@m6d/cortex-cli 0.20.0 → 0.22.0

package/src/contracts/management/procedures.generated.ts

@@ -233,6 +233,7 @@ export const managementProcedureKinds = {
   "credentials.delete": "mutation",
   "credentials.list": "query",
   "credentials.names": "query",
+  "credentials.rotateKey": "mutation",
   "credentials.update": "mutation",
   "datasetHosts.create": "mutation",
   "datasetHosts.delete": "mutation",
@@ -257,6 +258,8 @@ export const managementProcedureKinds = {
   "manifests.sync": "mutation",
   "mcpServers.create": "mutation",
   "mcpServers.delete": "mutation",
+  "mcpServers.detectSignIn": "query",
+  "mcpServers.disconnect": "mutation",
   "mcpServers.get": "query",
   "mcpServers.list": "query",
   "mcpServers.publish": "mutation",
@@ -299,6 +302,7 @@ export const managementProcedureKinds = {
   "secrets.names": "query",
   "secrets.rotate": "mutation",
   "secrets.set": "mutation",
+  "secrets.update": "mutation",
   "servers.create": "mutation",
   "servers.delete": "mutation",
   "servers.get": "query",
@@ -379,9 +383,10 @@ export const managementProcedureKinds = {
 
 /** Each procedure's input, as it is sent, and output, as JSON carries it. */
 export type ManagementProcedures = {
-  /** Give an agent an alias: a second slug it answers to wherever a slug is resolved. Refused (slug_taken) when an agent's slug or another alias holds the name; to move an alias, delete it and add it to the other agent. */
+  /** Give an agent an alias: a second name it answers to wherever a name is resolved. Refused (name_taken) when an agent's name or another alias holds the name; to move an alias, delete it and add it to the other agent. */
   "agents.addAlias": {
     input: {
+      /** A name: lowercase letters, digits, and single hyphens. */
       alias: string;
       agentId: string;
     };
@@ -395,8 +400,9 @@ export type ManagementProcedures = {
   /** Create an agent on a registered server, or on none (`serverId` null), fixed for good either way. An agent with no server has no native tools, no server variables and no server auth, and publishes only on a chat model of its own. The draft has no prompt yet; save one with agents.savePrompt before publishing. */
   "agents.create": {
     input: {
-      slug: string;
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       serverId: string | null;
     };
     output: {
@@ -405,9 +411,9 @@ export type ManagementProcedures = {
       sourceId: string | null;
       overridable: Array<string>;
       applied: string | number | boolean | null | Record<string, unknown> | Array<unknown> | null;
-      slug: string;
-      serverId: string | null;
       name: string;
+      serverId: string | null;
+      displayName: Partial<Record<"en" | "ar", string>>;
       promptDraft: string;
       ragEnabled: boolean;
       toolRegistryEnabled: boolean;
@@ -450,9 +456,9 @@ export type ManagementProcedures = {
       sourceId: string | null;
       overridable: Array<string>;
       applied: string | number | boolean | null | Record<string, unknown> | Array<unknown> | null;
-      slug: string;
-      serverId: string | null;
       name: string;
+      serverId: string | null;
+      displayName: Partial<Record<"en" | "ar", string>>;
       promptDraft: string;
       ragEnabled: boolean;
       toolRegistryEnabled: boolean;
@@ -486,6 +492,7 @@ export type ManagementProcedures = {
   /** Remove an alias. */
   "agents.deleteAlias": {
     input: {
+      /** A name: lowercase letters, digits, and single hyphens. */
       alias: string;
     };
     output: {
@@ -506,9 +513,9 @@ export type ManagementProcedures = {
       sourceId: string | null;
       overridable: Array<string>;
       applied: string | number | boolean | null | Record<string, unknown> | Array<unknown> | null;
-      slug: string;
-      serverId: string | null;
       name: string;
+      serverId: string | null;
+      displayName: Partial<Record<"en" | "ar", string>>;
       promptDraft: string;
       ragEnabled: boolean;
       toolRegistryEnabled: boolean;
@@ -535,7 +542,10 @@ export type ManagementProcedures = {
       summarizationModel: string | null;
       context: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
       limits: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
-      serverName: string | null;
+      server: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      } | null;
       serverVerifies: boolean;
       variables: Array<{
         name: string;
@@ -566,13 +576,16 @@ export type ManagementProcedures = {
     output: {
       items: Array<{
         id: string;
-        slug: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         updatedAt: string;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
-        serverName: string | null;
+        server: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
         published: boolean;
         toolCount: number;
         serviceCount: number;
@@ -585,7 +598,7 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** List an agent's aliases (second slugs, unique across the deployment beside every agent's own), with pagination. */
+  /** List an agent's aliases (second names, unique across the deployment beside every agent's own), with pagination. */
   "agents.listAliases": {
     input: {
       pageIndex?: number;
@@ -606,13 +619,13 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Agent id, slug, and name pairs for selectors. */
+  /** Agent ids, names and display names for selectors. */
   "agents.options": {
     input: undefined;
     output: Array<{
       id: string;
-      slug: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       serverId: string | null;
     }>;
   };
@@ -666,9 +679,9 @@ export type ManagementProcedures = {
       sourceId: string | null;
       overridable: Array<string>;
       applied: string | number | boolean | null | Record<string, unknown> | Array<unknown> | null;
-      slug: string;
-      serverId: string | null;
       name: string;
+      serverId: string | null;
+      displayName: Partial<Record<"en" | "ar", string>>;
       promptDraft: string;
       ragEnabled: boolean;
       toolRegistryEnabled: boolean;
@@ -776,9 +789,9 @@ export type ManagementProcedures = {
       sourceId: string | null;
       overridable: Array<string>;
       applied: string | number | boolean | null | Record<string, unknown> | Array<unknown> | null;
-      slug: string;
-      serverId: string | null;
       name: string;
+      serverId: string | null;
+      displayName: Partial<Record<"en" | "ar", string>>;
       promptDraft: string;
       ragEnabled: boolean;
       toolRegistryEnabled: boolean;
@@ -809,11 +822,11 @@ export type ManagementProcedures = {
       updatedAt: string;
     };
   };
-  /** Rename an agent. The name applies at once; it is not part of the published prompt. */
+  /** Set an agent's display name, a text per locale. It applies at once; it is not part of the published prompt. */
   "agents.update": {
     input: {
       id: string;
-      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     };
     output: {
       id: string;
@@ -821,9 +834,9 @@ export type ManagementProcedures = {
       sourceId: string | null;
       overridable: Array<string>;
       applied: string | number | boolean | null | Record<string, unknown> | Array<unknown> | null;
-      slug: string;
-      serverId: string | null;
       name: string;
+      serverId: string | null;
+      displayName: Partial<Record<"en" | "ar", string>>;
       promptDraft: string;
       ragEnabled: boolean;
       toolRegistryEnabled: boolean;
@@ -875,7 +888,7 @@ export type ManagementProcedures = {
     output: {
       id: string;
       actorId: string;
-      credentialKind: "session" | "managementKey" | "operatorToken" | "system";
+      credentialKind: "session" | "managementKey" | "operatorToken" | "oauthToken" | "system";
       credentialId: string | null;
       entityType: string;
       entityId: string;
@@ -883,9 +896,16 @@ export type ManagementProcedures = {
       createdAt: string;
       actorName: string;
       actorEmail: string;
-      entityName: string | null;
-      credentialFingerprint: string | null;
-      credentialName: string | null;
+      entity: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      } | null;
+      managementKey: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+        fingerprint: string;
+      } | null;
+      oauthClientName: string | null;
       before: unknown;
       after: unknown;
     };
@@ -906,7 +926,7 @@ export type ManagementProcedures = {
       items: Array<{
         id: string;
         actorId: string;
-        credentialKind: "session" | "managementKey" | "operatorToken" | "system";
+        credentialKind: "session" | "managementKey" | "operatorToken" | "oauthToken" | "system";
         credentialId: string | null;
         entityType: string;
         entityId: string;
@@ -914,9 +934,16 @@ export type ManagementProcedures = {
         createdAt: string;
         actorName: string;
         actorEmail: string;
-        entityName: string | null;
-        credentialFingerprint: string | null;
-        credentialName: string | null;
+        entity: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
+        managementKey: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+          fingerprint: string;
+        } | null;
+        oauthClientName: string | null;
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
       count: number;
@@ -924,10 +951,12 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Create a knowledge collection with an audience ({ kind: "all" }, { kind: "server", serverId }, or { kind: "agents", agentIds }). Documents are uploaded into it; a service tag scopes every document to that service. */
+  /** Create a knowledge collection with a display name (a text per locale, `{}` for none) and an audience ({ kind: "all" }, { kind: "server", serverId }, or { kind: "agents", agentIds }). Documents are uploaded into it; a service tag scopes every document to that service. */
   "collections.create": {
     input: {
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string;
       serviceId: string | null;
       citable: boolean;
@@ -968,6 +997,7 @@ export type ManagementProcedures = {
       citable: boolean;
       createdAt: string;
       updatedAt: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       source: "direct" | "manifest" | "server";
       sourceId: string | null;
       overridable: Array<string>;
@@ -981,9 +1011,10 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -994,7 +1025,10 @@ export type ManagementProcedures = {
           agentIds: Array<string>;
         };
       }>;
-      serviceKey: string | null;
+      service: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      } | null;
     };
   };
   /** List knowledge collections with pagination and search, optionally the ones an agent sees or the ones reaching a server. */
@@ -1015,6 +1049,7 @@ export type ManagementProcedures = {
         description: string;
         serviceId: string | null;
         updatedAt: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -1027,7 +1062,10 @@ export type ManagementProcedures = {
           kind: "agents";
           agentIds: Array<string>;
         };
-        serviceKey: string | null;
+        service: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
         documentCount: number;
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
@@ -1087,10 +1125,10 @@ export type ManagementProcedures = {
       };
     }>;
   };
-  /** Rename, describe or change the service tag of a knowledge collection. A tag change applies to agents at once. */
+  /** Set a knowledge collection's display name, describe it or change its service tag. A tag change applies to agents at once. */
   "collections.update": {
     input: {
-      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string;
       serviceId: string | null;
       citable: boolean;
@@ -1101,24 +1139,31 @@ export type ManagementProcedures = {
       name: string;
     };
   };
-  /** Create a named credential over a stored secret: `static` presents the secret's value; `oauth2-client-credentials` exchanges it, as the client secret of `clientId`, for a bearer at `tokenUrl` (https, or http on loopback or on a host `EGRESS_ALLOWED_HOSTS` admits). A credential's name and kind never change. Needs `secrets:write` too: whatever presents the credential sends its secret. */
+  /** Create a credential over a stored secret, with a display name (`{}` for none). `static` presents the secret's value; `oauth2-client-credentials` gets a bearer at `tokenUrl` (https) as `clientId`, by `authMethod`: `client_secret_basic` sends the secret; `private_key_jwt` signs with a key Cortex generates into a new secret named `secretName`, which nothing else may compose or rewrite (`signing_key_secret`), and needs `issuer` and an engine public URL to publish its key under (`jwks_unavailable`); `none` is a public app for MCP sign-in at `issuer`, with no secret. `issuer` is the authorization server's exact identifier. Name, kind and auth method never change. Needs `secrets:write`. */
   "credentials.create": {
     input: {
+      displayName: Partial<Record<"en" | "ar", string>>;
       kind: "static" | "oauth2-client-credentials";
+      authMethod: "client_secret_basic" | "private_key_jwt" | "none";
       secretName: string;
       tokenUrl: string;
       clientId: string;
       scope: string;
+      issuer: string;
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
     };
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       kind: "static" | "oauth2-client-credentials";
-      secretName: string;
+      authMethod: "client_secret_basic" | "private_key_jwt" | "none" | null;
+      secretName: string | null;
       tokenUrl: string | null;
       clientId: string | null;
       scope: string | null;
+      issuer: string | null;
       createdAt: string;
       updatedAt: string;
     };
@@ -1131,16 +1176,19 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       kind: "static" | "oauth2-client-credentials";
-      secretName: string;
+      authMethod: "client_secret_basic" | "private_key_jwt" | "none" | null;
+      secretName: string | null;
       tokenUrl: string | null;
       clientId: string | null;
       scope: string | null;
+      issuer: string | null;
       createdAt: string;
       updatedAt: string;
     };
   };
-  /** List credentials with pagination and search: the name tools, dataset hosts and triggers reference, its kind, the secret it composes, and how many rows name it with the first few (`usedBy`). */
+  /** List credentials with pagination and search: the name tools, dataset hosts and triggers reference, its display name, its kind and auth method, the secret it composes, how many rows name it with the first few (`usedBy`), and, for a `private_key_jwt` one, the URL of its public key set (`jwksUrl`, null without an engine public URL), which its authorization server is registered with, and the `kid` of the key it signs with now (null for any other). */
   "credentials.list": {
     input: {
       pageIndex?: number;
@@ -1151,21 +1199,27 @@ export type ManagementProcedures = {
       items: Array<{
         id: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "static" | "oauth2-client-credentials";
-        secretName: string;
+        authMethod: "client_secret_basic" | "private_key_jwt" | "none" | null;
+        secretName: string | null;
         tokenUrl: string | null;
         clientId: string | null;
         scope: string | null;
+        issuer: string | null;
         createdAt: string;
         updatedAt: string;
         usedBy: {
           count: number;
           preview: Array<{
+            name: string;
+            displayName: Partial<Record<"en" | "ar", string>>;
             kind: "credential" | "model_provider" | "server" | "agent" | "tool" | "trigger" | "dataset_host" | "webhook" | "mcp_server";
             id: string;
-            name: string;
           }>;
         };
+        jwksUrl: string | null;
+        kid: string | null;
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
       count: number;
@@ -1173,31 +1227,60 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Credential names in order, for a picker. `present`: what a tool, dataset host, webhook or trigger run may present upstream (every credential but a trigger's fire credential). `fire`: what a trigger may be fired with (static credentials). */
+  /** Each credential's name and display name, in name order, for a picker. `present`: what a tool, dataset host, webhook or trigger run may present upstream (every credential but a trigger's fire credential). `fire`: what a trigger may be fired with (static credentials). `signIn`: what an MCP server's sign-in may present as its pre-registered app (OAuth2 client credentials ones naming their `issuer`). */
   "credentials.names": {
     input: {
-      use: "present" | "fire";
+      use: "present" | "fire" | "signIn";
     };
-    output: Array<string>;
+    output: Array<{
+      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
+    }>;
   };
-  /** Change the secret a credential composes and, for an OAuth2 one, its token URL, client id and scope. Applies to the next call of every tool, dataset host and trigger naming it. Changing the secret or the token URL needs `secrets:write` too (`secret_binding_forbidden`): either sends a stored secret somewhere new. */
+  /** Replace a `private_key_jwt` credential's signing key with a new one, under a new `kid`, rewriting its secret (`no_signing_key` for any other credential). Its key set serves only the new public key at once, so assertions verify again once the authorization server refetches it. */
+  "credentials.rotateKey": {
+    input: {
+      id: string;
+    };
+    output: {
+      id: string;
+      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
+      kind: "static" | "oauth2-client-credentials";
+      authMethod: "client_secret_basic" | "private_key_jwt" | "none" | null;
+      secretName: string | null;
+      tokenUrl: string | null;
+      clientId: string | null;
+      scope: string | null;
+      issuer: string | null;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+  /** Change a credential's display name, the secret it composes and, for an OAuth2 one, its token URL, client id, scope and issuer. Applies to the next call of every tool, dataset host and trigger naming it. Changing the secret, the token URL or the issuer needs `secrets:write` too (`secret_binding_forbidden`): each sends a stored secret somewhere new. A `private_key_jwt` one keeps its secret, which holds its key, like its kind and auth method (`kind_locked`). */
   "credentials.update": {
     input: {
+      displayName: Partial<Record<"en" | "ar", string>>;
       kind: "static" | "oauth2-client-credentials";
+      authMethod: "client_secret_basic" | "private_key_jwt" | "none";
       secretName: string;
       tokenUrl: string;
       clientId: string;
       scope: string;
+      issuer: string;
       id: string;
     };
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       kind: "static" | "oauth2-client-credentials";
-      secretName: string;
+      authMethod: "client_secret_basic" | "private_key_jwt" | "none" | null;
+      secretName: string | null;
       tokenUrl: string | null;
       clientId: string | null;
       scope: string | null;
+      issuer: string | null;
       createdAt: string;
       updatedAt: string;
     };
@@ -1207,6 +1290,7 @@ export type ManagementProcedures = {
     input: {
       name: string;
       url: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -1252,6 +1336,7 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       url: string;
       headers: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
       timeoutMs: number;
@@ -1284,9 +1369,10 @@ export type ManagementProcedures = {
       revision: number;
       updatedAt: string;
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -1297,7 +1383,6 @@ export type ManagementProcedures = {
           agentIds: Array<string>;
         };
       }>;
-      nameLocked: boolean;
       variables: Array<{
         name: string;
         description: string;
@@ -1327,6 +1412,7 @@ export type ManagementProcedures = {
         manifestVersion: string | null;
         syncedAt: string | null;
         expose: Array<string>;
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -1462,7 +1548,6 @@ export type ManagementProcedures = {
   /** Update a dataset host's draft: which synced datasets the agent may query (`expose`) and which are listed in every turn (`pinned`). Saved as a draft; call the entity's publish procedure to make it live. The url, headers (each with a prefix and its value from a credential, the run token, a variable or a constant), timeout, and `rateLimits` (queries per minute for all users and per user, null for no limit) apply live without a publish. */
   "datasetHosts.update": {
     input: {
-      name: string;
       url: string;
       headers: Array<{
         header: string;
@@ -1492,6 +1577,7 @@ export type ManagementProcedures = {
       expose: Array<string>;
       pinned: Array<string>;
       id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     };
     output: {
       id: string;
@@ -1636,7 +1722,7 @@ export type ManagementProcedures = {
       updatedAt: string;
     };
   };
-  /** The caller's live management keys with pagination and search: name, fingerprint, scope, and dates. Never the key itself. */
+  /** The caller's live management keys in name order, with pagination and search: name, display name, fingerprint, scope, and dates. Never the key itself. */
   "managementKeys.list": {
     input: {
       pageIndex?: number;
@@ -1647,6 +1733,7 @@ export type ManagementProcedures = {
       items: Array<{
         id: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         fingerprint: string;
         permissions: Array<string> | null;
         lastUsedAt: string | null;
@@ -1659,12 +1746,13 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** The management key this request authenticated with (name, fingerprint, scope, dates). Refused for a session or an operator token, which are not keys. */
+  /** The management key this request authenticated with (name, display name, fingerprint, scope, dates). Refused for a session or an operator token, which are not keys. */
   "managementKeys.mine": {
     input: undefined;
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       fingerprint: string;
       permissions: Array<string> | null;
       lastUsedAt: string | null;
@@ -1677,8 +1765,8 @@ export type ManagementProcedures = {
     input: {
       id: string;
       agents?: Array<{
-        slug: string;
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         server?: string;
         prompt: string;
         auth: {
@@ -1755,11 +1843,12 @@ export type ManagementProcedures = {
           prompt: string;
         }>>;
         greeting?: Record<"en" | "ar", string>;
-        overridable?: Array<"name" | "prompt" | "models" | "settings" | "rateLimits" | "suggestions" | "greeting">;
+        overridable?: Array<"displayName" | "prompt" | "models" | "settings" | "rateLimits" | "suggestions" | "greeting">;
       }>;
       tools?: Array<{
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsPreviewSchema0>;
@@ -1790,7 +1879,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
         url: string;
         headers?: Array<{
           header: string;
@@ -1818,6 +1907,7 @@ export type ManagementProcedures = {
       } | {
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsPreviewSchema0>;
@@ -1848,7 +1938,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
         url: string;
         headers?: Array<{
           header: string;
@@ -1873,6 +1963,7 @@ export type ManagementProcedures = {
       } | {
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsPreviewSchema0>;
@@ -1903,7 +1994,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
         url: string;
         headers?: Array<{
           header: string;
@@ -1935,6 +2026,7 @@ export type ManagementProcedures = {
       } | {
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsPreviewSchema0>;
@@ -1965,7 +2057,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags">;
         type: "client";
       }>;
       openapi?: Array<{
@@ -1998,21 +2090,22 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
       }>;
       services?: Array<{
-        key: string;
-        name: Record<"en" | "ar", string>;
+        name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description: Record<"en" | "ar", string>;
         audience: "all" | {
           server: string;
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description">;
+        overridable?: Array<"displayName" | "description">;
       }>;
       skills?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description: string;
         body: string;
         service?: string;
@@ -2021,10 +2114,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "body">;
+        overridable?: Array<"displayName" | "description" | "body">;
       }>;
       triggers?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description: string;
         inputSchema?: {
           type: "object";
@@ -2063,10 +2157,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "instructions" | "threadPolicy" | "budgetPerDay" | "disableAfterFailures" | "model">;
+        overridable?: Array<"displayName" | "description" | "instructions" | "threadPolicy" | "budgetPerDay" | "disableAfterFailures" | "model">;
       }>;
       datasetHosts?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         url: string;
         headers?: Array<{
           header: string;
@@ -2100,10 +2195,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"timeoutMs" | "rateLimits" | "headers">;
+        overridable?: Array<"displayName" | "timeoutMs" | "rateLimits" | "headers">;
       }>;
       mcpServers?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         url: string;
         headers?: Array<{
           header: string;
@@ -2121,6 +2217,11 @@ export type ManagementProcedures = {
             value: string;
           };
         }>;
+        signIn?: {
+          connects: "shared" | "endUser";
+          scope?: string;
+          credential?: string;
+        };
         include?: Array<string>;
         exclude?: Array<string>;
         audience: "all" | {
@@ -2128,10 +2229,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"include" | "exclude" | "headers">;
+        overridable?: Array<"displayName" | "include" | "exclude" | "headers" | "signIn">;
       }>;
       webhooks?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description?: string;
         event: "approval_requested";
         url: string;
@@ -2152,10 +2254,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "headers">;
       }>;
       collections?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description?: string;
         service?: string;
         citable?: boolean;
@@ -2174,7 +2277,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "documents">;
+        overridable?: Array<"displayName" | "description" | "documents">;
       }>;
       prefer?: "live" | "manifest";
       resolutions?: Array<{
@@ -2202,8 +2305,8 @@ export type ManagementProcedures = {
     input: {
       id: string;
       agents?: Array<{
-        slug: string;
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         server?: string;
         prompt: string;
         auth: {
@@ -2280,11 +2383,12 @@ export type ManagementProcedures = {
           prompt: string;
         }>>;
         greeting?: Record<"en" | "ar", string>;
-        overridable?: Array<"name" | "prompt" | "models" | "settings" | "rateLimits" | "suggestions" | "greeting">;
+        overridable?: Array<"displayName" | "prompt" | "models" | "settings" | "rateLimits" | "suggestions" | "greeting">;
       }>;
       tools?: Array<{
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsSyncSchema0>;
@@ -2315,7 +2419,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
         url: string;
         headers?: Array<{
           header: string;
@@ -2343,6 +2447,7 @@ export type ManagementProcedures = {
       } | {
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsSyncSchema0>;
@@ -2373,7 +2478,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
         url: string;
         headers?: Array<{
           header: string;
@@ -2398,6 +2503,7 @@ export type ManagementProcedures = {
       } | {
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsSyncSchema0>;
@@ -2428,7 +2534,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
         url: string;
         headers?: Array<{
           header: string;
@@ -2460,6 +2566,7 @@ export type ManagementProcedures = {
       } | {
         name: string;
         description: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         inputSchema?: {
           type: "object";
           properties?: Record<string, ManifestsSyncSchema0>;
@@ -2490,7 +2597,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags">;
         type: "client";
       }>;
       openapi?: Array<{
@@ -2523,21 +2630,22 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "maxResponseBytes" | "rateLimits" | "pinned" | "tags" | "headers">;
       }>;
       services?: Array<{
-        key: string;
-        name: Record<"en" | "ar", string>;
+        name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description: Record<"en" | "ar", string>;
         audience: "all" | {
           server: string;
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description">;
+        overridable?: Array<"displayName" | "description">;
       }>;
       skills?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description: string;
         body: string;
         service?: string;
@@ -2546,10 +2654,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "body">;
+        overridable?: Array<"displayName" | "description" | "body">;
       }>;
       triggers?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description: string;
         inputSchema?: {
           type: "object";
@@ -2588,10 +2697,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "instructions" | "threadPolicy" | "budgetPerDay" | "disableAfterFailures" | "model">;
+        overridable?: Array<"displayName" | "description" | "instructions" | "threadPolicy" | "budgetPerDay" | "disableAfterFailures" | "model">;
       }>;
       datasetHosts?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         url: string;
         headers?: Array<{
           header: string;
@@ -2625,10 +2735,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"timeoutMs" | "rateLimits" | "headers">;
+        overridable?: Array<"displayName" | "timeoutMs" | "rateLimits" | "headers">;
       }>;
       mcpServers?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         url: string;
         headers?: Array<{
           header: string;
@@ -2646,6 +2757,11 @@ export type ManagementProcedures = {
             value: string;
           };
         }>;
+        signIn?: {
+          connects: "shared" | "endUser";
+          scope?: string;
+          credential?: string;
+        };
         include?: Array<string>;
         exclude?: Array<string>;
         audience: "all" | {
@@ -2653,10 +2769,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"include" | "exclude" | "headers">;
+        overridable?: Array<"displayName" | "include" | "exclude" | "headers" | "signIn">;
       }>;
       webhooks?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description?: string;
         event: "approval_requested";
         url: string;
@@ -2677,10 +2794,11 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "timeoutMs" | "headers">;
+        overridable?: Array<"displayName" | "description" | "timeoutMs" | "headers">;
       }>;
       collections?: Array<{
         name: string;
+        displayName?: Partial<Record<"en" | "ar", string>>;
         description?: string;
         service?: string;
         citable?: boolean;
@@ -2699,7 +2817,7 @@ export type ManagementProcedures = {
         } | {
           agents: Array<string>;
         };
-        overridable?: Array<"description" | "documents">;
+        overridable?: Array<"displayName" | "description" | "documents">;
       }>;
       prefer?: "live" | "manifest";
       resolutions?: Array<{
@@ -2722,6 +2840,7 @@ export type ManagementProcedures = {
     input: {
       name: string;
       url: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -2746,7 +2865,30 @@ export type ManagementProcedures = {
       id: string;
     };
   };
-  /** One MCP server by id with its url, headers, tool filters, and sharing. */
+  /** Find how Cortex would sign in to the MCP server with OAuth, from its metadata: the authorization server's issuer, the method Cortex would use (`preRegistered`, `clientIdDocument`, `dynamicRegistration`, or null for none), the scopes on offer, whether PKCE with S256 is supported, and the resource tokens are for. A pre-registered app for another issuer is refused as `sign_in_issuer_mismatch`. */
+  "mcpServers.detectSignIn": {
+    input: {
+      id: string;
+    };
+    output: {
+      issuer: string;
+      method: "preRegistered" | "clientIdDocument" | "dynamicRegistration" | null;
+      scopes: Array<string>;
+      pkce: boolean;
+      resource: string;
+    };
+  };
+  /** Forget every connection Cortex holds to the MCP server: the shared one, or every end user's. Its turns report it not connected until someone signs in again. The tokens are not revoked at the authorization server. */
+  "mcpServers.disconnect": {
+    input: {
+      id: string;
+    };
+    output: {
+      id: string;
+      name: string;
+    };
+  };
+  /** One MCP server by id with its url, headers, sign-in, tool filters, and sharing; its shared connection, never its tokens, with `stepUp` once its server refused a call for lack of scope (the scopes it lacks, and whether a sign-in may still ask for them); how many end users are connected or must sign in again; and `signInUrl`, where a browser form-posts an operator token and the server's id to connect it (null while the engine or the console has no public URL). */
   "mcpServers.get": {
     input: {
       id: string;
@@ -2767,6 +2909,7 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       url: string;
       headers: Array<{
         header: string;
@@ -2784,14 +2927,20 @@ export type ManagementProcedures = {
           value: string;
         };
       }>;
+      signIn: {
+        connects: "shared" | "endUser";
+        scope?: string;
+        credential?: string;
+      } | null;
       include: Array<string>;
       exclude: Array<string>;
       status: "draft" | "published" | "disabled";
       updatedAt: string;
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -2802,7 +2951,6 @@ export type ManagementProcedures = {
           agentIds: Array<string>;
         };
       }>;
-      nameLocked: boolean;
       variables: Array<{
         name: string;
         description: string;
@@ -2810,6 +2958,22 @@ export type ManagementProcedures = {
         type: "string" | "number" | "boolean";
         computed: boolean;
       }>;
+      connection: {
+        status: "connected" | "needs_scope" | "broken";
+        issuer: string;
+        scope: string;
+        expiresAt: string | null;
+        updatedAt: string;
+        stepUp: {
+          missing: string;
+          grantable: boolean;
+        } | null;
+      } | null;
+      endUsers: {
+        connected: number;
+        broken: number;
+      };
+      signInUrl: string | null;
     };
   };
   /** List MCP servers with pagination and search. */
@@ -2828,6 +2992,7 @@ export type ManagementProcedures = {
         name: string;
         url: string;
         status: "draft" | "published" | "disabled";
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -2938,10 +3103,9 @@ export type ManagementProcedures = {
       unchanged: boolean;
     };
   };
-  /** Update an MCP server's draft: its name (until first published) and which of its tools agents may call (`include`, empty for every tool, and `exclude`, tool names as the server spells them). Saved as a draft; call publish to make it live. The url and headers (each with a prefix and its value from a credential, the run token, a variable or a constant) apply live without a publish. */
+  /** Update an MCP server's draft: which of its tools agents may call (`include`, empty for every tool, and `exclude`, tool names as the server spells them). Saved as a draft; call publish to make it live. The url, headers (each with a prefix and its value from a credential, the run token, a variable or a constant) and `signIn` apply live without a publish. `signIn` (null for none) has Cortex sign in with OAuth: `connects` is `shared` (an operator connects once for every agent) or `endUser` (each end user connects their own), `scope` what to ask for, and `credential` names the app registered with the authorization server beforehand, an `oauth2-client-credentials` credential naming its `issuer`. A server that signs in declares no Authorization header. */
   "mcpServers.update": {
     input: {
-      name: string;
       url: string;
       headers: Array<{
         header: string;
@@ -2959,27 +3123,36 @@ export type ManagementProcedures = {
           value: string;
         };
       }>;
+      signIn: {
+        connects: "shared" | "endUser";
+        scope?: string;
+        credential?: string;
+      } | null;
       include: Array<string>;
       exclude: Array<string>;
       id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     };
     output: {
       id: string;
       name: string;
     };
   };
-  /** Create a model provider: an OpenAI-compatible `baseUrl` (https, or http on loopback or on a host `EGRESS_ALLOWED_HOSTS` admits), the secret holding its key, the model ids it offers, and the values it accepts as `reasoning_effort`. Its name never changes. Needs `secrets:write` too: every model call sends the key to `baseUrl`. */
+  /** Create a model provider: a display name (a text per locale, `{}` for none), an OpenAI-compatible `baseUrl` (https, or http on loopback or on a host `EGRESS_ALLOWED_HOSTS` admits), the secret holding its key, the model ids it offers, and the values it accepts as `reasoning_effort`. Its name never changes. Needs `secrets:write` too: every model call sends the key to `baseUrl`. */
   "modelProviders.create": {
     input: {
+      displayName: Partial<Record<"en" | "ar", string>>;
       baseUrl: string;
       secretName: string;
       models: Array<string>;
       efforts: Array<string>;
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
     };
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       baseUrl: string;
       secretName: string;
       models: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
@@ -2996,6 +3169,7 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       baseUrl: string;
       secretName: string;
       models: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
@@ -3026,6 +3200,7 @@ export type ManagementProcedures = {
       items: Array<{
         id: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         baseUrl: string;
         secretName: string;
         models: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
@@ -3035,9 +3210,10 @@ export type ManagementProcedures = {
         usedBy: {
           count: number;
           preview: Array<{
+            name: string;
+            displayName: Partial<Record<"en" | "ar", string>>;
             kind: "credential" | "model_provider" | "server" | "agent" | "tool" | "trigger" | "dataset_host" | "webhook" | "mcp_server";
             id: string;
-            name: string;
           }>;
         };
       }>;
@@ -3047,18 +3223,20 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Every model provider with its models and efforts, in name order, for a model picker. */
+  /** Every model provider with its display name, models and efforts, in name order, for a model picker. */
   "modelProviders.options": {
     input: undefined;
     output: Array<{
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       models: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
       efforts: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
     }>;
   };
-  /** Change a model provider's URL, key secret, models and efforts. Refused with `in_use` while a server, agent or trigger picks a model or effort it would drop. Changing the URL or the key secret needs `secrets:write` too (`secret_binding_forbidden`): either sends a stored secret somewhere new. Applies from each agent's next turn. */
+  /** Change a model provider's display name, URL, key secret, models and efforts. Refused with `in_use` while a server, agent or trigger picks a model or effort it would drop. Changing the URL or the key secret needs `secrets:write` too (`secret_binding_forbidden`): either sends a stored secret somewhere new. Applies from each agent's next turn. */
   "modelProviders.update": {
     input: {
+      displayName: Partial<Record<"en" | "ar", string>>;
       baseUrl: string;
       secretName: string;
       models: Array<string>;
@@ -3068,6 +3246,7 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       baseUrl: string;
       secretName: string;
       models: string | number | boolean | null | Record<string, unknown> | Array<unknown>;
@@ -3090,7 +3269,10 @@ export type ManagementProcedures = {
       callerId: string | null;
       toolName: string;
       createdAt: string;
-      agentName: string;
+      agent: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      };
       triggerName: string | null;
       threadId: string | null;
       threadTitle: string | null;
@@ -3126,7 +3308,8 @@ export type ManagementProcedures = {
         entityType: "knowledge" | "service" | "tool";
         entityId: string;
         collectionId: string | null;
-        name: Record<"en" | "ar", string>;
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         resolutionCount: number;
       }>;
       broadTools: Array<{
@@ -3138,13 +3321,19 @@ export type ManagementProcedures = {
       missingQueries: Array<{
         queryHash: string;
         agentId: string;
-        agentName: string;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         searchCount: number;
         lastSearchedAt: string;
       }>;
       hitRates: Array<{
         agentId: string;
-        agentName: string;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         retrievalCount: number;
         hitCount: number;
         hitRate: number;
@@ -3163,9 +3352,14 @@ export type ManagementProcedures = {
       outcome: "started" | "awaiting_approval" | "completed" | "failed" | "rejected" | "dropped";
       reason: "busy" | "approval_pending" | "budget" | "rate_limited" | "invalid_payload" | "missing_thread_key" | "no_turn" | "no_output" | "invalid_output" | null;
       output: unknown;
-      serverName: string | null;
-      agentSlug: string;
-      agentName: string;
+      server: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      } | null;
+      agent: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      };
       threadTitle: string | null;
       createdAt: string;
       finishedAt: string | null;
@@ -3200,7 +3394,10 @@ export type ManagementProcedures = {
       };
       perUser: Array<{
         scopeId: string;
-        scopeName: string;
+        scope: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         userId: string;
         triggerName: string | null;
         threads: number;
@@ -3213,11 +3410,17 @@ export type ManagementProcedures = {
       }>;
       perServer: Array<{
         serverId: string | null;
-        serverName: string | null;
+        server: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
         totalTokens: number;
       }>;
       perAgent: Array<{
-        agentSlug: string;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         totalTokens: number;
       }>;
       perDay: Array<{
@@ -3251,9 +3454,14 @@ export type ManagementProcedures = {
         detail: string | null;
         threadId: string;
         createdAt: string;
-        serverName: string | null;
-        agentSlug: string;
-        agentName: string;
+        server: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         threadTitle: string | null;
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
@@ -3286,7 +3494,10 @@ export type ManagementProcedures = {
         callerId: string | null;
         toolName: string;
         createdAt: string;
-        agentName: string;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         triggerName: string | null;
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
@@ -3356,7 +3567,10 @@ export type ManagementProcedures = {
     output: {
       items: Array<{
         agentId: string;
-        agentName: string;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         skillName: string;
         misses: number;
         lastSeenAt: string | null;
@@ -3433,9 +3647,14 @@ export type ManagementProcedures = {
         outcome: "started" | "awaiting_approval" | "completed" | "failed" | "rejected" | "dropped";
         reason: "busy" | "approval_pending" | "budget" | "rate_limited" | "invalid_payload" | "missing_thread_key" | "no_turn" | "no_output" | "invalid_output" | null;
         output: unknown;
-        serverName: string | null;
-        agentSlug: string;
-        agentName: string;
+        server: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
         threadTitle: string | null;
         createdAt: string;
         finishedAt: string | null;
@@ -3480,9 +3699,10 @@ export type ManagementProcedures = {
       agentId: string;
     };
     output: Array<{
+      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       kind: "tool" | "service" | "skill" | "trigger" | "dataset_host" | "mcp_server" | "webhook" | "knowledge_collection";
       id: string;
-      name: string;
     }>;
   };
   /** Publication history of an entity with pagination. */
@@ -3589,11 +3809,12 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       createdAt: string;
       updatedAt: string;
     };
   };
-  /** List secret names and dates with pagination and search, each with how many rows name it and the first few (`usedBy`); values are never returned. */
+  /** List secrets' names, display names and dates with pagination and search, each with how many rows name it and the first few (`usedBy`); values are never returned. */
   "secrets.list": {
     input: {
       pageIndex?: number;
@@ -3604,14 +3825,16 @@ export type ManagementProcedures = {
       items: Array<{
         id: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         createdAt: string;
         updatedAt: string;
         usedBy: {
           count: number;
           preview: Array<{
+            name: string;
+            displayName: Partial<Record<"en" | "ar", string>>;
             kind: "credential" | "model_provider" | "server" | "agent" | "tool" | "trigger" | "dataset_host" | "webhook" | "mcp_server";
             id: string;
-            name: string;
           }>;
         };
       }>;
@@ -3621,12 +3844,15 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Every secret name in order, for a picker. */
+  /** Every secret's name and display name, in name order, for a picker. */
   "secrets.names": {
     input: undefined;
-    output: Array<string>;
+    output: Array<{
+      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
+    }>;
   };
-  /** Replace a secret's value in place. */
+  /** Replace a secret's value in place; a `private_key_jwt` credential's generated key is refused (`signing_key_secret`), since only `credentials.rotateKey` rewrites it. */
   "secrets.rotate": {
     input: {
       id: string;
@@ -3635,27 +3861,45 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       createdAt: string;
       updatedAt: string;
     };
   };
-  /** Create a named secret; credentials compose it by name, and a tool input field may read it. */
+  /** Create a named secret with a display name (a text per locale, `{}` for none); credentials compose it by name, and a tool input field may read it. */
   "secrets.set": {
     input: {
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       value: string;
     };
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       createdAt: string;
       updatedAt: string;
     };
   };
-  /** Register a server by name, with the URL it serves the server protocol at, the secret holding its key, optionally the model its agents run on by default, and how often Cortex may check callers with it: `signInChecksPerMinute` (new end-user tokens it verifies) and `triggerChecksPerMinute` (trigger secrets). Its manifest is read at once; a failed read is the row's `syncError` and does not fail the registration. */
-  "servers.create": {
+  /** Set a secret's display name, a text per locale. Its name and value stay; `secrets.rotate` replaces the value. */
+  "secrets.update": {
     input: {
+      id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
+    };
+    output: {
+      id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+  /** Register a server by name, with a display name (a text per locale, `{}` for none), the URL it serves the server protocol at, the secret holding its key, optionally the model its agents run on by default, and how often Cortex may check callers with it: `signInChecksPerMinute` (new end-user tokens it verifies) and `triggerChecksPerMinute` (trigger secrets). Its manifest is read at once; a failed read is the row's `syncError` and does not fail the registration. */
+  "servers.create": {
+    input: {
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string;
       url: string | "";
       keySecretName: string;
@@ -3664,10 +3908,13 @@ export type ManagementProcedures = {
       modelEffort: string | null;
       signInChecksPerMinute: number;
       triggerChecksPerMinute: number;
+      /** A name: lowercase letters, digits, and single hyphens. */
+      name: string;
     };
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string | null;
       url: string | null;
       keySecretName: string | null;
@@ -3681,6 +3928,7 @@ export type ManagementProcedures = {
         }>;
         tools: Array<{
           name: string;
+          displayName?: Partial<Record<"en" | "ar", string>>;
           description: string;
           inputSchema: Record<string, unknown>;
           outputSchema?: Record<string, unknown>;
@@ -3712,6 +3960,7 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string | null;
       url: string | null;
       keySecretName: string | null;
@@ -3725,6 +3974,7 @@ export type ManagementProcedures = {
         }>;
         tools: Array<{
           name: string;
+          displayName?: Partial<Record<"en" | "ar", string>>;
           description: string;
           inputSchema: Record<string, unknown>;
           outputSchema?: Record<string, unknown>;
@@ -3756,6 +4006,7 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string | null;
       url: string | null;
       keySecretName: string | null;
@@ -3777,9 +4028,10 @@ export type ManagementProcedures = {
         computed: boolean;
       }>;
       components: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "tool" | "service" | "skill" | "trigger" | "dataset_host" | "mcp_server" | "webhook" | "knowledge_collection";
         id: string;
-        name: string;
       }>;
     };
   };
@@ -3795,6 +4047,7 @@ export type ManagementProcedures = {
       items: Array<{
         id: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         description: string | null;
         url: string | null;
         keySecretName: string | null;
@@ -3810,7 +4063,7 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Server id and name pairs for selectors. Cortex's own system server is left out unless `includeSystem` asks for it, as a filter over its threads does. */
+  /** Each server's id, name and display name, for selectors. Cortex's own system server is left out unless `includeSystem` asks for it, as a filter over its threads does. */
   "servers.options": {
     input: {
       includeSystem?: boolean;
@@ -3818,6 +4071,7 @@ export type ManagementProcedures = {
     output: Array<{
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     }>;
   };
   /** Read the server's manifest now and apply its variables and native tools; a refused manifest leaves the previous one in place. */
@@ -3829,10 +4083,10 @@ export type ManagementProcedures = {
       syncedAt: string;
     };
   };
-  /** Rename a server, change its URL or key, set how often Cortex may check callers with it (`signInChecksPerMinute`, `triggerChecksPerMinute`; resend the current values to keep them), or pick the model its agents run on by default: `modelProvider` with one of its `modelName`s, and a `modelEffort` that provider lists; all null leaves each agent to pick its own. Refused as `model_not_offered` otherwise, and as `model_in_use` when an agent on the server picks an effort alone the new provider does not list, or is published with no model of its own and would be left without one. Clearing the URL or key drops what its manifest offered, refused as a sync dropping it all would be: `verify_in_use` while an agent's auth is the server's, `variable_in_use` or `still_referenced` while a published component reads a variable or calls a native tool it declared. A rename is refused as `manifest_in_use`, naming the `manifests`, while a manifest names the server by an agent on it or a component reaching it. A new URL or key has its manifest read at once, as on registration. */
+  /** Change a server's display name, URL or key, set how often Cortex may check callers with it (`signInChecksPerMinute`, `triggerChecksPerMinute`; resend the current values to keep them), or pick the model its agents run on by default: `modelProvider` with one of its `modelName`s, and a `modelEffort` that provider lists; all null leaves each agent to pick its own. Refused as `model_not_offered` otherwise, and as `model_in_use` when an agent on the server picks an effort alone the new provider does not list, or is published with no model of its own and would be left without one. Clearing the URL or key drops what its manifest offered, refused as a sync dropping it all would be: `verify_in_use` while an agent's auth is the server's, `variable_in_use` or `still_referenced` while a published component reads a variable or calls a native tool it declared. A new URL or key has its manifest read at once, as on registration. */
   "servers.update": {
     input: {
-      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string;
       url: string | "";
       keySecretName: string;
@@ -3846,6 +4100,7 @@ export type ManagementProcedures = {
     output: {
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string | null;
       url: string | null;
       keySecretName: string | null;
@@ -3859,6 +4114,7 @@ export type ManagementProcedures = {
         }>;
         tools: Array<{
           name: string;
+          displayName?: Partial<Record<"en" | "ar", string>>;
           description: string;
           inputSchema: Record<string, unknown>;
           outputSchema?: Record<string, unknown>;
@@ -3885,9 +4141,9 @@ export type ManagementProcedures = {
   /** Create a service with an audience ({ kind: "all" }, { kind: "server", serverId }, or { kind: "agents", agentIds }). The draft has no tools yet; add them before publishing. */
   "services.create": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
-      key: string;
-      name: Record<"en" | "ar", string>;
+      /** A name: lowercase letters, digits, and single hyphens. */
+      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -3900,7 +4156,7 @@ export type ManagementProcedures = {
     };
     output: {
       id: string;
-      name: Record<"en" | "ar", string>;
+      name: string;
     };
   };
   /** Delete a service; fails while tools reference it. */
@@ -3919,11 +4175,11 @@ export type ManagementProcedures = {
     };
     output: {
       id: string;
-      key: string;
-      name: Record<"en" | "ar", string>;
+      name: string;
       description: Record<"en" | "ar", string>;
       status: "draft" | "published" | "disabled";
       updatedAt: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       source: "direct" | "manifest" | "server";
       sourceId: string | null;
       overridable: Array<string>;
@@ -3937,9 +4193,10 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -3958,7 +4215,6 @@ export type ManagementProcedures = {
         id: string;
         name: string;
       }>;
-      nameLocked: boolean;
     };
   };
   /** List services (upstream API groupings for tools) with pagination and search. */
@@ -3974,10 +4230,10 @@ export type ManagementProcedures = {
     output: {
       items: Array<{
         id: string;
-        key: string;
-        name: Record<"en" | "ar", string>;
+        name: string;
         description: Record<"en" | "ar", string>;
         status: "draft" | "published" | "disabled";
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -3997,7 +4253,7 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Every service a component with the given audience may be scoped to, as id, key and name, for selectors. */
+  /** Every service a component with the given audience may be scoped to, as id, name and display name, for selectors. */
   "services.options": {
     input: {
       audience: {
@@ -4012,8 +4268,8 @@ export type ManagementProcedures = {
     };
     output: Array<{
       id: string;
-      key: string;
-      name: Record<"en" | "ar", string>;
+      name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     }>;
   };
   /** Publish the service's current draft. */
@@ -4094,15 +4350,13 @@ export type ManagementProcedures = {
   /** Update a service's draft. Saved as a draft; call the entity's publish procedure to make it live. */
   "services.update": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
-      key: string;
-      name: Record<"en" | "ar", string>;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: Record<"en" | "ar", string>;
       id: string;
     };
     output: {
       id: string;
-      name: Record<"en" | "ar", string>;
+      name: string;
     };
   };
   /** Deployment settings: log and thread retention. */
@@ -4134,8 +4388,9 @@ export type ManagementProcedures = {
   /** Create a skill with an audience ({ kind: "all" }, { kind: "server", serverId }, or { kind: "agents", agentIds }). The draft has no body yet; fill it with update before publishing. */
   "skills.create": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -4174,6 +4429,7 @@ export type ManagementProcedures = {
       body: string;
       status: "draft" | "published" | "disabled";
       updatedAt: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       source: "direct" | "manifest" | "server";
       sourceId: string | null;
       overridable: Array<string>;
@@ -4187,9 +4443,10 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -4200,7 +4457,10 @@ export type ManagementProcedures = {
           agentIds: Array<string>;
         };
       }>;
-      serviceKey: string | null;
+      service: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      } | null;
       variables: Array<{
         name: string;
         description: string;
@@ -4220,7 +4480,6 @@ export type ManagementProcedures = {
         id: string;
         name: string;
       }>;
-      nameLocked: boolean;
     };
   };
   /** List skills with pagination and search: every skill of an agent, or only those scoped to no service or to one service. */
@@ -4241,6 +4500,7 @@ export type ManagementProcedures = {
         name: string;
         description: string;
         status: "draft" | "published" | "disabled";
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -4335,14 +4595,13 @@ export type ManagementProcedures = {
       unchanged: boolean;
     };
   };
-  /** Update a skill's draft name, description, or body. Saved as a draft; call the entity's publish procedure to make it live. */
+  /** Update a skill's display name, or its draft description or body. The description and body are saved as a draft; call the entity's publish procedure to make them live. The display name applies at once. */
   "skills.update": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
-      name: string;
       description: string;
       body: string;
       id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       variables: Array<string>;
     };
     output: {
@@ -4364,10 +4623,15 @@ export type ManagementProcedures = {
       createdAt: string;
       updatedAt: string;
       serverId: string | null;
-      serverName: string | null;
-      agentSlug: string;
+      server: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      } | null;
+      agent: {
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
+      };
       agentId: string;
-      agentName: string;
       agentUrl: string | null;
       messageCount: number;
       totalTokens: number;
@@ -4386,7 +4650,7 @@ export type ManagementProcedures = {
       pageSize?: number;
       q?: string;
       serverId?: string;
-      agentSlug?: string;
+      agentName?: string;
       userId?: string;
       dateFrom?: string;
       dateTo?: string;
@@ -4403,8 +4667,14 @@ export type ManagementProcedures = {
         createdAt: string;
         updatedAt: string;
         serverId: string | null;
-        serverName: string | null;
-        agentSlug: string;
+        server: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        };
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
       count: number;
@@ -4593,6 +4863,7 @@ export type ManagementProcedures = {
       description: string;
       endpointUrl: string;
       method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -4824,6 +5095,7 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string;
       type: "http" | "embedded" | "soap" | "native" | "client";
       config: {
@@ -4858,9 +5130,10 @@ export type ManagementProcedures = {
       createdAt: string;
       updatedAt: string;
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -4880,7 +5153,6 @@ export type ManagementProcedures = {
       }>;
       inputFields: Array<StoredSchemaFieldRow>;
       outputFields: Array<StoredSchemaFieldRow>;
-      nameLocked: boolean;
     };
   };
   /** List tools with pagination and search. */
@@ -4904,6 +5176,7 @@ export type ManagementProcedures = {
         status: "draft" | "published" | "disabled";
         pinned: boolean;
         importSource: string | null;
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -4923,12 +5196,13 @@ export type ManagementProcedures = {
       filteredCount: number;
     };
   };
-  /** Tool id and name pairs for selectors. */
+  /** Each tool's id, name and display name, for selectors. */
   "tools.options": {
     input: undefined;
     output: Array<{
       id: string;
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     }>;
   };
   /** Parse an OpenAPI document and list the operations it would import as tools, and the tools already importing some of them. */
@@ -5108,8 +5382,6 @@ export type ManagementProcedures = {
   /** Update a tool's draft. Saved as a draft; call the entity's publish procedure to make it live. `headers` (the headers every call carries, each with a prefix and where its value comes from: `{ kind: "credential", name }`, `{ kind: "runToken" }`, `{ kind: "variable", name }` or `{ kind: "constant", value }`) and `rateLimits` (calls per minute for all users and per user, null for no limit) apply live without a publish. A variable must be one every agent the tool reaches is filled with. */
   "tools.update": {
     input: {
-      /** An identifier of up to 64 characters: letters, digits, _ or $, not starting with a digit, and not the name of a built-in tool (submitAnswer, loadSkill, executeCode, requestLocation and the like). */
-      name: string;
       description: string;
       endpointUrl: string;
       method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
@@ -5144,6 +5416,7 @@ export type ManagementProcedures = {
       projectOutput: boolean;
       tags: Array<string>;
       id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       variables: Array<{
         name: string;
         description: string;
@@ -5237,8 +5510,9 @@ export type ManagementProcedures = {
   /** Create a trigger (a named entry point external systems fire on an agent) with an audience ({ kind: "all" }, { kind: "server", serverId }, or { kind: "agents", agentIds }), fired on any agent in it. The draft has no instructions yet; fill them with update before publishing. */
   "triggers.create": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -5349,6 +5623,7 @@ export type ManagementProcedures = {
       modelEffort: string | null;
       status: "draft" | "published" | "disabled";
       updatedAt: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       source: "direct" | "manifest" | "server";
       sourceId: string | null;
       overridable: Array<string>;
@@ -5362,9 +5637,10 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -5377,8 +5653,8 @@ export type ManagementProcedures = {
       }>;
       agents: Array<{
         id: string;
-        slug: string;
         name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
       }>;
       engineUrl: string | null;
       variables: Array<{
@@ -5402,7 +5678,6 @@ export type ManagementProcedures = {
         id: string;
         name: string;
       }>;
-      nameLocked: boolean;
     };
   };
   /** List triggers with pagination and search. */
@@ -5432,6 +5707,7 @@ export type ManagementProcedures = {
         };
         status: "draft" | "published" | "disabled";
         secretPrefix: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -5537,11 +5813,9 @@ export type ManagementProcedures = {
       unchanged: boolean;
     };
   };
-  /** Update a trigger's draft. Saved as a draft; call the entity's publish procedure to make it live. `credentialName`, `fireCredentialName` and the model pick are the exceptions: they apply without a publish, the fire credential from the next firing and the others from each agent's next turn. Giving the run a different `credentialName` needs `secrets:write`, since tools forwarding the run token send its value upstream. The model pick (`modelProvider` with one of its `modelName`s and optionally a `modelEffort`, all null to run on each agent's own) is refused as `model_not_offered` when the provider does not list the model or the effort, or an effort is picked without a model. `fireCredentialName` names a static credential whose value callers present to fire, shared by every trigger naming it; that credential and its secret may serve nothing else. Clearing it leaves the trigger shut until `triggers.rotateSecret` mints a secret. */
+  /** Update a trigger's draft. Saved as a draft; call the entity's publish procedure to make it live. `displayName`, `credentialName`, `fireCredentialName` and the model pick are the exceptions: they apply without a publish, the display name at once, the fire credential from the next firing and the others from each agent's next turn. Giving the run a different `credentialName` needs `secrets:write`, since tools forwarding the run token send its value upstream. The model pick (`modelProvider` with one of its `modelName`s and optionally a `modelEffort`, all null to run on each agent's own) is refused as `model_not_offered` when the provider does not list the model or the effort, or an effort is picked without a model. `fireCredentialName` names a static credential whose value callers present to fire, shared by every trigger naming it; that credential and its secret may serve nothing else. Clearing it leaves the trigger shut until `triggers.rotateSecret` mints a secret. */
   "triggers.update": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
-      name: string;
       description: string;
       inputFields: Array<SchemaFieldRow>;
       outputFields: Array<SchemaFieldRow>;
@@ -5559,6 +5833,7 @@ export type ManagementProcedures = {
       budgetPerDay: number | null;
       disableAfterFailures: number;
       id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       credentialName: string | null;
       fireCredentialName: string | null;
       modelProvider: string | null;
@@ -5648,9 +5923,10 @@ export type ManagementProcedures = {
   /** Create a webhook (an HTTP endpoint Cortex posts an event to when a run on an agent parks for approval) with an audience ({ kind: "all" }, { kind: "server", serverId }, or { kind: "agents", agentIds }). It starts disabled: set its headers with update, then enable it with toggle. */
   "webhooks.create": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
+      /** A name: lowercase letters, digits, and single hyphens. */
       name: string;
       url: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       audience: {
         kind: "all";
       } | {
@@ -5696,6 +5972,7 @@ export type ManagementProcedures = {
         agentIds: Array<string>;
       };
       name: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
       description: string;
       event: "approval_requested";
       url: string;
@@ -5719,9 +5996,10 @@ export type ManagementProcedures = {
       enabled: boolean;
       updatedAt: string;
       referrers: Array<{
+        name: string;
+        displayName: Partial<Record<"en" | "ar", string>>;
         kind: "agent_prompt" | "service" | "skill" | "trigger" | "knowledge_collection";
         id: string;
-        name: string;
         readers: {
           kind: "all";
         } | {
@@ -5751,6 +6029,7 @@ export type ManagementProcedures = {
         event: "approval_requested";
         url: string;
         enabled: boolean;
+        displayName: Partial<Record<"en" | "ar", string>>;
         source: "direct" | "manifest" | "server";
         sourceId: string | null;
         overridable: Array<string>;
@@ -5798,7 +6077,10 @@ export type ManagementProcedures = {
         durationMs: number;
         error: "upstream_status" | "upstream_failed" | "egress_blocked" | "timeout" | "response_too_large" | "token_missing" | "unknown_credential" | "credential_unavailable" | "unexpected" | null;
         createdAt: string;
-        agentName: string | null;
+        agent: {
+          name: string;
+          displayName: Partial<Record<"en" | "ar", string>>;
+        } | null;
       }>;
       /** Every row the caller may see, ignoring the search and filters. */
       count: number;
@@ -5861,8 +6143,6 @@ export type ManagementProcedures = {
   /** Update a webhook. Every delivery reads it live, so a change applies to the next one at once. A header's value comes from a credential or a constant: a delivery has no run of its own, so no run token or variable. */
   "webhooks.update": {
     input: {
-      /** A slug: lowercase letters, digits, and single hyphens. */
-      name: string;
       description: string;
       event: "approval_requested";
       url: string;
@@ -5884,6 +6164,7 @@ export type ManagementProcedures = {
       }>;
       timeoutMs: number;
       id: string;
+      displayName: Partial<Record<"en" | "ar", string>>;
     };
     output: {
       id: string;