		}, z.core.$strict>
+	], "kind">>;
+}, z.core.$strict>;
+export type LivePin = Schemas.LivePin;
+declare const LivePin: z.ZodObject<{
+	agentId: z.ZodString;
+	scope: z.ZodDiscriminatedUnion<[
+		z.ZodObject<{
+			kind: z.ZodLiteral<"tenant">;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"org">;
+			orgId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"project">;
+			projectId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"segment">;
+			projectId: z.ZodUUID;
+			path: z.ZodArray<z.ZodObject<{
+				key: z.ZodString;
+				value: z.ZodString;
+			}, z.core.$strict>>;
+		}, z.core.$strict>
+	], "kind">;
+	version: z.ZodString;
+	promotionId: z.ZodUUID;
+	setAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type LivePinList = Schemas.LivePinList;
+declare const LivePinList: z.ZodObject<{
+	data: z.ZodArray<z.ZodObject<{
+		agentId: z.ZodString;
+		scope: z.ZodDiscriminatedUnion<[
+			z.ZodObject<{
+				kind: z.ZodLiteral<"tenant">;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"org">;
+				orgId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"project">;
+				projectId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"segment">;
+				projectId: z.ZodUUID;
+				path: z.ZodArray<z.ZodObject<{
+					key: z.ZodString;
+					value: z.ZodString;
+				}, z.core.$strict>>;
+			}, z.core.$strict>
+		], "kind">;
+		version: z.ZodString;
+		promotionId: z.ZodUUID;
+		setAt: z.ZodISODateTime;
+	}, z.core.$strict>>;
+}, z.core.$strict>;
+export type GatePolicyRef = Schemas.GatePolicyRef;
+declare const GatePolicyRef: z.ZodObject<{
+	id: z.ZodString;
+	version: z.ZodString;
+}, z.core.$strict>;
+export type GateCheck = Schemas.GateCheck;
+declare const GateCheck: z.ZodObject<{
+	name: z.ZodString;
+	passed: z.ZodBoolean;
+	message: z.ZodString;
+	value: z.ZodOptional<z.ZodUnion<readonly [
+		z.ZodNumber,
+		z.ZodString
+	]>>;
+	threshold: z.ZodOptional<z.ZodUnion<readonly [
+		z.ZodNumber,
+		z.ZodString
+	]>>;
+}, z.core.$strict>;
+export type Promotion = Schemas.Promotion;
+declare const Promotion: z.ZodObject<{
+	id: z.ZodUUID;
+	agentId: z.ZodString;
+	scope: z.ZodDiscriminatedUnion<[
+		z.ZodObject<{
+			kind: z.ZodLiteral<"tenant">;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"org">;
+			orgId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"project">;
+			projectId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"segment">;
+			projectId: z.ZodUUID;
+			path: z.ZodArray<z.ZodObject<{
+				key: z.ZodString;
+				value: z.ZodString;
+			}, z.core.$strict>>;
+		}, z.core.$strict>
+	], "kind">;
+	action: z.ZodEnum<{
+		promote: "promote";
+		rollback: "rollback";
+		unpin: "unpin";
+	}>;
+	fromVersion: z.ZodNullable<z.ZodString>;
+	toVersion: z.ZodNullable<z.ZodString>;
+	requestedBy: z.ZodObject<{
+		kind: z.ZodEnum<{
+			user: "user";
+			service: "service";
+		}>;
+		id: z.ZodString;
+	}, z.core.$strict>;
+	reason: z.ZodOptional<z.ZodString>;
+	evalRunId: z.ZodOptional<z.ZodString>;
+	createdAt: z.ZodISODateTime;
+	status: z.ZodOptional<z.ZodEnum<{
+		rejected: "rejected";
+		expired: "expired";
+		promoted: "promoted";
+		"pending-approval": "pending-approval";
+		refused: "refused";
+		superseded: "superseded";
+	}>>;
+	policy: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+	}, z.core.$strict>>>;
+	checks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+		name: z.ZodString;
+		passed: z.ZodBoolean;
+		message: z.ZodString;
+		value: z.ZodOptional<z.ZodUnion<readonly [
+			z.ZodNumber,
+			z.ZodString
+		]>>;
+		threshold: z.ZodOptional<z.ZodUnion<readonly [
+			z.ZodNumber,
+			z.ZodString
+		]>>;
+	}, z.core.$strict>>>;
+	approvalId: z.ZodOptional<z.ZodString>;
+	resolvedAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type PromotionPage = Schemas.PromotionPage;
+declare const PromotionPage: z.ZodObject<{
+	data: z.ZodArray<z.ZodObject<{
+		id: z.ZodUUID;
+		agentId: z.ZodString;
+		scope: z.ZodDiscriminatedUnion<[
+			z.ZodObject<{
+				kind: z.ZodLiteral<"tenant">;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"org">;
+				orgId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"project">;
+				projectId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"segment">;
+				projectId: z.ZodUUID;
+				path: z.ZodArray<z.ZodObject<{
+					key: z.ZodString;
+					value: z.ZodString;
+				}, z.core.$strict>>;
+			}, z.core.$strict>
+		], "kind">;
+		action: z.ZodEnum<{
+			promote: "promote";
+			rollback: "rollback";
+			unpin: "unpin";
+		}>;
+		fromVersion: z.ZodNullable<z.ZodString>;
+		toVersion: z.ZodNullable<z.ZodString>;
+		requestedBy: z.ZodObject<{
+			kind: z.ZodEnum<{
+				user: "user";
+				service: "service";
+			}>;
+			id: z.ZodString;
+		}, z.core.$strict>;
+		reason: z.ZodOptional<z.ZodString>;
+		evalRunId: z.ZodOptional<z.ZodString>;
+		createdAt: z.ZodISODateTime;
+		status: z.ZodOptional<z.ZodEnum<{
+			rejected: "rejected";
+			expired: "expired";
+			promoted: "promoted";
+			"pending-approval": "pending-approval";
+			refused: "refused";
+			superseded: "superseded";
+		}>>;
+		policy: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+			id: z.ZodString;
+			version: z.ZodString;
+		}, z.core.$strict>>>;
+		checks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+			name: z.ZodString;
+			passed: z.ZodBoolean;
+			message: z.ZodString;
+			value: z.ZodOptional<z.ZodUnion<readonly [
+				z.ZodNumber,
+				z.ZodString
+			]>>;
+			threshold: z.ZodOptional<z.ZodUnion<readonly [
+				z.ZodNumber,
+				z.ZodString
+			]>>;
+		}, z.core.$strict>>>;
+		approvalId: z.ZodOptional<z.ZodString>;
+		resolvedAt: z.ZodOptional<z.ZodISODateTime>;
+	}, z.core.$strict>>;
+	hasMore: z.ZodBoolean;
+	nextCursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type GateApproval = Schemas.GateApproval;
+declare const GateApproval: z.ZodObject<{
+	role: z.ZodEnum<{
+		standard: "standard";
+		senior: "senior";
+		admin: "admin";
+	}>;
+	count: z.ZodNumber;
+	separateApprover: z.ZodBoolean;
+}, z.core.$strict>;
+export type GatePolicySpec = Schemas.GatePolicySpec;
+declare const GatePolicySpec: z.ZodObject<{
+	comparison: z.ZodOptional<z.ZodObject<{
+		maxAgeHours: z.ZodOptional<z.ZodNumber>;
+		suite: z.ZodOptional<z.ZodObject<{
+			id: z.ZodString;
+			version: z.ZodOptional<z.ZodString>;
+		}, z.core.$strict>>;
+	}, z.core.$strict>>;
+	evidence: z.ZodOptional<z.ZodObject<{
+		minCases: z.ZodOptional<z.ZodNumber>;
+		minWeight: z.ZodOptional<z.ZodNumber>;
+	}, z.core.$strict>>;
+	metrics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+		name: z.ZodEnum<{
+			weightedYesShare: "weightedYesShare";
+			judgedCoverage: "judgedCoverage";
+			weightedPrecisionAtK: "weightedPrecisionAtK";
+		}>;
+		k: z.ZodOptional<z.ZodNumber>;
+		minCandidate: z.ZodOptional<z.ZodNumber>;
+		maxDrop: z.ZodOptional<z.ZodNumber>;
+	}, z.core.$strict>>>;
+	replay: z.ZodOptional<z.ZodObject<{
+		maxDiverged: z.ZodOptional<z.ZodNumber>;
+		maxErrors: z.ZodOptional<z.ZodNumber>;
+		maxRefusedWrites: z.ZodOptional<z.ZodNumber>;
+		maxStopped: z.ZodOptional<z.ZodNumber>;
+	}, z.core.$strict>>;
+	approvals: z.ZodOptional<z.ZodObject<{
+		role: z.ZodOptional<z.ZodEnum<{
+			standard: "standard";
+			senior: "senior";
+			admin: "admin";
+		}>>;
+		separateApprover: z.ZodOptional<z.ZodBoolean>;
+	}, z.core.$strict>>;
+	onlyRestrictedClasses: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type GatePolicy = Schemas.GatePolicy;
+declare const GatePolicy: z.ZodObject<{
+	id: z.ZodString;
+	version: z.ZodString;
+	agentId: z.ZodString;
+	scope: z.ZodDiscriminatedUnion<[
+		z.ZodObject<{
+			kind: z.ZodLiteral<"tenant">;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"org">;
+			orgId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"project">;
+			projectId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"segment">;
+			projectId: z.ZodUUID;
+			path: z.ZodArray<z.ZodObject<{
+				key: z.ZodString;
+				value: z.ZodString;
+			}, z.core.$strict>>;
+		}, z.core.$strict>
+	], "kind">;
+	spec: z.ZodObject<{
+		comparison: z.ZodOptional<z.ZodObject<{
+			maxAgeHours: z.ZodOptional<z.ZodNumber>;
+			suite: z.ZodOptional<z.ZodObject<{
+				id: z.ZodString;
+				version: z.ZodOptional<z.ZodString>;
+			}, z.core.$strict>>;
+		}, z.core.$strict>>;
+		evidence: z.ZodOptional<z.ZodObject<{
+			minCases: z.ZodOptional<z.ZodNumber>;
+			minWeight: z.ZodOptional<z.ZodNumber>;
+		}, z.core.$strict>>;
+		metrics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+			name: z.ZodEnum<{
+				weightedYesShare: "weightedYesShare";
+				judgedCoverage: "judgedCoverage";
+				weightedPrecisionAtK: "weightedPrecisionAtK";
+			}>;
+			k: z.ZodOptional<z.ZodNumber>;
+			minCandidate: z.ZodOptional<z.ZodNumber>;
+			maxDrop: z.ZodOptional<z.ZodNumber>;
+		}, z.core.$strict>>>;
+		replay: z.ZodOptional<z.ZodObject<{
+			maxDiverged: z.ZodOptional<z.ZodNumber>;
+			maxErrors: z.ZodOptional<z.ZodNumber>;
+			maxRefusedWrites: z.ZodOptional<z.ZodNumber>;
+			maxStopped: z.ZodOptional<z.ZodNumber>;
+		}, z.core.$strict>>;
+		approvals: z.ZodOptional<z.ZodObject<{
+			role: z.ZodOptional<z.ZodEnum<{
+				standard: "standard";
+				senior: "senior";
+				admin: "admin";
+			}>>;
+			separateApprover: z.ZodOptional<z.ZodBoolean>;
+		}, z.core.$strict>>;
+		onlyRestrictedClasses: z.ZodOptional<z.ZodBoolean>;
+	}, z.core.$strict>;
+	description: z.ZodOptional<z.ZodString>;
+	createdAt: z.ZodISODateTime;
+	unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type GatePolicyPage = Schemas.GatePolicyPage;
+declare const GatePolicyPage: z.ZodObject<{
+	data: z.ZodArray<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+		agentId: z.ZodString;
+		scope: z.ZodDiscriminatedUnion<[
+			z.ZodObject<{
+				kind: z.ZodLiteral<"tenant">;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"org">;
+				orgId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"project">;
+				projectId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"segment">;
+				projectId: z.ZodUUID;
+				path: z.ZodArray<z.ZodObject<{
+					key: z.ZodString;
+					value: z.ZodString;
+				}, z.core.$strict>>;
+			}, z.core.$strict>
+		], "kind">;
+		spec: z.ZodObject<{
+			comparison: z.ZodOptional<z.ZodObject<{
+				maxAgeHours: z.ZodOptional<z.ZodNumber>;
+				suite: z.ZodOptional<z.ZodObject<{
+					id: z.ZodString;
+					version: z.ZodOptional<z.ZodString>;
+				}, z.core.$strict>>;
+			}, z.core.$strict>>;
+			evidence: z.ZodOptional<z.ZodObject<{
+				minCases: z.ZodOptional<z.ZodNumber>;
+				minWeight: z.ZodOptional<z.ZodNumber>;
+			}, z.core.$strict>>;
+			metrics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+				name: z.ZodEnum<{
+					weightedYesShare: "weightedYesShare";
+					judgedCoverage: "judgedCoverage";
+					weightedPrecisionAtK: "weightedPrecisionAtK";
+				}>;
+				k: z.ZodOptional<z.ZodNumber>;
+				minCandidate: z.ZodOptional<z.ZodNumber>;
+				maxDrop: z.ZodOptional<z.ZodNumber>;
+			}, z.core.$strict>>>;
+			replay: z.ZodOptional<z.ZodObject<{
+				maxDiverged: z.ZodOptional<z.ZodNumber>;
+				maxErrors: z.ZodOptional<z.ZodNumber>;
+				maxRefusedWrites: z.ZodOptional<z.ZodNumber>;
+				maxStopped: z.ZodOptional<z.ZodNumber>;
+			}, z.core.$strict>>;
+			approvals: z.ZodOptional<z.ZodObject<{
+				role: z.ZodOptional<z.ZodEnum<{
+					standard: "standard";
+					senior: "senior";
+					admin: "admin";
+				}>>;
+				separateApprover: z.ZodOptional<z.ZodBoolean>;
+			}, z.core.$strict>>;
+			onlyRestrictedClasses: z.ZodOptional<z.ZodBoolean>;
+		}, z.core.$strict>;
+		description: z.ZodOptional<z.ZodString>;
+		createdAt: z.ZodISODateTime;
+		unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+	}, z.core.$strict>>;
+	hasMore: z.ZodBoolean;
+	nextCursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type PublishGatePolicyBody = Schemas.PublishGatePolicyBody;
+declare const PublishGatePolicyBody: z.ZodObject<{
+	id: z.ZodString;
+	version: z.ZodString;
+	agentId: z.ZodString;
+	scope: z.ZodDiscriminatedUnion<[
+		z.ZodObject<{
+			kind: z.ZodLiteral<"tenant">;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"org">;
+			orgId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"project">;
+			projectId: z.ZodUUID;
+		}, z.core.$strict>,
+		z.ZodObject<{
+			kind: z.ZodLiteral<"segment">;
+			projectId: z.ZodUUID;
+			path: z.ZodArray<z.ZodObject<{
+				key: z.ZodString;
+				value: z.ZodString;
+			}, z.core.$strict>>;
+		}, z.core.$strict>
+	], "kind">;
+	spec: z.ZodObject<{
+		comparison: z.ZodOptional<z.ZodObject<{
+			maxAgeHours: z.ZodOptional<z.ZodNumber>;
+			suite: z.ZodOptional<z.ZodObject<{
+				id: z.ZodString;
+				version: z.ZodOptional<z.ZodString>;
+			}, z.core.$strict>>;
+		}, z.core.$strict>>;
+		evidence: z.ZodOptional<z.ZodObject<{
+			minCases: z.ZodOptional<z.ZodNumber>;
+			minWeight: z.ZodOptional<z.ZodNumber>;
+		}, z.core.$strict>>;
+		metrics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+			name: z.ZodEnum<{
+				weightedYesShare: "weightedYesShare";
+				judgedCoverage: "judgedCoverage";
+				weightedPrecisionAtK: "weightedPrecisionAtK";
+			}>;
+			k: z.ZodOptional<z.ZodNumber>;
+			minCandidate: z.ZodOptional<z.ZodNumber>;
+			maxDrop: z.ZodOptional<z.ZodNumber>;
+		}, z.core.$strict>>>;
+		replay: z.ZodOptional<z.ZodObject<{
+			maxDiverged: z.ZodOptional<z.ZodNumber>;
+			maxErrors: z.ZodOptional<z.ZodNumber>;
+			maxRefusedWrites: z.ZodOptional<z.ZodNumber>;
+			maxStopped: z.ZodOptional<z.ZodNumber>;
+		}, z.core.$strict>>;
+		approvals: z.ZodOptional<z.ZodObject<{
+			role: z.ZodOptional<z.ZodEnum<{
+				standard: "standard";
+				senior: "senior";
+				admin: "admin";
+			}>>;
+			separateApprover: z.ZodOptional<z.ZodBoolean>;
+		}, z.core.$strict>>;
+		onlyRestrictedClasses: z.ZodOptional<z.ZodBoolean>;
+	}, z.core.$strict>;
+	description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type GatePolicyResolution = Schemas.GatePolicyResolution;
+declare const GatePolicyResolution: z.ZodObject<{
+	policy: z.ZodNullable<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+		agentId: z.ZodString;
+		scope: z.ZodDiscriminatedUnion<[
+			z.ZodObject<{
+				kind: z.ZodLiteral<"tenant">;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"org">;
+				orgId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"project">;
+				projectId: z.ZodUUID;
+			}, z.core.$strict>,
+			z.ZodObject<{
+				kind: z.ZodLiteral<"segment">;
+				projectId: z.ZodUUID;
+				path: z.ZodArray<z.ZodObject<{
+					key: z.ZodString;
+					value: z.ZodString;
+				}, z.core.$strict>>;
+			}, z.core.$strict>
+		], "kind">;
+		spec: z.ZodObject<{
+			comparison: z.ZodOptional<z.ZodObject<{
+				maxAgeHours: z.ZodOptional<z.ZodNumber>;
+				suite: z.ZodOptional<z.ZodObject<{
+					id: z.ZodString;
+					version: z.ZodOptional<z.ZodString>;
+				}, z.core.$strict>>;
+			}, z.core.$strict>>;
+			evidence: z.ZodOptional<z.ZodObject<{
+				minCases: z.ZodOptional<z.ZodNumber>;
+				minWeight: z.ZodOptional<z.ZodNumber>;
+			}, z.core.$strict>>;
+			metrics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+				name: z.ZodEnum<{
+					weightedYesShare: "weightedYesShare";
+					judgedCoverage: "judgedCoverage";
+					weightedPrecisionAtK: "weightedPrecisionAtK";
+				}>;
+				k: z.ZodOptional<z.ZodNumber>;
+				minCandidate: z.ZodOptional<z.ZodNumber>;
+				maxDrop: z.ZodOptional<z.ZodNumber>;
+			}, z.core.$strict>>>;
+			replay: z.ZodOptional<z.ZodObject<{
+				maxDiverged: z.ZodOptional<z.ZodNumber>;
+				maxErrors: z.ZodOptional<z.ZodNumber>;
+				maxRefusedWrites: z.ZodOptional<z.ZodNumber>;
+				maxStopped: z.ZodOptional<z.ZodNumber>;
+			}, z.core.$strict>>;
+			approvals: z.ZodOptional<z.ZodObject<{
+				role: z.ZodOptional<z.ZodEnum<{
+					standard: "standard";
+					senior: "senior";
+					admin: "admin";
+				}>>;
+				separateApprover: z.ZodOptional<z.ZodBoolean>;
+			}, z.core.$strict>>;
+			onlyRestrictedClasses: z.ZodOptional<z.ZodBoolean>;
+		}, z.core.$strict>;
+		description: z.ZodOptional<z.ZodString>;
+		createdAt: z.ZodISODateTime;
+		unregisteredAt: z.ZodOptional<z.ZodISODateTime>;
+	}, z.core.$strict>>;
+}, z.core.$strict>;
+export type PromotionCheck = Schemas.PromotionCheck;
+declare const PromotionCheck: z.ZodObject<{
+	outcome: z.ZodEnum<{
+		"would-promote": "would-promote";
+		"needs-approval": "needs-approval";
+		"gate-failed": "gate-failed";
+	}>;
+	policy: z.ZodNullable<z.ZodObject<{
+		id: z.ZodString;
+		version: z.ZodString;
+	}, z.core.$strict>>;
+	checks: z.ZodArray<z.ZodObject<{
+		name: z.ZodString;
+		passed: z.ZodBoolean;
+		message: z.ZodString;
+		value: z.ZodOptional<z.ZodUnion<readonly [
+			z.ZodNumber,
+			z.ZodString
+		]>>;
+		threshold: z.ZodOptional<z.ZodUnion<readonly [
+			z.ZodNumber,
+			z.ZodString
+		]>>;
+	}, z.core.$strict>>;
+	approval: z.ZodOptional<z.ZodObject<{
+		role: z.ZodEnum<{
+			standard: "standard";
+			senior: "senior";
+			admin: "admin";
+		}>;
+		count: z.ZodNumber;
+		separateApprover: z.ZodBoolean;
+	}, z.core.$strict>>;
+}, z.core.$strict>;
 export type RunProgress = Schemas.RunProgress;
-export declare const RunProgress: z.ZodObject<{
+declare const RunProgress: z.ZodObject<{
 	id: z.ZodUUID;
 	flowId: z.ZodString;
 	flowVersion: z.ZodString;
@@ -8439,7 +9641,7 @@ export declare const RunProgress: z.ZodObject<{
 	completedAt: z.ZodOptional<z.ZodISODateTime>;
 	parentRunId: z.ZodOptional<z.ZodUUID>;
 }, z.core.$strict>;
-export type TrustedSigningKey = Schemas.TrustedSigningKey;
+type TrustedSigningKey = Schemas.TrustedSigningKey;
 declare const TrustedSigningKey: z.ZodObject<{
 	keyId: z.ZodString;
 	tenantId: z.ZodUUID;
@@ -8472,7 +9674,7 @@ declare const TrustedSigningKeyPage: z.ZodObject<{
 	nextCursor: z.ZodOptional<z.ZodString>;
 	hasMore: z.ZodBoolean;
 }, z.core.$strict>;
-export type RevokeSigningKeyResult = Schemas.RevokeSigningKeyResult;
+type RevokeSigningKeyResult = Schemas.RevokeSigningKeyResult;
 declare const RevokeSigningKeyResult: z.ZodObject<{
 	keyId: z.ZodString;
 	revoked: z.ZodBoolean;
@@ -8537,6 +9739,10 @@ declare const JudgedEvalCase: z.ZodObject<{
 		no: z.ZodNumber;
 		yesWeight: z.ZodNumber;
 		totalWeight: z.ZodNumber;
+		restricted: z.ZodOptional<z.ZodObject<{
+			yesWeight: z.ZodNumber;
+			totalWeight: z.ZodNumber;
+		}, z.core.$strict>>;
 		reasons: z.ZodArray<z.ZodObject<{
 			verdict: z.ZodEnum<{
 				yes: "yes";
@@ -8596,6 +9802,10 @@ declare const JudgedEvalCaseCollectionPage: z.ZodObject<{
 			no: z.ZodNumber;
 			yesWeight: z.ZodNumber;
 			totalWeight: z.ZodNumber;
+			restricted: z.ZodOptional<z.ZodObject<{
+				yesWeight: z.ZodNumber;
+				totalWeight: z.ZodNumber;
+			}, z.core.$strict>>;
 			reasons: z.ZodArray<z.ZodObject<{
 				verdict: z.ZodEnum<{
 					yes: "yes";
@@ -9095,12 +10305,12 @@ declare const ReinstateEvalSuiteVersionResult: z.ZodObject<{
 	wasTombstoned: z.ZodBoolean;
 }, z.core.$strict>;
 export type BlockKind = Schemas.BlockKind;
-export declare const BlockKind: z.ZodEnum<{
+declare const BlockKind: z.ZodEnum<{
 	prompt: "prompt";
 	settings: "settings";
 }>;
 export type Block = Schemas.Block;
-export declare const Block: z.ZodObject<{
+declare const Block: z.ZodObject<{
 	id: z.ZodString;
 	version: z.ZodString;
 	kind: z.ZodEnum<{
@@ -9204,18 +10414,18 @@ declare const PublishBlockBody: z.ZodObject<{
 	]>;
 }, z.core.$strict>;
 export type PublishBlockResult = Schemas.PublishBlockResult;
-export declare const PublishBlockResult: z.ZodObject<{
+declare const PublishBlockResult: z.ZodObject<{
 	blockId: z.ZodString;
 	version: z.ZodString;
 }, z.core.$strict>;
 export type UnregisterBlockResult = Schemas.UnregisterBlockResult;
-export declare const UnregisterBlockResult: z.ZodObject<{
+declare const UnregisterBlockResult: z.ZodObject<{
 	blockId: z.ZodString;
 	version: z.ZodString;
 	unregistered: z.ZodLiteral<true>;
 }, z.core.$strict>;
 export type ReinstateBlockResult = Schemas.ReinstateBlockResult;
-export declare const ReinstateBlockResult: z.ZodObject<{
+declare const ReinstateBlockResult: z.ZodObject<{
 	blockId: z.ZodString;
 	version: z.ZodString;
 	wasTombstoned: z.ZodBoolean;
@@ -9229,7 +10439,7 @@ declare const EvalRunStatus: z.ZodEnum<{
 	cancelled: "cancelled";
 }>;
 export type ComparisonMetric = Schemas.ComparisonMetric;
-export declare const ComparisonMetric: z.ZodObject<{
+declare const ComparisonMetric: z.ZodObject<{
 	baseline: z.ZodNullable<z.ZodNumber>;
 	candidate: z.ZodNullable<z.ZodNumber>;
 	delta: z.ZodNullable<z.ZodNumber>;
@@ -9242,11 +10452,12 @@ export declare const ComparisonMetric: z.ZodObject<{
 	spread: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type ComparisonCandidate = Schemas.ComparisonCandidate;
-export declare const ComparisonCandidate: z.ZodUnion<readonly [
+declare const ComparisonCandidate: z.ZodUnion<readonly [
 	z.ZodObject<{
 		kind: z.ZodLiteral<"agent">;
 		agentId: z.ZodString;
 		version: z.ZodString;
+		pinsDigest: z.ZodOptional<z.ZodString>;
 	}, z.core.$strict>,
 	z.ZodObject<{
 		kind: z.ZodLiteral<"flow">;
@@ -9259,7 +10470,7 @@ export declare const ComparisonCandidate: z.ZodUnion<readonly [
 	}, z.core.$strict>
 ]>;
 export type JudgedComparisonSummary = Schemas.JudgedComparisonSummary;
-export declare const JudgedComparisonSummary: z.ZodObject<{
+declare const JudgedComparisonSummary: z.ZodObject<{
 	evalRunId: z.ZodString;
 	status: z.ZodEnum<{
 		failed: "failed";
@@ -9276,6 +10487,7 @@ export declare const JudgedComparisonSummary: z.ZodObject<{
 			kind: z.ZodLiteral<"agent">;
 			agentId: z.ZodString;
 			version: z.ZodString;
+			pinsDigest: z.ZodOptional<z.ZodString>;
 		}, z.core.$strict>,
 		z.ZodObject<{
 			kind: z.ZodLiteral<"flow">;
@@ -9302,8 +10514,8 @@ export declare const JudgedComparisonSummary: z.ZodObject<{
 			agentId: z.ZodString;
 			version: z.ZodString;
 			via: z.ZodEnum<{
-				live: "live";
 				explicit: "explicit";
+				live: "live";
 			}>;
 			liveScope: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 		}, z.core.$strict>
@@ -9317,9 +10529,13 @@ export declare const JudgedComparisonSummary: z.ZodObject<{
 	errors: z.ZodNumber;
 	stopped: z.ZodNumber;
 	reads: z.ZodEnum<{
-		recorded: "recorded";
 		live: "live";
+		recorded: "recorded";
 	}>;
+	classWeights: z.ZodOptional<z.ZodEnum<{
+		"as-recorded": "as-recorded";
+		"restricted-only": "restricted-only";
+	}>>;
 	sampling: z.ZodObject<{
 		models: z.ZodArray<z.ZodObject<{
 			providerId: z.ZodString;
@@ -9368,7 +10584,7 @@ export declare const JudgedComparisonSummary: z.ZodObject<{
 	}, z.core.$strict>;
 }, z.core.$strict>;
 export type ComparisonCaseResult = Schemas.ComparisonCaseResult;
-export declare const ComparisonCaseResult: z.ZodObject<{
+declare const ComparisonCaseResult: z.ZodObject<{
 	caseId: z.ZodString;
 	runIds: z.ZodArray<z.ZodString>;
 	baseline: z.ZodObject<{
@@ -9414,9 +10630,9 @@ export declare const ComparisonCaseResult: z.ZodObject<{
 		toolVersion: z.ZodString;
 		arguments: z.ZodUnknown;
 		source: z.ZodEnum<{
-			recorded: "recorded";
 			live: "live";
 			refused: "refused";
+			recorded: "recorded";
 		}>;
 		reason: z.ZodOptional<z.ZodString>;
 	}, z.core.$strict>>>;
@@ -9432,7 +10648,7 @@ export declare const ComparisonCaseResult: z.ZodObject<{
 	}, z.core.$strict>>;
 }, z.core.$strict>;
 export type JudgedComparisonResult = Schemas.JudgedComparisonResult;
-export declare const JudgedComparisonResult: z.ZodObject<{
+declare const JudgedComparisonResult: z.ZodObject<{
 	summary: z.ZodObject<{
 		evalRunId: z.ZodString;
 		status: z.ZodEnum<{
@@ -9450,6 +10666,7 @@ export declare const JudgedComparisonResult: z.ZodObject<{
 				kind: z.ZodLiteral<"agent">;
 				agentId: z.ZodString;
 				version: z.ZodString;
+				pinsDigest: z.ZodOptional<z.ZodString>;
 			}, z.core.$strict>,
 			z.ZodObject<{
 				kind: z.ZodLiteral<"flow">;
@@ -9476,8 +10693,8 @@ export declare const JudgedComparisonResult: z.ZodObject<{
 				agentId: z.ZodString;
 				version: z.ZodString;
 				via: z.ZodEnum<{
-					live: "live";
 					explicit: "explicit";
+					live: "live";
 				}>;
 				liveScope: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 			}, z.core.$strict>
@@ -9491,9 +10708,13 @@ export declare const JudgedComparisonResult: z.ZodObject<{
 		errors: z.ZodNumber;
 		stopped: z.ZodNumber;
 		reads: z.ZodEnum<{
-			recorded: "recorded";
 			live: "live";
+			recorded: "recorded";
 		}>;
+		classWeights: z.ZodOptional<z.ZodEnum<{
+			"as-recorded": "as-recorded";
+			"restricted-only": "restricted-only";
+		}>>;
 		sampling: z.ZodObject<{
 			models: z.ZodArray<z.ZodObject<{
 				providerId: z.ZodString;
@@ -9587,9 +10808,9 @@ export declare const JudgedComparisonResult: z.ZodObject<{
 			toolVersion: z.ZodString;
 			arguments: z.ZodUnknown;
 			source: z.ZodEnum<{
-				recorded: "recorded";
 				live: "live";
 				refused: "refused";
+				recorded: "recorded";
 			}>;
 			reason: z.ZodOptional<z.ZodString>;
 		}, z.core.$strict>>>;
@@ -9651,13 +10872,16 @@ declare const EvalRun: z.ZodObject<{
 			z.ZodObject<{
 				live: z.ZodObject<{
 					projectId: z.ZodOptional<z.ZodString>;
-					segments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+					segments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+						key: z.ZodString;
+						value: z.ZodString;
+					}, z.core.$strict>>>;
 				}, z.core.$strict>;
 			}, z.core.$strict>
 		]>;
 		reads: z.ZodEnum<{
-			recorded: "recorded";
 			live: "live";
+			recorded: "recorded";
 		}>;
 		repetitions: z.ZodNumber;
 		k: z.ZodNumber;
@@ -9665,6 +10889,10 @@ declare const EvalRun: z.ZodObject<{
 			tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 			agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 		}, z.core.$strict>>;
+		classWeights: z.ZodOptional<z.ZodEnum<{
+			"as-recorded": "as-recorded";
+			"restricted-only": "restricted-only";
+		}>>;
 	}, z.core.$strict>>;
 }, z.core.$strict>;
 export type EvalRunCollectionPage = Schemas.EvalRunCollectionPage;
@@ -9714,13 +10942,16 @@ declare const EvalRunCollectionPage: z.ZodObject<{
 				z.ZodObject<{
 					live: z.ZodObject<{
 						projectId: z.ZodOptional<z.ZodString>;
-						segments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+						segments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+							key: z.ZodString;
+							value: z.ZodString;
+						}, z.core.$strict>>>;
 					}, z.core.$strict>;
 				}, z.core.$strict>
 			]>;
 			reads: z.ZodEnum<{
-				recorded: "recorded";
 				live: "live";
+				recorded: "recorded";
 			}>;
 			repetitions: z.ZodNumber;
 			k: z.ZodNumber;
@@ -9728,6 +10959,10 @@ declare const EvalRunCollectionPage: z.ZodObject<{
 				tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 				agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 			}, z.core.$strict>>;
+			classWeights: z.ZodOptional<z.ZodEnum<{
+				"as-recorded": "as-recorded";
+				"restricted-only": "restricted-only";
+			}>>;
 		}, z.core.$strict>>;
 	}, z.core.$strict>>;
 	nextCursor: z.ZodOptional<z.ZodString>;
@@ -9755,13 +10990,16 @@ declare const StartEvalRunBody: z.ZodObject<{
 		z.ZodObject<{
 			live: z.ZodObject<{
 				projectId: z.ZodOptional<z.ZodString>;
-				segments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+				segments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+					key: z.ZodString;
+					value: z.ZodString;
+				}, z.core.$strict>>>;
 			}, z.core.$strict>;
 		}, z.core.$strict>
 	]>>;
 	reads: z.ZodOptional<z.ZodEnum<{
-		recorded: "recorded";
 		live: "live";
+		recorded: "recorded";
 	}>>;
 	repetitions: z.ZodOptional<z.ZodNumber>;
 	k: z.ZodOptional<z.ZodNumber>;
@@ -9769,6 +11007,10 @@ declare const StartEvalRunBody: z.ZodObject<{
 		tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 		agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 	}, z.core.$strict>>;
+	classWeights: z.ZodOptional<z.ZodEnum<{
+		"as-recorded": "as-recorded";
+		"restricted-only": "restricted-only";
+	}>>;
 }, z.core.$strict>;
 export type StartEvalRunResult = Schemas.StartEvalRunResult;
 declare const StartEvalRunResult: z.ZodObject<{
@@ -9828,6 +11070,7 @@ declare const IdentityProviderCollectionPage: z.ZodObject<{
 		}, z.core.$strict>>;
 		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, z.core.$strict>>;
+	hasMore: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type RegisterIdentityProviderResult = Schemas.RegisterIdentityProviderResult;
 declare const RegisterIdentityProviderResult: z.ZodObject<{
@@ -10453,8 +11696,8 @@ declare const Tenant$1: z.ZodObject<{
 export type TenantConfigKind = Schemas.TenantConfigKind;
 declare const TenantConfigKind: z.ZodEnum<{
 	env: "env";
-	config: "config";
 	secret: "secret";
+	config: "config";
 }>;
 export type TenantConfigCollectionPage = Schemas.TenantConfigCollectionPage;
 declare const TenantConfigCollectionPage: z.ZodObject<{
@@ -10462,8 +11705,8 @@ declare const TenantConfigCollectionPage: z.ZodObject<{
 		tenantId: z.ZodString;
 		kind: z.ZodEnum<{
 			env: "env";
-			config: "config";
 			secret: "secret";
+			config: "config";
 		}>;
 		key: z.ZodString;
 		value: z.ZodString;
@@ -10478,8 +11721,8 @@ export type UpsertTenantConfigBody = Schemas.UpsertTenantConfigBody;
 declare const UpsertTenantConfigBody: z.ZodObject<{
 	kind: z.ZodEnum<{
 		env: "env";
-		config: "config";
 		secret: "secret";
+		config: "config";
 	}>;
 	key: z.ZodString;
 	value: z.ZodString;
@@ -10492,8 +11735,8 @@ declare const UpsertTenantConfigResult: z.ZodObject<{
 		tenantId: z.ZodString;
 		kind: z.ZodEnum<{
 			env: "env";
-			config: "config";
 			secret: "secret";
+			config: "config";
 		}>;
 		key: z.ZodString;
 		value: z.ZodString;
@@ -10693,12 +11936,12 @@ declare const WebhookTriggerUnregisterResult: z.ZodObject<{
 	triggerId: z.ZodString;
 	unregistered: z.ZodBoolean;
 }, z.core.$strict>;
-export type WebhookSecretRef = Schemas.WebhookSecretRef;
+type WebhookSecretRef = Schemas.WebhookSecretRef;
 declare const WebhookSecretRef: z.ZodObject<{
 	envName: z.ZodString;
 	name: z.ZodString;
 }, z.core.$strict>;
-export type WebhookEndpoint = Schemas.WebhookEndpoint;
+type WebhookEndpoint = Schemas.WebhookEndpoint;
 declare const WebhookEndpoint: z.ZodObject<{
 	endpointId: z.ZodString;
 	url: z.ZodURL;
@@ -10716,7 +11959,7 @@ declare const WebhookEndpoint: z.ZodObject<{
 	createdAt: z.ZodISODateTime;
 	updatedAt: z.ZodISODateTime;
 }, z.core.$strict>;
-export type GeneratedWebhookSecret = Schemas.GeneratedWebhookSecret;
+type GeneratedWebhookSecret = Schemas.GeneratedWebhookSecret;
 declare const GeneratedWebhookSecret: z.ZodObject<{
 	secret: z.ZodString;
 }, z.core.$strict>;
@@ -10777,7 +12020,7 @@ declare const WebhookEndpointUnregisterResult: z.ZodObject<{
 	endpointId: z.ZodString;
 	unregistered: z.ZodBoolean;
 }, z.core.$strict>;
-export type RunFinishedEvent = Schemas.RunFinishedEvent;
+type RunFinishedEvent = Schemas.RunFinishedEvent;
 declare const RunFinishedEvent: z.ZodObject<{
 	id: z.ZodString;
 	type: z.ZodLiteral<"run.finished">;
@@ -10811,7 +12054,7 @@ declare const RunFinishedEvent: z.ZodObject<{
 		}, z.core.$strict>;
 	}, z.core.$strict>;
 }, z.core.$strict>;
-export type WebhookTestEvent = Schemas.WebhookTestEvent;
+type WebhookTestEvent = Schemas.WebhookTestEvent;
 declare const WebhookTestEvent: z.ZodObject<{
 	id: z.ZodString;
 	type: z.ZodLiteral<"webhook.test">;
@@ -10820,7 +12063,7 @@ declare const WebhookTestEvent: z.ZodObject<{
 		endpointId: z.ZodString;
 	}, z.core.$strict>;
 }, z.core.$strict>;
-export type WebhookEvent = Schemas.WebhookEvent;
+type WebhookEvent = Schemas.WebhookEvent;
 declare const WebhookEvent: z.ZodDiscriminatedUnion<[
 	z.ZodObject<{
 		id: z.ZodString;
@@ -10864,13 +12107,13 @@ declare const WebhookEvent: z.ZodDiscriminatedUnion<[
 		type: z.ZodLiteral<"webhook.test">;
 	}, z.core.$strict>
 ], "type">;
-export type WebhookDeliveryStatus = Schemas.WebhookDeliveryStatus;
+type WebhookDeliveryStatus = Schemas.WebhookDeliveryStatus;
 declare const WebhookDeliveryStatus: z.ZodEnum<{
 	pending: "pending";
 	failed: "failed";
 	delivered: "delivered";
 }>;
-export type WebhookDelivery = Schemas.WebhookDelivery;
+type WebhookDelivery = Schemas.WebhookDelivery;
 declare const WebhookDelivery: z.ZodObject<{
 	deliveryId: z.ZodString;
 	endpointId: z.ZodString;
@@ -11024,9 +12267,16 @@ export interface AgentsClient {
 	/** @wire GET /v1/agents/:agentId — latest active version */
 	get(agentId: AgentId): Promise<Agent$1>;
 	readonly versions: AgentVersionsClient;
+	/** Which version runs where: live versions per scope, rollback and unpin. */
+	readonly live: AgentLiveClient;
+	/** Making a version live for a scope, and the history of those changes. */
+	readonly promotions: AgentPromotionsClient;
+	/** The gate policy a promotion for a scope is checked against. */
+	readonly gatePolicy: AgentGatePolicyClient;
 	/**
 	 * Un-tombstone a specific previously-unregistered version.
 	 *
+	 * @deprecated Use `agents.versions.reinstate`; removed in 0.2.
 	 * @wire POST /v1/agents/:agentId/versions/:version/reinstate
 	 */
 	reinstateVersion(agentId: AgentId, version: Semver, options?: MutationOptions): Promise<ReinstateAgentVersionResult>;
@@ -11038,12 +12288,19 @@ export interface AgentVersionsClient {
 	get(agentId: AgentId, version: Semver): Promise<Agent$1>;
 	/**
 	 * Tombstone a specific version. Reversible via
-	 * `agents.reinstateVersion`. Unregistering an unknown or
+	 * `agents.versions.reinstate`. Unregistering an unknown or
 	 * already-tombstoned version fails with `404 agent-not-found`.
 	 *
 	 * @wire POST /v1/agents/:agentId/versions/:version/unregister
 	 */
 	unregister(agentId: AgentId, version: Semver, options?: MutationOptions): Promise<UnregisterAgentResult>;
+	/**
+	 * Un-tombstone a specific previously-unregistered version. Idempotent:
+	 * reinstating an active version returns `wasTombstoned: false`.
+	 *
+	 * @wire POST /v1/agents/:agentId/versions/:version/reinstate
+	 */
+	reinstate(agentId: AgentId, version: Semver, options?: MutationOptions): Promise<ReinstateAgentVersionResult>;
 	/**
 	 * Derive a new version from a pinned one with some data-block pins
 	 * swapped (an expert's edit, no code change). Numbered the next free
@@ -11055,6 +12312,104 @@ export interface AgentVersionsClient {
 }
 /** Body of `POST /v1/agents/{agentId}/versions`. */
 export type DeriveAgentVersionInput = DeriveAgentVersionBody;
+/**
+ * Live versions. A run that doesn't name its version uses the live
+ * version of the most specific scope that has one (segment path,
+ * project, org, tenant), else the latest registered version.
+ */
+export interface AgentLiveClient {
+	/**
+	 * The version a run would use for a project and segment path, and why
+	 * (`via: 'live'` with the scope, or `via: 'latest'`).
+	 *
+	 * @wire GET /v1/agents/:agentId/live
+	 */
+	resolve(agentId: AgentId | string, where?: LiveWhere): Promise<LiveVersionResolution>;
+	/** @wire GET /v1/agents/:agentId/live-versions — every scope with a pin */
+	list(agentId: AgentId | string): Promise<LivePinList>;
+	/**
+	 * Back to the scope's previous live version, or `toVersion`.
+	 * `409 nothing-to-roll-back` when there is none; `409 not-pinned`
+	 * when the scope has no pin.
+	 *
+	 * @wire POST /v1/agents/:agentId/live/rollback
+	 */
+	rollback(agentId: AgentId | string, input: RollbackLiveInput, options?: MutationOptions): Promise<Promotion>;
+	/**
+	 * Remove the scope's own pin: its runs use the next scope up.
+	 * `409 not-pinned` when it has none.
+	 *
+	 * @wire POST /v1/agents/:agentId/live/unpin
+	 */
+	unpin(agentId: AgentId | string, input: UnpinLiveInput, options?: MutationOptions): Promise<Promotion>;
+}
+export interface AgentPromotionsClient {
+	/**
+	 * Make `version` live for `scope`, from the next run. Open
+	 * conversations keep their version. `404 agent-version-not-found`
+	 * when the version isn't registered and active.
+	 *
+	 * With a gate policy for the scope, the promotion is checked first,
+	 * against the comparison named by `evalRunId`. The answer's `status`
+	 * says what happened: `promoted`, or `pending-approval` (a reviewer
+	 * must approve it; `approvalId`). A refusal throws a `KindgiApiError`
+	 * whose `error.serverCode` is `gate-failed`, with `promotionId`,
+	 * `policy` and every check in `error.fields`.
+	 *
+	 * @wire POST /v1/agents/:agentId/promotions
+	 */
+	create(agentId: AgentId | string, input: PromoteInput, options?: MutationOptions): Promise<Promotion>;
+	/**
+	 * What `create` with the same input would do, recording nothing:
+	 * `would-promote`, `needs-approval` (with the approval it needs) or
+	 * `gate-failed`, with every check.
+	 *
+	 * @wire POST /v1/agents/:agentId/promotions/check
+	 */
+	check(agentId: AgentId | string, input: PromoteInput): Promise<PromotionCheck>;
+	/** @wire GET /v1/agents/:agentId/promotions — newest first */
+	list(agentId: AgentId | string, filter?: ListPromotionsFilter): Promise<PromotionPage>;
+	/** @wire GET /v1/agents/:agentId/promotions/:promotionId */
+	get(agentId: AgentId | string, promotionId: string): Promise<Promotion>;
+}
+export interface AgentGatePolicyClient {
+	/**
+	 * The gate policy a promotion for `scope` is checked against: the most
+	 * specific scope with one, at its latest active version; `policy: null`
+	 * when none applies.
+	 *
+	 * @wire GET /v1/agents/:agentId/gate-policy
+	 */
+	resolve(agentId: AgentId | string, scope: LiveScope): Promise<GatePolicyResolution>;
+}
+/** Where a run would happen: its project and segment path (coarse to fine). */
+export interface LiveWhere {
+	readonly projectId?: string;
+	readonly segments?: readonly ScopeSegment[];
+}
+export interface PromoteInput {
+	readonly version: string;
+	readonly scope: LiveScope;
+	readonly reason?: string;
+	/** The eval run behind the decision, kept on the record. */
+	readonly evalRunId?: string;
+}
+export interface RollbackLiveInput {
+	readonly scope: LiveScope;
+	/** An earlier version to go back to; default: the scope's previous live version. */
+	readonly toVersion?: string;
+	readonly reason?: string;
+}
+export interface UnpinLiveInput {
+	readonly scope: LiveScope;
+	readonly reason?: string;
+}
+export interface ListPromotionsFilter {
+	/** Only this scope's history. */
+	readonly scope?: LiveScope;
+	readonly limit?: number;
+	readonly cursor?: string;
+}
 export interface ListAgentsFilter {
 	readonly limit?: number;
 	readonly cursor?: string;
@@ -11108,7 +12463,7 @@ export interface ApprovalsClient {
 	 * @wire `GET /v1/approvals` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1approvals/get`. Role-scoped.
 	 */
-	list(filter?: ApprovalFilter): Promise<Page<Approval>>;
+	list(filter?: ApprovalFilter): Promise<ListPage<Approval>>;
 	/**
 	 * @wire `GET /v1/approvals/{approvalId}` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1approvals~1{approvalId}/get`.
@@ -11172,7 +12527,7 @@ export interface ReviewersClient {
 	 * @wire `GET /v1/approvals/reviewers` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1approvals~1reviewers/get`.
 	 */
-	list(filter?: ReviewerFilter): Promise<Page<Reviewer>>;
+	list(filter?: ReviewerFilter): Promise<ListPage<Reviewer>>;
 	/**
 	 * @wire `GET /v1/approvals/reviewers/{reviewerId}` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1approvals~1reviewers~1{reviewerId}/get`.
@@ -11225,7 +12580,7 @@ export interface AuditClient {
 	 * @unwired The API has no `GET /v1/audit-bundles` route — bundles
 	 *   are not stored server-side (see `get`).
 	 */
-	list(filter?: Filter): Promise<Page<AuditBundleMeta>>;
+	list(filter?: Filter): Promise<ListPage<AuditBundleMeta>>;
 	/**
 	 * Verify a bundle's Ed25519 signature client-side.
 	 *
@@ -11246,6 +12601,11 @@ export interface ApprovalFilter extends Omit<Filter<ApprovalStatus>, "status"> {
 	readonly requiredRole?: ReviewerRole$1;
 	/** ISO 8601 timestamp — return approvals created strictly after this. */
 	readonly createdAfter?: Timestamp;
+	/**
+	 * Only approvals linked to one of these run waits (an approval's
+	 * `waitTokenId`; a run's journal names its open waits). At most 50.
+	 */
+	readonly waitTokenIds?: readonly string[];
 }
 export interface ReviewerFilter extends Filter {
 	/** Filter reviewers by role class. */
@@ -11313,7 +12673,7 @@ export interface ArtifactsClient {
 	 * @wire `GET /v1/artifacts` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1artifacts/get`.
 	 */
-	list(filter?: ArtifactFilter): Promise<Page<BlobMeta>>;
+	list(filter?: ArtifactFilter): Promise<ListPage<BlobMeta>>;
 	/**
 	 * Delete an artifact. First delete returns `deleted: true`; a repeat
 	 * against an already-gone id returns `deleted: false` (idempotent —
@@ -11379,6 +12739,8 @@ export interface ListAuthzDecisionsFilter {
 	readonly runId?: string;
 	readonly from?: string;
 	readonly to?: string;
+	/** `asc` (absent): oldest first. `desc`: newest first. */
+	readonly order?: "asc" | "desc";
 }
 export interface AuthzAuditClient {
 	/** @wire GET /v1/audit/authz */
@@ -11387,7 +12749,10 @@ export interface AuthzAuditClient {
 export interface AuditResourceClient {
 	readonly authz: AuthzAuditClient;
 }
-export type IdentityProviderPage = IdentityProviderCollectionPage;
+/** Every identity provider: the list comes whole, so `hasMore` is `false`. */
+export interface IdentityProviderPage extends IdentityProviderCollectionPage {
+	readonly hasMore: boolean;
+}
 export type IdentityProviderRegisterInput = IdentityProviderConfig;
 export type IdentityProviderRegisterOutcome = RegisterIdentityProviderResult;
 export type IdentityProviderUnregisterOutcome = UnregisterIdentityProviderResult;
@@ -11528,7 +12893,7 @@ export interface CapabilitiesClient {
 	 * @wire `GET /v1/capabilities` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1capabilities/get`.
 	 */
-	list(filter?: CapabilityFilter): Promise<Page<CapabilityDeclaration>>;
+	list(filter?: CapabilityFilter): Promise<ListPage<CapabilityDeclaration>>;
 	/**
 	 * Fetch a single capability declaration by id.
 	 *
@@ -11543,14 +12908,14 @@ export interface CapabilitiesClient {
 	route(needs: readonly CapabilityNeed[]): Promise<RouteResult>;
 	readonly providers: ProvidersClient;
 }
-export interface ProvidersClient {
+interface ProvidersClient {
 	/**
 	 * Paginated list of registered providers.
 	 *
 	 * @wire `GET /v1/providers` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1providers/get`.
 	 */
-	list(filter?: ProviderFilter): Promise<Page<LegacyCapabilitiesProvider>>;
+	list(filter?: ProviderFilter): Promise<ListPage<LegacyCapabilitiesProvider>>;
 	/**
 	 * @wire `GET /v1/providers/{providerId}` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1providers~1{providerId}/get`.
@@ -11654,9 +13019,9 @@ export interface EvidenceClient {
  * Flow:
  *   1. `open()` — establishes the thread; returns the full
  *      `Conversation` row (wire returns 201 with the row body).
- *   2. Each turn: `runs.start({ agent, input, conversation })` — the
- *      SDK's runs surface accepts a conversation reference so the
- *      turn appends to the same thread.
+ *   2. Each turn: `runs.start({ agent, input: { userMessage,
+ *      conversationId } })` — an agent run's input names the
+ *      conversation, and the turn appends to it.
  *   3. `messages(id)` — read the accumulated message history.
  *   4. `close(id)` — freezes the thread; subsequent turns rejected.
  *
@@ -11688,7 +13053,7 @@ export interface ConversationsClient {
 	 * @wire `GET /v1/conversations` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1conversations/get`.
 	 */
-	list(filter?: ConversationFilter): Promise<Page<Conversation>>;
+	list(filter?: ConversationFilter): Promise<ListPage<Conversation>>;
 	/**
 	 * Close a conversation. Idempotent on already-closed threads — the
 	 * wire returns the current row unchanged in that case (no error, no
@@ -11715,7 +13080,7 @@ export interface ConversationsClient {
 	 * `role` / `sinceTurn` are accepted but have no effect: the SDK does
 	 * not send them and the API does not filter by them.
 	 */
-	messages(id: ThreadId, filter?: MessageFilter): Promise<Page<ConversationMessage$1>>;
+	messages(id: ThreadId, filter?: MessageFilter): Promise<ListPage<ConversationMessage$1>>;
 }
 export interface ConversationFilter extends Omit<Filter<ConversationStatus>, "status"> {
 	/**
@@ -11727,6 +13092,12 @@ export interface ConversationFilter extends Omit<Filter<ConversationStatus>, "st
 	readonly scope?: ScopeRef;
 	readonly agent?: AgentId;
 	readonly participantId?: string;
+	/**
+	 * Replay conversations (a comparison's replays, `metadata.replayOf`):
+	 * left out by default (`exclude`); `include` lists them with the
+	 * others, `only` lists just them.
+	 */
+	readonly replays?: "exclude" | "include" | "only";
 }
 export interface MessageFilter extends Filter {
 	readonly role?: MessageRole$1;
@@ -11755,7 +13126,7 @@ export interface UsageClient {
 	 * @wire `GET /v1/cost/records` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1cost~1records/get`.
 	 */
-	query(filter?: CostRecordFilter): Promise<Page<CostRecord>>;
+	query(filter?: CostRecordFilter): Promise<ListPage<CostRecord>>;
 	/**
 	 * Fetch a single cost record.
 	 *
@@ -11781,6 +13152,13 @@ export interface UsageSummaryInput extends Omit<CostRecordFilter, "from" | "to"
 	/** Exclusive. */
 	readonly to: Timestamp;
 	readonly groupBy?: readonly CostGroupDimension[];
+	/**
+	 * The most groups to return: the most expensive ones, highest first.
+	 * 1 to 10000; the server's default is 1000. When there were more, the
+	 * result's `truncated` is `true` and `totalGroups` says how many; the
+	 * totals still cover every record.
+	 */
+	readonly limit?: number;
 }
 export interface BudgetsClient {
 	/**
@@ -11910,6 +13288,8 @@ export interface EnvRecord {
 }
 export interface EnvListPage {
 	readonly data: readonly EnvRecord[];
+	/** Whether there's another page (`nextCursor` names it). */
+	readonly hasMore: boolean;
 	readonly nextCursor?: Cursor;
 }
 /**
@@ -12138,13 +13518,13 @@ export interface EventsClient {
 	/**
 	 * @unwired The API has no `GET /v1/events` route for event history.
 	 */
-	query(filter?: EventListFilter): Promise<Page<Event$1>>;
+	query(filter?: EventListFilter): Promise<ListPage<Event$1>>;
 }
 export interface SubscriptionsClient {
 	/**
 	 * @unwired The API has no `GET /v1/events/subscriptions` route.
 	 */
-	list(): Promise<Page<Subscription>>;
+	list(): Promise<ListPage<Subscription>>;
 	/**
 	 * @unwired The API has no `GET /v1/events/subscriptions/{id}` route.
 	 */
@@ -12208,44 +13588,67 @@ export interface FlowsClient {
 	 * @wire `GET /v1/flows` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1flows/get`.
 	 */
-	list(filter?: FlowFilter): Promise<Page<Flow>>;
+	list(filter?: FlowFilter): Promise<ListPage<Flow>>;
+	/**
+	 * A flow's versions: list, get, unregister and reinstate. Calling it
+	 * directly lists them (deprecated: use `flows.versions.list`).
+	 */
+	readonly versions: FlowVersionsClient;
+	/** @deprecated Use `flows.versions.get`; removed in 0.2. */
+	getVersion(id: FlowId, version: string): Promise<Flow>;
+	/** @deprecated Use `flows.versions.unregister`; removed in 0.2. */
+	delete(id: FlowId, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<void>;
+	/** @deprecated Use `flows.versions.reinstate`; removed in 0.2. */
+	reinstateVersion(id: FlowId, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<ReinstateFlowVersionResult>;
+}
+export interface FlowVersionsClient {
+	/** @deprecated Use `flows.versions.list`; removed in 0.2. */
+	(id: FlowId, filter?: PageFilter): Promise<ListPage<Flow>>;
 	/**
 	 * Historical versions of a flow.id.
 	 *
 	 * @wire `GET /v1/flows/{flowId}/versions` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1flows~1{flowId}~1versions/get`.
 	 */
-	versions(id: FlowId, filter?: PageFilter): Promise<Page<Flow>>;
+	list(id: FlowId, filter?: PageFilter): Promise<ListPage<Flow>>;
 	/**
 	 * Fetch a specific version of a flow.
 	 *
 	 * @wire `GET /v1/flows/{flowId}/versions/{version}` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1flows~1{flowId}~1versions~1{version}/get`.
 	 */
-	getVersion(id: FlowId, version: string): Promise<Flow>;
+	get(id: FlowId, version: string): Promise<Flow>;
 	/**
 	 * Unregister a specific version (an explicit version is required —
 	 * flows are versioned). Historical runs remain in the journal; only
 	 * future `runs.start` calls against this `(flowId, version)` fail
-	 * with `not-found/flow`.
+	 * with `not-found/flow`. Reversible via `flows.versions.reinstate`.
 	 *
 	 * @wire `POST /v1/flows/{flowId}/versions/{version}/unregister` —
 	 *   see `@kindgi/api/openapi.json#/paths/~1v1~1flows~1{flowId}~1versions~1{version}~1unregister/post`.
 	 */
-	delete(id: FlowId, version: string, options?: {
+	unregister(id: FlowId, version: string, options?: {
 		readonly idempotencyKey?: string;
-	}): Promise<void>;
+	}): Promise<UnregisterFlowVersionResult>;
 	/**
-	 * Un-tombstone a previously-unregistered version — the reverse of
-	 * `delete`. Idempotent — reinstating an active version returns
-	 * `wasTombstoned: false`.
+	 * Un-tombstone a previously-unregistered version. Idempotent —
+	 * reinstating an active version returns `wasTombstoned: false`.
 	 *
 	 * @wire `POST /v1/flows/{flowId}/versions/{version}/reinstate`
 	 */
-	reinstateVersion(id: FlowId, version: string, options?: {
+	reinstate(id: FlowId, version: string, options?: {
 		readonly idempotencyKey?: string;
 	}): Promise<ReinstateFlowVersionResult>;
 }
+export interface UnregisterFlowVersionResult {
+	readonly flowId: FlowId;
+	readonly version: string;
+	readonly unregistered: boolean;
+}
 export interface ReinstateFlowVersionResult {
 	readonly flowId: FlowId;
 	readonly version: string;
@@ -12272,6 +13675,56 @@ export interface FlowValidateResult {
 		readonly message: string;
 	}[];
 }
+/**
+ * Gate policies (evals step 4b): what a promotion of an agent must show
+ * before a version goes live for a scope. One policy per agent and scope;
+ * the caller names the policy and its semver versions. Writes need
+ * `admin` on the tenant.
+ */
+export interface GatePoliciesClient {
+	/**
+	 * Each policy's latest active version.
+	 *
+	 * @wire GET /v1/gate-policies
+	 */
+	list(filter?: GatePolicyFilter): Promise<GatePolicyPage>;
+	/**
+	 * The policy's latest active version.
+	 *
+	 * @wire GET /v1/gate-policies/:policyId
+	 */
+	get(policyId: string): Promise<GatePolicy>;
+	/**
+	 * Register a policy, or a new version of one. `409
+	 * gate-policy-scope-taken` when another policy gates the agent for the
+	 * scope (`details.heldBy`); `409 gate-policy-scope-changed` when a new
+	 * version names another agent or scope.
+	 *
+	 * @wire POST /v1/gate-policies
+	 */
+	publish(input: PublishGatePolicyInput, options?: {
+		idempotencyKey?: string;
+	}): Promise<GatePolicy>;
+	readonly versions: GatePolicyVersionsClient;
+}
+export interface GatePolicyVersionsClient {
+	/** @wire GET /v1/gate-policies/:policyId/versions — oldest first, unregistered ones too */
+	list(policyId: string): Promise<GatePolicyPage>;
+	/** @wire GET /v1/gate-policies/:policyId/versions/:version */
+	get(policyId: string, version: string): Promise<GatePolicy>;
+	/** @wire POST /v1/gate-policies/:policyId/versions/:version/unregister */
+	unregister(policyId: string, version: string): Promise<GatePolicy>;
+	/** @wire POST /v1/gate-policies/:policyId/versions/:version/reinstate */
+	reinstate(policyId: string, version: string): Promise<GatePolicy>;
+}
+export interface GatePolicyFilter {
+	readonly agentId?: string;
+	/** Only the policy of exactly this scope. */
+	readonly scope?: LiveScope;
+	readonly limit?: number;
+	readonly cursor?: string;
+}
+export type PublishGatePolicyInput = PublishGatePolicyBody;
 /**
  * Guardrails resource — declarative rules that gate runs.
  *
@@ -12313,7 +13766,7 @@ export interface GuardrailsClient {
 	 * @wire `GET /v1/guardrails` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1guardrails/get`.
 	 */
-	list(filter?: GuardrailFilter): Promise<Page<Guardrail>>;
+	list(filter?: GuardrailFilter): Promise<ListPage<Guardrail>>;
 	/**
 	 * Retire a guardrail. Idempotent on already-unregistered ids —
 	 * returns `unregistered: true` in either case; only unknown ids
@@ -12334,12 +13787,12 @@ export interface GuardrailsClient {
 	 *   per id; supersession via `unregister` + re-`register`), with no
 	 *   version history.
 	 */
-	versions(id: GuardrailId): Promise<Page<Guardrail>>;
+	versions(id: GuardrailId): Promise<ListPage<Guardrail>>;
 	/**
 	 * @unwired The API has no `GET /v1/guardrails/built-ins` route for
 	 *   the built-in check catalog.
 	 */
-	builtIns(): Promise<Page<BuiltInGuardrail>>;
+	builtIns(): Promise<ListPage<BuiltInGuardrail>>;
 	/**
 	 * @unwired The API has no `POST /v1/guardrails/{id}/evaluate`
 	 *   route — guardrails are evaluated inline during a run
@@ -12406,7 +13859,7 @@ export interface JudgeClassesClient {
 	 * @wire `GET /v1/judge-classes` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes/get`.
 	 */
-	list(filter?: JudgeClassFilter): Promise<Page<JudgeClass>>;
+	list(filter?: JudgeClassFilter): Promise<ListPage<JudgeClass>>;
 	/**
 	 * One class, also a retired one (`unregisteredAt` set).
 	 *
@@ -12415,7 +13868,7 @@ export interface JudgeClassesClient {
 	 */
 	get(judgeClassId: string): Promise<JudgeClass>;
 	/**
-	 * Change a live class's weight or description.
+	 * Change a live class's weight, description or who may assert it.
 	 *
 	 * @wire `PATCH /v1/judge-classes/{judgeClassId}` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1judge-classes~1{judgeClassId}/patch`.
@@ -12460,7 +13913,7 @@ export interface JudgmentsClient {
 	 *
 	 * @wire `GET /v1/judgments` — see `@kindgi/api/openapi.json#/paths/~1v1~1judgments/get`.
 	 */
-	list(filter?: JudgmentFilter): Promise<Page<Judgment>>;
+	list(filter?: JudgmentFilter): Promise<ListPage<Judgment>>;
 	/**
 	 * One judgment with the stored copies of what was judged.
 	 *
@@ -12521,12 +13974,12 @@ export interface McpClient {
 	 *   `client.tools.list()` — the wire `Tool` shape is the MCP
 	 *   manifest.
 	 */
-	tools(): Promise<Page<ToolManifest>>;
+	tools(): Promise<ListPage<ToolManifest>>;
 	/**
 	 * @unwired No `GET /v1/mcp/agents` route. List agents with
 	 *   `client.agents.list()`.
 	 */
-	agents(): Promise<Page<McpAgentExposure>>;
+	agents(): Promise<ListPage<McpAgentExposure>>;
 	/**
 	 * @unwired No `POST /v1/mcp/invoke-tool` route; tools run inside
 	 *   agent and flow runs (`client.runs.start`).
@@ -12550,7 +14003,7 @@ export interface McpEndpointsClient {
 	 * @wire `GET /v1/mcp/endpoints` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1mcp~1endpoints/get`.
 	 */
-	list(filter?: McpEndpointFilter): Promise<Page<McpEndpoint>>;
+	list(filter?: McpEndpointFilter): Promise<ListPage<McpEndpoint>>;
 	/**
 	 * Register an outbound MCP endpoint.
 	 *
@@ -12675,7 +14128,7 @@ export interface FactsClient {
 	 * is serialized as a JSON-encoded `?scope=` query param per the
 	 * server-side parser (`parseScopeParam`).
 	 */
-	list(filter?: FactFilter): Promise<Page<Fact$1>>;
+	list(filter?: FactFilter): Promise<ListPage<Fact$1>>;
 	/**
 	 * Soft-delete a fact via supersession. Facts are append-only on the
 	 * wire. Returns the wire envelope `{ factId, superseded: true }`;
@@ -12699,7 +14152,7 @@ export interface LogsClient {
 	/**
 	 * @unwired No `GET /v1/memory/logs` route.
 	 */
-	list(filter?: LogFilter): Promise<Page<LogEntry>>;
+	list(filter?: LogFilter): Promise<ListPage<LogEntry>>;
 	/**
 	 * @unwired No `POST /v1/memory/logs/verify` route. Verifying the
 	 *   hash chain needs the log entries, which the API does not
@@ -12726,7 +14179,7 @@ export interface ObservationsClient {
 	 *
 	 * @wire `GET /v1/observations` — see `@kindgi/api/openapi.json#/paths/~1v1~1observations/get`.
 	 */
-	query(filter?: ObservationFilter): Promise<Page<Observation>>;
+	query(filter?: ObservationFilter): Promise<ListPage<Observation>>;
 	/**
 	 * @unwired No `/v1/observations/patterns` route.
 	 */
@@ -12800,11 +14253,11 @@ export interface PacksClient {
 	 */
 	install(input: PackInstallInput): Promise<InstallationId>;
 	/** @unwired No `GET /v1/packs/installed` route. */
-	installed(filter?: PackFilter): Promise<Page<InstalledPack>>;
+	installed(filter?: PackFilter): Promise<ListPage<InstalledPack>>;
 	/** @unwired No `GET /v1/packs/{id}` route. */
 	get(id: PackId): Promise<Pack>;
 	/** @unwired No `GET /v1/packs/{id}/versions` route. */
-	versions(id: PackId): Promise<Page<Pack>>;
+	versions(id: PackId): Promise<ListPage<Pack>>;
 	/** @unwired No `PATCH /v1/pack-installations/{id}/config` route. */
 	configure(id: InstallationId, config: Readonly<Record<string, unknown>>): Promise<void>;
 	/** @unwired No `POST /v1/pack-installations/{id}/disable` route. */
@@ -12822,9 +14275,9 @@ export interface PacksClient {
  */
 export interface RegistryClient {
 	/** @unwired No `GET /v1/packs/registry` route. */
-	browse(filter?: RegistryFilter): Promise<Page<Pack>>;
+	browse(filter?: RegistryFilter): Promise<ListPage<Pack>>;
 	/** @unwired No `GET /v1/packs/registry/configured` route. */
-	configured(): Promise<Page<{
+	configured(): Promise<ListPage<{
 		readonly url: string;
 		readonly name: string;
 	}>>;
@@ -12840,7 +14293,8 @@ export interface RegistryFilter extends Filter {
  * Policies resource — versioned tenant policy registry.
  *
  * Each policy carries a `kind` (`access-control`, `model-routing`,
- * `adapter-allowlist`, `rate-limit`, `retention`, `compliance`) and a
+ * `adapter-allowlist`, `rate-limit`, `retention`, `compliance`,
+ * `tool-errors`, `hitl`) and a
  * `spec` object whose shape that kind defines. The API stores and
  * versions policies (semver per id); enforcement happens where each
  * kind is consumed, not in this resource.
@@ -12852,16 +14306,31 @@ export interface RegistryFilter extends Filter {
 export interface PoliciesClient {
 	/**
 	 * Publish a policy version. The server validates the top-level
-	 * shape (id, semver version, `kind`, `spec` object) — failures return
-	 * `400 validation-failed` with the issue list; deeper validation of
-	 * `spec` belongs to the consumer of that kind. Publishing the same
+	 * shape (id, semver version, `kind`, `spec` object), and `spec` for
+	 * `tool-errors`, `hitl` and `retention` — failures return
+	 * `400 validation-failed` with the issue list (a retention policy with
+	 * an unknown domain, or `mode: 'archive'`, is refused). Other kinds'
+	 * specs belong to the consumer of that kind. Publishing the same
 	 * `(id, version)` twice returns `409 policy-already-registered`.
 	 *
+	 * A tenant has one retention policy per domain, plus one for `*`: a
+	 * second policy id for a covered domain returns
+	 * `409 policy-scope-taken` (`details.heldBy` names the one that covers
+	 * it; publish a new version of that one instead), and a new version
+	 * can't move a policy to another domain (`409 policy-scope-changed`).
+	 *
 	 * @wire `POST /v1/policies` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1policies/post`.
 	 *
 	 * The wire action is publish; there is no draft lifecycle.
 	 */
+	publish(spec: PolicySpec, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<{
+		readonly policyId: PolicyId;
+		readonly version: string;
+	}>;
+	/** @deprecated Use `policies.publish`; removed in 0.2. */
 	author(spec: PolicySpec, options?: {
 		readonly idempotencyKey?: string;
 	}): Promise<{
@@ -12877,7 +14346,7 @@ export interface PoliciesClient {
 	 * @wire `GET /v1/policies` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1policies/get`.
 	 */
-	list(filter?: PolicyListFilter): Promise<Page<Policy>>;
+	list(filter?: PolicyListFilter): Promise<ListPage<Policy>>;
 	/**
 	 * Historical versions of a policy.id. Defaults to active-only. Pass
 	 * `filter.includeTombstoned = true` to include soft-tombstoned rows
@@ -12887,7 +14356,7 @@ export interface PoliciesClient {
 	 * @wire `GET /v1/policies/{policyId}/versions` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1policies~1{policyId}~1versions/get`.
 	 */
-	versions(id: PolicyId, filter?: PolicyVersionsFilter): Promise<Page<PolicyVersionRow>>;
+	versions(id: PolicyId, filter?: PolicyVersionsFilter): Promise<ListPage<PolicyVersionRow>>;
 	/**
 	 * Fetch a specific version of a policy.
 	 *
@@ -13026,7 +14495,7 @@ export interface ProvenanceClient {
 	 * @wire `GET /v1/provenance` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1provenance/get`.
 	 */
-	query(filter?: ProvenanceQueryFilter): Promise<Page<ProvenanceRecordMetadata>>;
+	query(filter?: ProvenanceQueryFilter): Promise<ListPage<ProvenanceRecordMetadata>>;
 	/**
 	 * Export a signed JSON bundle for a run. The server canonicalizes the
 	 * DAG + optional messages, signs with the Ed25519 key named by
@@ -13086,6 +14555,52 @@ interface ProvidersClient$1 {
 		readonly idempotencyKey?: string;
 	}): Promise<UnregisterProviderOutcome>;
 }
+/**
+ * Retention resource — what happens to deleted rows. Deleting most
+ * things is a tombstone; a `retention` policy per domain (published with
+ * `policies.author`) sets how long a tombstone stays before a sweep
+ * purges it for good. Nothing sweeps on its own: call `sweep` from a
+ * schedule. Both need `admin` on the tenant.
+ */
+export interface RetentionClient {
+	/**
+	 * The tombstoned rows in every domain a retention policy covers, each
+	 * with when it is purged (`purgeAt`) and the policy that decides it.
+	 * The page also names the covered domains this deployment can't purge
+	 * (`domainsMissingAdapter`), the ones no policy covers
+	 * (`unpolicedDomains`), and any domain two policies cover
+	 * (`conflicts`).
+	 *
+	 * @wire `GET /v1/retention/scheduled` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1retention~1scheduled/get`.
+	 */
+	scheduled(filter?: RetentionScheduledFilter): Promise<RetentionScheduledPage>;
+	/**
+	 * Purge, for good, the tombstoned rows past their policy's grace: in
+	 * every domain, or only `domain`. At most `maxPerDomain` per domain
+	 * per call (default 500); `remaining` counts the rest. Idempotent.
+	 *
+	 * @wire `POST /v1/retention/sweep`, or with `domain`
+	 *   `POST /v1/retention/sweep/{domain}` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1retention~1sweep/post`.
+	 */
+	sweep(input?: RetentionSweepInput): Promise<RetentionSweepResult>;
+}
+export interface RetentionScheduledFilter {
+	readonly domain?: RetentionDomain;
+	/** Only the rows a sweep would purge now. */
+	readonly pastGraceOnly?: boolean;
+	/** Rows per domain at most: 1..100, default 25. */
+	readonly limit?: number;
+	/** A previous page's `nextCursor`, to continue where it stopped. */
+	readonly cursor?: string;
+}
+export interface RetentionSweepInput {
+	/** One domain (not `*`). Absent: every domain. */
+	readonly domain?: Exclude<RetentionDomain, "*">;
+	/** 1..10000, default 500. */
+	readonly maxPerDomain?: number;
+}
 /**
  * A run event without its payload: what happened, on which node, when
  * (`RunProgressEvent` in the OpenAPI document). What
@@ -13325,9 +14840,15 @@ export interface RunPage {
  */
 export type StartRunInput = {
 	readonly agent: AgentId | string;
+	/**
+	 * Omit to use the live version for this project and segment path
+	 * (or, in a conversation, the version its earlier turns used).
+	 */
 	readonly agentVersion?: string;
 	/** Project the run belongs to. Omit to use the tenant's default project. */
 	readonly projectId?: string;
+	/** Where the run happens, coarse to fine (e.g. company, then role); picks the live version. */
+	readonly segments?: readonly ScopeSegment[];
 	readonly input: unknown;
 	readonly options?: StartRunOptions;
 	readonly idempotencyKey?: string;
@@ -13336,6 +14857,8 @@ export type StartRunInput = {
 	readonly flowVersion?: string;
 	/** Project the run belongs to. Optional; when omitted, the API's run handler chooses. */
 	readonly projectId?: string;
+	/** Where the run happens; picks the live version of each agent step. */
+	readonly segments?: readonly ScopeSegment[];
 	readonly input: unknown;
 	readonly options?: StartRunOptions;
 	readonly idempotencyKey?: string;
@@ -13364,6 +14887,16 @@ export interface RunAgent {
 	readonly id: string;
 	readonly version: string;
 	readonly conversationId: string;
+	/**
+	 * How the version was chosen: named on the run (`explicit`), held by the
+	 * flow version a flow's agent step runs in (`flow-pin`: the node's
+	 * `config.version`, else the flow version's pin), the conversation's
+	 * version (`conversation`), a live version (`live`), or the latest
+	 * (`latest`). Absent on turns from before 0.1.4.
+	 */
+	readonly via?: "explicit" | "flow-pin" | "conversation" | "live" | "latest";
+	/** With `via: 'live'`: the scope whose live version ran. */
+	readonly liveScope?: LiveScope;
 }
 /**
  * Wire shape — matches `@kindgi/api/openapi.json#Run`. Runs are
@@ -13394,6 +14927,8 @@ export interface Run {
 	 * started). Absent on other runs, and on turns from before 0.1.3.
 	 */
 	readonly agent?: RunAgent;
+	/** The segment path the run was started with; a child run has its parent's. */
+	readonly segments?: readonly ScopeSegment[];
 }
 /**
  * What `runs.start` returns: the run, plus a public run token when the
@@ -13640,10 +15175,14 @@ export interface SecretVersionRecord {
 }
 export interface SecretListPage {
 	readonly data: readonly SecretRecord[];
+	/** Whether there's another page (`nextCursor` names it). */
+	readonly hasMore: boolean;
 	readonly nextCursor?: Cursor;
 }
 export interface SecretVersionPage {
 	readonly data: readonly SecretVersionRecord[];
+	/** Whether there's another page (`nextCursor` names it). */
+	readonly hasMore: boolean;
 	readonly nextCursor?: Cursor;
 }
 export type SecretSetOutcome = {
@@ -13794,9 +15333,9 @@ export interface SupervisorClient {
 	/** @unwired No `GET /v1/supervisors/{id}` route. */
 	get(id: SupervisorId): Promise<Supervisor>;
 	/** @unwired No `GET /v1/supervisors` route. */
-	list(filter?: Filter): Promise<Page<Supervisor>>;
+	list(filter?: Filter): Promise<ListPage<Supervisor>>;
 	/** @unwired No `GET /v1/supervisors/{id}/versions` route. */
-	versions(id: SupervisorId): Promise<Page<Supervisor>>;
+	versions(id: SupervisorId): Promise<ListPage<Supervisor>>;
 	/** @unwired No `DELETE /v1/supervisors/{id}` route. */
 	delete(id: SupervisorId): Promise<void>;
 	readonly proposals: ProposalsClient;
@@ -13820,7 +15359,7 @@ export interface ProposalsClient {
 	 * @wire `GET /v1/proposals` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1proposals/get`.
 	 */
-	list(input: ProposalListInput): Promise<Page<FixProposal>>;
+	list(input: ProposalListInput): Promise<ListPage<FixProposal>>;
 	/**
 	 * @wire `GET /v1/proposals/{proposalId}` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1proposals~1{proposalId}/get`.
@@ -14032,7 +15571,7 @@ export interface TokensClient {
 	 * @wire `GET /v1/tokens` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1tokens/get`.
 	 */
-	list(filter?: TokenFilter): Promise<Page<ApiToken>>;
+	list(filter?: TokenFilter): Promise<ListPage<ApiToken>>;
 	/**
 	 * Read one API key. Never returns the secret.
 	 *
@@ -14093,7 +15632,7 @@ export interface ToolsClient {
 	 * @wire `GET /v1/tools` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1tools/get`.
 	 */
-	list(filter?: ToolFilter): Promise<Page<Tool>>;
+	list(filter?: ToolFilter): Promise<ListPage<Tool>>;
 	/**
 	 * Fetch the latest active version of a tool.
 	 *
@@ -14107,6 +15646,49 @@ export interface ToolsClient {
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1tools~1{toolId}/get`.
 	 */
 	get(id: ToolId): Promise<Tool>;
+	/**
+	 * Register a tool manifest (the tool minus its handler) at its version,
+	 * in a project. Metadata only: the handler isn't uploaded, and must
+	 * already be available to the runtime. Registering a version again is
+	 * `409 tool-already-registered`; a registry that takes no writes
+	 * (under `kindgi dev`, the pack's files are the source) is
+	 * `409 registry-read-only`.
+	 *
+	 * @wire `POST /v1/tools` — see
+	 *   `@kindgi/api/openapi.json#/paths/~1v1~1tools/post`.
+	 */
+	register(manifest: Tool, options: {
+		readonly projectId: string;
+		readonly idempotencyKey?: string;
+	}): Promise<{
+		readonly toolId: ToolId;
+	}>;
+	/** A tool's versions: list, get, unregister and reinstate. */
+	readonly versions: ToolVersionsClient;
+	/** @deprecated Use `tools.versions.list`; removed in 0.2. */
+	listVersions(id: ToolId, filter?: ToolVersionFilter): Promise<ListPage<ToolVersionRow>>;
+	/** @deprecated Use `tools.versions.get`; removed in 0.2. */
+	getVersion(id: ToolId, version: string): Promise<Tool>;
+	/** @deprecated Use `tools.versions.reinstate`; removed in 0.2. */
+	reinstateVersion(id: ToolId, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<ReinstateToolVersionResult>;
+	/** @deprecated Use `tools.versions.unregister`; removed in 0.2. */
+	unregisterVersion(id: ToolId, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<UnregisterToolVersionResult>;
+	/**
+	 * @unwired No `POST /v1/tools/{toolId}/invoke` route; tools run
+	 *   inside agent and flow runs.
+	 */
+	invoke(id: ToolId, input: unknown): Promise<never>;
+	/**
+	 * @unwired No separate manifests route — the wire `Tool` shape is
+	 *   the manifest; use `list`.
+	 */
+	manifests(filter?: ToolFilter): Promise<never>;
+}
+export interface ToolVersionsClient {
 	/**
 	 * Cursor-paginated list of tool versions. Defaults to active-only.
 	 * Pass `filter.includeTombstoned = true` to include soft-tombstoned
@@ -14115,7 +15697,7 @@ export interface ToolsClient {
 	 *
 	 * @wire `GET /v1/tools/{toolId}/versions`
 	 */
-	listVersions(id: ToolId, filter?: ToolVersionFilter): Promise<Page<ToolVersionRow>>;
+	list(id: ToolId, filter?: ToolVersionFilter): Promise<ListPage<ToolVersionRow>>;
 	/**
 	 * Fetch a specific tool version by exact semver. Returns
 	 * `404 tool-not-found` when the (id, version) pair isn't registered
@@ -14123,7 +15705,16 @@ export interface ToolsClient {
 	 *
 	 * @wire `GET /v1/tools/{toolId}/versions/{version}`
 	 */
-	getVersion(id: ToolId, version: string): Promise<Tool>;
+	get(id: ToolId, version: string): Promise<Tool>;
+	/**
+	 * Tombstone a specific version. Reversible via `tools.versions.reinstate`.
+	 * Idempotent — repeat call returns `unregistered: false`.
+	 *
+	 * @wire `POST /v1/tools/{toolId}/versions/{version}/unregister`
+	 */
+	unregister(id: ToolId, version: string, options?: {
+		readonly idempotencyKey?: string;
+	}): Promise<UnregisterToolVersionResult>;
 	/**
 	 * Un-tombstone a specific previously-unregistered version.
 	 * Restores the manifest bytes verbatim (semver hygiene: reinstate
@@ -14138,28 +15729,9 @@ export interface ToolsClient {
 	 *
 	 * @wire `POST /v1/tools/{toolId}/versions/{version}/reinstate`
 	 */
-	reinstateVersion(id: ToolId, version: string, options?: {
+	reinstate(id: ToolId, version: string, options?: {
 		readonly idempotencyKey?: string;
 	}): Promise<ReinstateToolVersionResult>;
-	/**
-	 * Tombstone a specific version. Reversible via `reinstateVersion`.
-	 * Idempotent — repeat call returns `unregistered: false`.
-	 *
-	 * @wire `POST /v1/tools/{toolId}/versions/{version}/unregister`
-	 */
-	unregisterVersion(id: ToolId, version: string, options?: {
-		readonly idempotencyKey?: string;
-	}): Promise<UnregisterToolVersionResult>;
-	/**
-	 * @unwired No `POST /v1/tools/{toolId}/invoke` route; tools run
-	 *   inside agent and flow runs.
-	 */
-	invoke(id: ToolId, input: unknown): Promise<never>;
-	/**
-	 * @unwired No separate manifests route — the wire `Tool` shape is
-	 *   the manifest; use `list`.
-	 */
-	manifests(filter?: ToolFilter): Promise<never>;
 }
 export interface ToolFilter {
 	readonly limit?: number;
@@ -14253,7 +15825,7 @@ export interface UsersClient {
 	 * @wire `GET /v1/identity/users` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1identity~1users/get`.
 	 */
-	list(filter?: UserFilter): Promise<Page<User>>;
+	list(filter?: UserFilter): Promise<ListPage<User>>;
 	/**
 	 * @unwired No user-update route — users live in the deployment's
 	 *   identity directory.
@@ -14274,7 +15846,7 @@ export interface SessionsClient {
 	 * @wire `GET /v1/identity/users/{userId}/sessions` — see
 	 *   `@kindgi/api/openapi.json#/paths/~1v1~1identity~1users~1{userId}~1sessions/get`.
 	 */
-	list(userId: UserId): Promise<Page<Session>>;
+	list(userId: UserId): Promise<ListPage<Session>>;
 	/**
 	 * Revoke ALL sessions for a user. Admin-scope. Idempotent on
 	 * already-revoked sets (returns `revokedCount: 0`).
@@ -14397,6 +15969,9 @@ export interface KindgiClient {
 	readonly adapters: AdaptersClient;
 	readonly providers: ProvidersClient$1;
 	readonly policies: PoliciesClient;
+	/** Gate policies: what a promotion must show before a version goes live (evals step 4b). */
+	readonly gatePolicies: GatePoliciesClient;
+	readonly retention: RetentionClient;
 	readonly projects: ProjectsClient;
 	readonly env: EnvClient;
 	readonly secrets: SecretsClient;
@@ -14468,17 +16043,23 @@ export interface NetworkError {
 }
 export interface AuthError {
 	readonly code: "auth";
+	/** The server's own error code (the wire `code`), when the error came from the server. */
+	readonly serverCode?: string;
 	readonly message: string;
 	readonly reason: "unauthenticated" | "forbidden" | "token-expired";
 }
 export interface RateLimitedError {
 	readonly code: "rate-limited";
+	/** The server's own error code (the wire `code`), when the error came from the server. */
+	readonly serverCode?: string;
 	readonly message: string;
 	/** Suggested seconds to wait before retry (from server `Retry-After`). */
 	readonly retryAfterSeconds?: number;
 }
 export interface NotFoundError {
 	readonly code: "not-found";
+	/** The server's own error code (the wire `code`), when the error came from the server. */
+	readonly serverCode?: string;
 	readonly message: string;
 	readonly resource: {
 		readonly kind: string;
@@ -14487,11 +16068,15 @@ export interface NotFoundError {
 }
 export interface ConflictError {
 	readonly code: "conflict";
+	/** The server's own error code (the wire `code`), when the error came from the server. */
+	readonly serverCode?: string;
 	readonly message: string;
 	readonly reason: string;
 }
 export interface InvalidRequestError {
 	readonly code: "invalid-request";
+	/** The server's own error code (the wire `code`), when the error came from the server. */
+	readonly serverCode?: string;
 	readonly message: string;
 	/** JSON-pointer issues, matching the shape used across `packages/*` validators. */
 	readonly issues: readonly {
@@ -14506,6 +16091,8 @@ export interface InvalidRequestError {
  */
 export interface GuardrailViolationError {
 	readonly code: "guardrail-violation";
+	/** The server's own error code (the wire `code`), when the error came from the server. */
+	readonly serverCode?: string;
 	readonly message: string;
 	readonly violations: readonly GuardrailViolation[];
 	/**
@@ -14531,12 +16118,14 @@ export interface GuardrailViolation {
 /**
  * Passthrough for server-side errors that have no dedicated SDK
  * variant (for example `KernelError` or `MemoryError` codes). `fromWire`
- * maps any unrecognized wire `code` to `{ code: 'server', serverCode:
- * <wire code>, message, fields: <wire details> }`.
+ * maps a wire `code` it doesn't list to `{ code: 'server', serverCode:
+ * <wire code>, message, fields: <wire details> }` — unless its HTTP
+ * status names a family (404/410 not-found, 401/403 auth, 429
+ * rate-limited, 400 invalid request; 409 and 422 stay `server`).
  *
  * Callers match `err.code === 'server' && err.serverCode === '...'` to
- * handle specific primitive errors. Keeps the SDK's top-level `code`
- * space small while preserving fidelity.
+ * handle specific primitive errors. Every error from the server carries
+ * `serverCode`, so matching on it alone works whatever the family.
  */
 export interface ServerError {
 	readonly code: "server";
@@ -14578,13 +16167,16 @@ export declare function notYetWired(method: string, reason: string): NotYetWired
  * `{ code, message, details?, requestId }` inside its `{ error }`
  * envelope, which the transport unwraps before calling this. This
  * function reads `code` and projects the rest of the object (including
- * `details`) into the matching variant. Unknown codes fall back to
- * `ServerError` with the raw code preserved as `serverCode` — later SDK
- * releases can add explicit variants without breaking older consumers.
+ * `details`) into the matching variant. A code this client doesn't list
+ * (a newer server's) is read by the HTTP `status` instead: 404/410 a
+ * not-found, 400 an invalid request, 401/403 an auth error, 429
+ * rate-limited. 409 and 422 stay `ServerError`: the docs match their
+ * codes there (`budget-exceeded`, `agent-version-mismatch`). Every
+ * error from the server keeps the raw code as `serverCode`.
  *
  * `code` is the discriminant.
  */
-export declare function fromWire(body: unknown): KindgiError;
+export declare function fromWire(body: unknown, status?: number): KindgiError;
 /**
  * Wrap a wire error as a JS `Error` so it can be `throw`n by SDK
  * methods. The typed payload rides on the `.error` property; callers