@naturali/cli 0.69.0 → 0.70.0

package/dist/index.mjs

@@ -14,7 +14,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region package.json
-var version = "0.69.0";
+var version = "0.70.0";
 //#endregion
 //#region ../sdk/src/generated/core/bodySerializer.gen.ts
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
@@ -2132,6 +2132,219 @@ var Models = class {
 		});
 	}
 };
+var Orchestrations = class {
+	/**
+	* List orchestrations
+	*
+	* Returns orchestrations accessible to the caller.
+	*/
+	static listOrchestrations(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/orchestrations",
+			...options
+		});
+	}
+	/**
+	* Create an orchestration
+	*
+	* Creates a new orchestration (pipeline) definition in the project.
+	*/
+	static createOrchestration(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestrations",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Validate an orchestration graph
+	*
+	* Statically validates an orchestration graph without persisting anything. Checks that every node has its required field, node ids are unique, edges reference existing nodes, the graph is acyclic (unless it contains a loop node), and every `input_mapping` `{"var": "..."}` reference resolves to a state key written by an upstream node or seeded by `input_schema`. Returns blocking `errors` and non-blocking `warnings` (e.g. a state key only written on a conditional branch). The same `errors` checks are enforced on create and update, which fail with `400` when any error is present.
+	*
+	*/
+	static validateOrchestration(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestrations/validate",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get orchestration queue stats
+	*
+	* Returns a point-in-time snapshot of the orchestration run queue: how many tasks are waiting to be claimed (`queue_depth`), how many are currently claimed with a valid lease (`claimed_tasks`), the age of the oldest waiting task, recent claim-latency percentiles over a rolling in-process window, and a per-project breakdown. Intended for admin/operator policies; guarded by `orchestrations:GetQueueStats`. A project-scoped caller sees only their own projects under `per_project`.
+	*
+	*/
+	static getQueueStats(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/v1/projects/{project_id}/orchestrations/queue/stats",
+			...options
+		});
+	}
+	/**
+	* Delete an orchestration
+	*
+	* Deletes an orchestration definition and all its runs.
+	*/
+	static deleteOrchestration(options) {
+		return (options.client ?? client).delete({
+			url: "/v1/projects/{project_id}/orchestrations/{orchestration_id}",
+			...options
+		});
+	}
+	/**
+	* Get an orchestration
+	*
+	* Returns the orchestration with nodes and edges.
+	*/
+	static getOrchestration(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/orchestrations/{orchestration_id}",
+			...options
+		});
+	}
+	/**
+	* Update an orchestration
+	*
+	* Partially updates an orchestration definition.
+	*/
+	static updateOrchestration(options) {
+		return (options.client ?? client).patch({
+			url: "/v1/projects/{project_id}/orchestrations/{orchestration_id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List an orchestration's graph versions
+	*
+	* Returns the orchestration's archived graphs, newest first. A version is written on create and on every subsequent write that changes the graph (`nodes`, `edges`, `state_schema`, `input_schema`) — through the REST API or a formation apply alike. Metadata-only edits (name, description) do not archive a version. See [Versioning](/docs/modules/orchestrations#versioning).
+	*
+	*/
+	static listOrchestrationVersions(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/orchestrations/{orchestration_id}/versions",
+			...options
+		});
+	}
+	/**
+	* Fetch an archived orchestration version
+	*
+	* Returns the exact graph a given version describes. Every run records the version it started on in `orchestration_version` and executes that graph for its whole life, so this is how you read the topology a run actually took — including a run whose orchestration has been rewired since.
+	*
+	*/
+	static getOrchestrationVersion(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/orchestrations/{orchestration_id}/versions/{version}",
+			...options
+		});
+	}
+	/**
+	* Restore an archived orchestration graph
+	*
+	* Writes an archived version's graph back as the orchestration's live definition, which archives it again as a **new** version rather than rewinding the counter — so a run pinned to any version in between still resolves the graph it started on.
+	*
+	* The restore runs through the ordinary update path, so the archived graph goes through the same static validation as an authored one. Node resource references (`agent_id`, `tool_id`, `orchestration_id`) resolve when a run reaches the node, so a target deleted since the snapshot was taken restores cleanly and surfaces as a failed run rather than a `400`. Restoring the graph the orchestration already holds is a no-op and archives nothing. Runs already in flight are unaffected either way — a restore is an ordinary edit, and pinning is what keeps it from reaching them.
+	*
+	*/
+	static restoreOrchestrationVersion(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestrations/{orchestration_id}/versions/{version}/restore",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List orchestration runs
+	*
+	* Returns orchestration runs the caller can access, optionally filtered by orchestration.
+	*/
+	static listOrchestrationRuns(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/orchestration-runs",
+			...options
+		});
+	}
+	/**
+	* Start an orchestration run
+	*
+	* Creates a new run for the orchestration named by orchestration_id. By default the run executes durably in the background: the response returns immediately with status "queued" (a worker then claims it and moves it to "running") and progress is observed via get-orchestration-run or run lifecycle webhook events (orchestration_runs.started/awaiting_input/succeeded/failed). Delay and poll waits park the run as "sleeping" and are woken by a background scheduler, surviving restarts. Pass wait=true to block until the run reaches a terminal or awaiting_input state.
+	*/
+	static startOrchestrationRun(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestration-runs",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Cancel an orchestration run
+	*
+	* Cancels a run that has not yet reached a terminal state.
+	*/
+	static cancelOrchestrationRun(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestration-runs/{orchestration_run_id}/cancel",
+			...options
+		});
+	}
+	/**
+	* Submit human input
+	*
+	* Provides human input to a run that is awaiting_input at a human node.
+	*/
+	static submitHumanInput(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestration-runs/{orchestration_run_id}/human-input",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Resume an orchestration run
+	*
+	* Re-drives an awaiting_input orchestration run from its last checkpoint. This does not satisfy the pause itself — it carries no node_id or payload, so a run parked on a human or webhook-receive node re-parks on the same node. Use submit-human-input to supply the awaited payload and advance the run.
+	*/
+	static resumeOrchestrationRun(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/orchestration-runs/{orchestration_run_id}/resume",
+			...options
+		});
+	}
+	/**
+	* Get an orchestration run
+	*
+	* Returns the status, state, and artifacts of a specific run.
+	*/
+	static getOrchestrationRun(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/orchestration-runs/{orchestration_run_id}",
+			...options
+		});
+	}
+};
 var Projects = class {
 	/**
 	* List projects
@@ -2485,6 +2698,97 @@ var Sessions = class {
 		});
 	}
 };
+var Tasks = class {
+	/**
+	* List tasks
+	*
+	* Lists tasks (the board query). Filter by workflow, state, status, or assignee — `GET /tasks?workflow_id=...&state=...` is one board column.
+	*/
+	static listTasks(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/tasks",
+			...options
+		});
+	}
+	/**
+	* Create a task
+	*
+	* Creates a task bound to a workflow. By default the task is placed in the workflow's initial state; passing `state` places it directly in that named state instead — an alternate entry point for starting a task mid-flow (e.g. "a new recorte for an existing theme by id"), rather than re-submitting from the initial state and hoping a guard or similarity gate recognizes it. Entering the resulting state, initial or named, behaves identically: that state's `on_enter` automation fires and its `stalled_after` clock arms.
+	*/
+	static createTask(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/tasks",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a task
+	*
+	* Deletes a task. Its transition history cascades.
+	*/
+	static deleteTask(options) {
+		return (options.client ?? client).delete({
+			url: "/v1/projects/{project_id}/tasks/{task_id}",
+			...options
+		});
+	}
+	/**
+	* Get a task
+	*
+	* Retrieves a task, including its active dispatch and automation status.
+	*/
+	static getTask(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/tasks/{task_id}",
+			...options
+		});
+	}
+	/**
+	* Update a task
+	*
+	* Updates a task's payload, title, or assignee. `state` is never directly writable — move it with a transition; sending a `state` field is rejected as an unknown field (`VALIDATION_FAILED`). `payload` is shallow-merged over the existing payload (PATCH semantics): keys the request omits are preserved. The payload is caller-owned; the automation result lives in the read-only `last_result` field, which no patch can reach. The merged payload is validated against the workflow's `payload_schema`.
+	*/
+	static updateTask(options) {
+		return (options.client ?? client).patch({
+			url: "/v1/projects/{project_id}/tasks/{task_id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Transition a task
+	*
+	* Fires a named transition on a task. The transition must exist in the workflow and be valid from the task's current state; its guard must pass. This is the single path every state change routes through. A transition declaring `requires_approval` does not move the task — it parks a pending ApprovalItem and returns the task with `pending_transition` set; the move applies only when the approval is approved.
+	*/
+	static transitionTask(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/tasks/{task_id}/transitions",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get task history
+	*
+	* Returns the append-only transition history of a task.
+	*/
+	static getTaskHistory(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/tasks/{task_id}/history",
+			...options
+		});
+	}
+};
 var Tools = class {
 	/**
 	* List tools
@@ -2620,27 +2924,26 @@ var Traces = class {
 		});
 	}
 };
-var Users = class {
+var Triggers = class {
 	/**
-	* Get the current user
+	* List triggers
 	*
-	* Returns the account the presented credential resolves to.
+	* Lists triggers. Filter by project, starter type, or target type.
 	*/
-	static getCurrentUser(options) {
-		return (options?.client ?? client).get({
-			url: "/v1/users/me",
+	static listTriggers(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/triggers",
 			...options
 		});
 	}
 	/**
-	* Update the current user
-	*
-	* Edits the account's display name. `name` is required in the body — send null to clear it — so a request that misspelled the field is rejected rather than answered with a silent 200.
+	* Create a trigger
 	*
+	* Creates a new trigger for a project
 	*/
-	static updateCurrentUser(options) {
-		return (options.client ?? client).patch({
-			url: "/v1/users/me",
+	static createTrigger(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/triggers",
 			...options,
 			headers: {
 				"Content-Type": "application/json",
@@ -2648,30 +2951,51 @@ var Users = class {
 			}
 		});
 	}
-};
-var Webhooks = class {
 	/**
-	* List webhooks
+	* Delete a trigger
 	*
-	* The endpoints registered in the project, newest first.
+	* Deletes a trigger
 	*/
-	static listWebhooks(options) {
+	static deleteTrigger(options) {
+		return (options.client ?? client).delete({
+			url: "/v1/projects/{project_id}/triggers/{trigger_id}",
+			...options
+		});
+	}
+	/**
+	* Get a trigger
+	*
+	* Retrieves the details of a specific trigger
+	*/
+	static getTrigger(options) {
 		return (options.client ?? client).get({
-			url: "/v1/projects/{project_id}/webhooks",
+			url: "/v1/projects/{project_id}/triggers/{trigger_id}",
 			...options
 		});
 	}
 	/**
-	* Create a webhook
+	* Update a trigger
 	*
-	* Register an endpoint and subscribe it to one or more event types.
-	* The response carries `secret` — the signing key, in plaintext. **This is the only time it is returned.** Store it where your receiver can read it; if you lose it, rotate rather than re-create, so the endpoint keeps its delivery history.
-	* Returns `501` on a deployment with no credential-sealing key configured, since the secret could not then be stored safely.
+	* Updates an existing trigger's configuration. The type is immutable.
+	*/
+	static updateTrigger(options) {
+		return (options.client ?? client).patch({
+			url: "/v1/projects/{project_id}/triggers/{trigger_id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Fire a trigger
 	*
+	* Fires a trigger synchronously and returns the terminal firing record. The firing itself always settles here; an `eval` target's run is queued rather than executed inline, so the record names a `queued` run to poll.
 	*/
-	static createWebhook(options) {
+	static fireTrigger(options) {
 		return (options.client ?? client).post({
-			url: "/v1/projects/{project_id}/webhooks",
+			url: "/v1/projects/{project_id}/triggers/{trigger_id}/fire",
 			...options,
 			headers: {
 				"Content-Type": "application/json",
@@ -2680,19 +3004,123 @@ var Webhooks = class {
 		});
 	}
 	/**
-	* Delete a webhook
-	*
-	* Removes the endpoint and its delivery records. To stop deliveries while keeping the audit trail, `PATCH` it to `active: false` instead.
+	* Get trigger secret
 	*
+	* Retrieves the signing secret for a webhook trigger
 	*/
-	static deleteWebhook(options) {
-		return (options.client ?? client).delete({
-			url: "/v1/projects/{project_id}/webhooks/{webhook_id}",
+	static getTriggerSecret(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/triggers/{trigger_id}/secret",
 			...options
 		});
 	}
 	/**
-	* Get a webhook
+	* Rotate trigger secret
+	*
+	* Rotates the signing secret for a webhook trigger
+	*/
+	static rotateTriggerSecret(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/triggers/{trigger_id}/rotate-secret",
+			...options
+		});
+	}
+	/**
+	* List trigger firings
+	*
+	* Lists firings for a trigger (trigger_id is required).
+	*/
+	static listTriggerFirings(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/trigger-firings",
+			...options
+		});
+	}
+	/**
+	* Get a trigger firing
+	*
+	* Retrieves the details of a specific trigger firing
+	*/
+	static getTriggerFiring(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/trigger-firings/{firing_id}",
+			...options
+		});
+	}
+};
+var Users = class {
+	/**
+	* Get the current user
+	*
+	* Returns the account the presented credential resolves to.
+	*/
+	static getCurrentUser(options) {
+		return (options?.client ?? client).get({
+			url: "/v1/users/me",
+			...options
+		});
+	}
+	/**
+	* Update the current user
+	*
+	* Edits the account's display name. `name` is required in the body — send null to clear it — so a request that misspelled the field is rejected rather than answered with a silent 200.
+	*
+	*/
+	static updateCurrentUser(options) {
+		return (options.client ?? client).patch({
+			url: "/v1/users/me",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var Webhooks = class {
+	/**
+	* List webhooks
+	*
+	* The endpoints registered in the project, newest first.
+	*/
+	static listWebhooks(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/webhooks",
+			...options
+		});
+	}
+	/**
+	* Create a webhook
+	*
+	* Register an endpoint and subscribe it to one or more event types.
+	* The response carries `secret` — the signing key, in plaintext. **This is the only time it is returned.** Store it where your receiver can read it; if you lose it, rotate rather than re-create, so the endpoint keeps its delivery history.
+	* Returns `501` on a deployment with no credential-sealing key configured, since the secret could not then be stored safely.
+	*
+	*/
+	static createWebhook(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/webhooks",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a webhook
+	*
+	* Removes the endpoint and its delivery records. To stop deliveries while keeping the audit trail, `PATCH` it to `active: false` instead.
+	*
+	*/
+	static deleteWebhook(options) {
+		return (options.client ?? client).delete({
+			url: "/v1/projects/{project_id}/webhooks/{webhook_id}",
+			...options
+		});
+	}
+	/**
+	* Get a webhook
 	*/
 	static getWebhook(options) {
 		return (options.client ?? client).get({
@@ -2769,6 +3197,113 @@ var Webhooks = class {
 		});
 	}
 };
+var Workflows = class {
+	/**
+	* List workflows
+	*
+	* Lists workflow definitions in a project.
+	*/
+	static listWorkflows(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/workflows",
+			...options
+		});
+	}
+	/**
+	* Create a workflow
+	*
+	* Creates a new workflow definition. The definition is statically validated.
+	*/
+	static createWorkflow(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/workflows",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a workflow
+	*
+	* Deletes a workflow. Rejected while open tasks exist.
+	*/
+	static deleteWorkflow(options) {
+		return (options.client ?? client).delete({
+			url: "/v1/projects/{project_id}/workflows/{workflow_id}",
+			...options
+		});
+	}
+	/**
+	* Get a workflow
+	*
+	* Retrieves a workflow definition.
+	*/
+	static getWorkflow(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/workflows/{workflow_id}",
+			...options
+		});
+	}
+	/**
+	* Update a workflow
+	*
+	* Updates a workflow definition. Structural changes (states/transitions) are re-validated. Existing tasks in a removed state stay put but can only leave via transitions valid in the new definition.
+	*/
+	static updateWorkflow(options) {
+		return (options.client ?? client).patch({
+			url: "/v1/projects/{project_id}/workflows/{workflow_id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List a workflow's versions
+	*
+	* Returns the workflow's archived state machines, newest first. A version is written on create and on every subsequent write that changes the definition (`states`, `transitions`, `payload_schema`) — through the REST API or a formation apply alike. Metadata-only edits (name, description) do not archive a version. See [Versioning](/docs/modules/workflows#versioning).
+	*
+	*/
+	static listWorkflowVersions(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/workflows/{workflow_id}/versions",
+			...options
+		});
+	}
+	/**
+	* Fetch an archived workflow version
+	*
+	* Returns the exact state machine a given version describes. Every task records the version it entered on in `workflow_version` and runs on that machine for its whole life, so this is how you read the definition a task is actually being validated against — including a task whose workflow has been rewired since.
+	*
+	*/
+	static getWorkflowVersion(options) {
+		return (options.client ?? client).get({
+			url: "/v1/projects/{project_id}/workflows/{workflow_id}/versions/{version}",
+			...options
+		});
+	}
+	/**
+	* Restore an archived workflow state machine
+	*
+	* Writes an archived version's state machine back as the workflow's live definition, which archives it again as a **new** version rather than rewinding the counter — so a task pinned to any version in between still runs on the machine it entered on.
+	*
+	* The restore runs through the ordinary update path, so the archived definition goes through the same validation as an authored one. That includes resolving every `on_enter` dispatch target, so restoring a version whose agent or orchestration has since been deleted fails with `400` rather than writing a definition that would strand a task on entry. Restoring the definition the workflow already holds is a no-op and archives nothing. Tasks already in flight are unaffected either way — a restore is an ordinary edit, and pinning is what keeps it from reaching them.
+	*
+	*/
+	static restoreWorkflowVersion(options) {
+		return (options.client ?? client).post({
+			url: "/v1/projects/{project_id}/workflows/{workflow_id}/versions/{version}/restore",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
 //#endregion
 //#region ../sdk/src/naturaliClient.ts
 /**
@@ -2829,13 +3364,17 @@ var NaturaliClient = class {
 	generations;
 	modelRoutes;
 	models;
+	orchestrations;
 	projects;
 	secrets;
 	sessions;
+	tasks;
 	tools;
 	traces;
+	triggers;
 	users;
 	webhooks;
+	workflows;
 	/** The underlying HTTP client, for interceptors or one-off requests. */
 	http;
 	constructor({ token, headers } = {}) {
@@ -2859,13 +3398,17 @@ var NaturaliClient = class {
 		this.generations = bindResource(Generations, this.http);
 		this.modelRoutes = bindResource(ModelRoutes, this.http);
 		this.models = bindResource(Models, this.http);
+		this.orchestrations = bindResource(Orchestrations, this.http);
 		this.projects = bindResource(Projects, this.http);
 		this.secrets = bindResource(Secrets, this.http);
 		this.sessions = bindResource(Sessions, this.http);
+		this.tasks = bindResource(Tasks, this.http);
 		this.tools = bindResource(Tools, this.http);
 		this.traces = bindResource(Traces, this.http);
+		this.triggers = bindResource(Triggers, this.http);
 		this.users = bindResource(Users, this.http);
 		this.webhooks = bindResource(Webhooks, this.http);
+		this.workflows = bindResource(Workflows, this.http);
 	}
 };
 //#endregion
@@ -2885,13 +3428,17 @@ var src_exports = /* @__PURE__ */ __exportAll({
 	ModelRoutes: () => ModelRoutes,
 	Models: () => Models,
 	NaturaliClient: () => NaturaliClient,
+	Orchestrations: () => Orchestrations,
 	Projects: () => Projects,
 	Secrets: () => Secrets,
 	Sessions: () => Sessions,
+	Tasks: () => Tasks,
 	Tools: () => Tools,
 	Traces: () => Traces,
+	Triggers: () => Triggers,
 	Users: () => Users,
 	Webhooks: () => Webhooks,
+	Workflows: () => Workflows,
 	createClient: () => createClient,
 	createConfig: () => createConfig
 });
@@ -7677,66 +8224,44 @@ const routes = {
 			}
 		]
 	},
-	"list-projects": {
-		serviceClass: "Projects",
-		operationId: "listProjects",
-		description: "Lists the projects the caller is a member of. A project-scoped API key lists only its own project.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
-		httpMethod: "get",
-		pathParams: [],
-		queryParams: ["limit", "cursor"],
-		flags: [{
-			"name": "limit",
-			"description": "Maximum items per page — an integer from 1 to 100 (default 20).",
-			"required": false,
-			"type": "integer",
-			"in": "query"
-		}, {
-			"name": "cursor",
-			"description": "Opaque pagination cursor from a previous response's next_cursor.",
-			"required": false,
-			"type": "string",
-			"in": "query"
-		}]
-	},
-	"create-project": {
-		serviceClass: "Projects",
-		operationId: "createProject",
-		description: "Creates a project (one per client or per environment).",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
-		httpMethod: "post",
-		pathParams: [],
-		queryParams: [],
-		flags: [{
-			"name": "name",
-			"description": "Human-readable project name.",
-			"required": true,
-			"type": "string",
-			"in": "body"
-		}]
-	},
-	"get-project": {
-		serviceClass: "Projects",
-		operationId: "getProject",
-		description: "Returns one project you are a member of, and your `role` in it. An id you are not a member of — including one that does not exist — responds `404`, not `403`: the API never confirms that an id exists elsewhere. `403` is reserved for the cases where there is nothing to hide: a project you *are* in, addressed with a credential scoped to a different one, or an action your role does not carry. There the message is what makes the failure fixable.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+	"list-orchestrations": {
+		serviceClass: "Orchestrations",
+		operationId: "listOrchestrations",
+		description: "Returns orchestrations accessible to the caller.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
 		httpMethod: "get",
 		pathParams: ["project_id"],
-		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
+		queryParams: ["limit", "offset"],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "limit",
+				"description": "Maximum number of results to return",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "offset",
+				"description": "Number of results to skip",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			}
+		]
 	},
-	"update-project": {
-		serviceClass: "Projects",
-		operationId: "updateProject",
-		description: "Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained. Requires the `admin` role in the project (an `owner` has it too). The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
-		httpMethod: "patch",
+	"create-orchestration": {
+		serviceClass: "Orchestrations",
+		operationId: "createOrchestration",
+		description: "Creates a new orchestration (pipeline) definition in the project.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "post",
 		pathParams: ["project_id"],
 		queryParams: [],
 		flags: [
@@ -7749,63 +8274,117 @@ const routes = {
 			},
 			{
 				"name": "name",
-				"description": "",
-				"required": false,
+				"description": "Human-readable name.",
+				"required": true,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "status",
+				"name": "description",
 				"description": "",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "trace_content_retention_days",
-				"description": "Days of trace and generation content retention before the daily sweep purges it. Send `null` to disable retention (content is then kept until purged on demand). Omitting the field leaves the current window unchanged — `null` and absent are different instructions.\n",
+				"name": "nodes",
+				"description": "",
+				"required": true,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "edges",
+				"description": "",
+				"required": true,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "state_schema",
+				"description": "",
 				"required": false,
-				"type": "integer",
+				"type": "object",
 				"in": "body"
 			},
 			{
-				"name": "trace_content_mode",
-				"description": "Set `none` for zero-retention: content is never written for any agent in this project. Tightening to `none` does not erase content already on disk — purge it explicitly, or set a retention window to have the sweep do it.\n",
+				"name": "input_schema",
+				"description": "",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "version_label",
+				"description": "Optional tag for the version this create archives, e.g. `initial`.",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			}
 		]
 	},
-	"delete-project": {
-		serviceClass: "Projects",
-		operationId: "deleteProject",
-		description: "Permanently deletes the project and its backing runtime project. Fails with 409 if the runtime project still has dependent resources — remove them first, or pass `force=true` to delete the project and all its dependents (agents, providers, tools, sessions, generations, traces). Forcing is destructive and irreversible. Requires the `owner` role — an `admin` runs the project day to day, but destroying it is the billing owner's call.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
-		httpMethod: "delete",
+	"validate-orchestration": {
+		serviceClass: "Orchestrations",
+		operationId: "validateOrchestration",
+		description: "Statically validates an orchestration graph without persisting anything. Checks that every node has its required field, node ids are unique, edges reference existing nodes, the graph is acyclic (unless it contains a loop node), and every `input_mapping` `{\"var\": \"...\"}` reference resolves to a state key written by an upstream node or seeded by `input_schema`. Returns blocking `errors` and non-blocking `warnings` (e.g. a state key only written on a conditional branch). The same `errors` checks are enforced on create and update, which fail with `400` when any error is present.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "post",
 		pathParams: ["project_id"],
-		queryParams: ["force"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "nodes",
+				"description": "",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "edges",
+				"description": "",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "input_schema",
+				"description": "Optional JSON Schema for run inputs; its top-level properties seed state.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			}
+		]
+	},
+	"get-queue-stats": {
+		serviceClass: "Orchestrations",
+		operationId: "getQueueStats",
+		description: "Returns a point-in-time snapshot of the orchestration run queue: how many tasks are waiting to be claimed (`queue_depth`), how many are currently claimed with a valid lease (`claimed_tasks`), the age of the oldest waiting task, recent claim-latency percentiles over a rolling in-process window, and a per-project breakdown. Intended for admin/operator policies; guarded by `orchestrations:GetQueueStats`. A project-scoped caller sees only their own projects under `per_project`.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [],
 		flags: [{
 			"name": "project_id",
 			"description": "Project public ID (proj_ prefix).",
 			"required": true,
 			"type": "string",
 			"in": "path"
-		}, {
-			"name": "force",
-			"description": "When true, delete the resource together with its dependents instead of returning 409. Destructive and irreversible.\n",
-			"required": false,
-			"type": "boolean",
-			"in": "query"
 		}]
 	},
-	"list-project-members": {
-		serviceClass: "Projects",
-		operationId: "listProjectMembers",
-		description: "Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes \"why can that person see my agents?\" unanswerable. Read-only for now — adding and removing members arrives with the invitation flow, since an invitee may not have an account yet.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+	"get-orchestration": {
+		serviceClass: "Orchestrations",
+		operationId: "getOrchestration",
+		description: "Returns the orchestration with nodes and edges.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
 		httpMethod: "get",
-		pathParams: ["project_id"],
+		pathParams: ["project_id", "orchestration_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -7813,21 +8392,22 @@ const routes = {
 			"required": true,
 			"type": "string",
 			"in": "path"
+		}, {
+			"name": "orchestration_id",
+			"description": "Public ID of the orchestration (orch_...)",
+			"required": true,
+			"type": "string",
+			"in": "path"
 		}]
 	},
-	"get-project-usage": {
-		serviceClass: "Projects",
-		operationId: "getProjectUsage",
-		description: "The per-project meter — the re-billing view (A11/C12/P3). Aggregates the project's usage over an optional [from, to] window, bucketed by a single dimension. Costs are the billing-grade cost_usd the runtime freezes at write time; null means nothing in the bucket was priced (never that it was free). Only managed providers are priced (on the runtime), so cost reflects managed usage; BYOK usage carries no LLM cost. Every bucket also carries components — the amounts actually measured. The token counts describe LLM usage alone, so that is where a storage, api_request or compute_execution bucket reports its real quantity instead of zeroed token fields.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
-		httpMethod: "get",
-		pathParams: ["project_id"],
-		queryParams: [
-			"group_by",
-			"meter_type",
-			"from",
-			"to"
-		],
+	"update-orchestration": {
+		serviceClass: "Orchestrations",
+		operationId: "updateOrchestration",
+		description: "Partially updates an orchestration definition.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "patch",
+		pathParams: ["project_id", "orchestration_id"],
+		queryParams: [],
 		flags: [
 			{
 				"name": "project_id",
@@ -7837,42 +8417,92 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "group_by",
-				"description": "Dimension to bucket by.",
-				"required": false,
+				"name": "orchestration_id",
+				"description": "Public ID of the orchestration (orch_...)",
+				"required": true,
 				"type": "string",
-				"in": "query"
+				"in": "path"
 			},
 			{
-				"name": "meter_type",
-				"description": "Narrow the rollup to one meter type (llm_tokens, compute_execution, api_request, storage). Omit to include every meter. Useful with group_by=model, whose dimension otherwise mixes model ids with platform SKUs. An unrecognized value yields an empty rollup, not an error.\n",
+				"name": "name",
+				"description": "",
 				"required": false,
 				"type": "string",
-				"in": "query"
+				"in": "body"
 			},
 			{
-				"name": "from",
-				"description": "Inclusive lower bound (ISO-8601) on event time. Omit for no lower bound.",
+				"name": "description",
+				"description": "",
 				"required": false,
 				"type": "string",
-				"in": "query"
+				"in": "body"
 			},
 			{
-				"name": "to",
-				"description": "Inclusive upper bound (ISO-8601) on event time. Omit for no upper bound.",
+				"name": "nodes",
+				"description": "",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "edges",
+				"description": "",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "state_schema",
+				"description": "",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "input_schema",
+				"description": "",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "version_label",
+				"description": "Optional tag for the version this write archives, e.g. `pre-rewire`. Ignored when the write changes no graph field, since no version is archived.",
 				"required": false,
 				"type": "string",
-				"in": "query"
+				"in": "body"
 			}
 		]
 	},
-	"list-secrets": {
-		serviceClass: "Secrets",
-		operationId: "listSecrets",
-		description: "Returns a list of secrets for a project",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
+	"delete-orchestration": {
+		serviceClass: "Orchestrations",
+		operationId: "deleteOrchestration",
+		description: "Deletes an orchestration definition and all its runs.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "delete",
+		pathParams: ["project_id", "orchestration_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "orchestration_id",
+			"description": "Public ID of the orchestration (orch_...)",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-orchestration-versions": {
+		serviceClass: "Orchestrations",
+		operationId: "listOrchestrationVersions",
+		description: "Returns the orchestration's archived graphs, newest first. A version is written on create and on every subsequent write that changes the graph (`nodes`, `edges`, `state_schema`, `input_schema`) — through the REST API or a formation apply alike. Metadata-only edits (name, description) do not archive a version. See [Versioning](/docs/modules/orchestrations#versioning).",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
 		httpMethod: "get",
-		pathParams: ["project_id"],
+		pathParams: ["project_id", "orchestration_id"],
 		queryParams: ["limit", "offset"],
 		flags: [
 			{
@@ -7882,9 +8512,16 @@ const routes = {
 				"type": "string",
 				"in": "path"
 			},
+			{
+				"name": "orchestration_id",
+				"description": "Public ID of the orchestration (orch_...)",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
 			{
 				"name": "limit",
-				"description": "Number of results per page",
+				"description": "Maximum number of results to return",
 				"required": false,
 				"type": "integer",
 				"in": "query"
@@ -7898,13 +8535,17 @@ const routes = {
 			}
 		]
 	},
-	"create-secret": {
-		serviceClass: "Secrets",
-		operationId: "createSecret",
-		description: "Creates a new encrypted secret in a project",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
-		httpMethod: "post",
-		pathParams: ["project_id"],
+	"get-orchestration-version": {
+		serviceClass: "Orchestrations",
+		operationId: "getOrchestrationVersion",
+		description: "Returns the exact graph a given version describes. Every run records the version it started on in `orchestration_version` and executes that graph for its whole life, so this is how you read the topology a run actually took — including a run whose orchestration has been rewired since.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "get",
+		pathParams: [
+			"project_id",
+			"orchestration_id",
+			"version"
+		],
 		queryParams: [],
 		flags: [
 			{
@@ -7915,50 +8556,32 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "name",
-				"description": "Secret name",
+				"name": "orchestration_id",
+				"description": "Public ID of the orchestration (orch_...)",
 				"required": true,
 				"type": "string",
-				"in": "body"
+				"in": "path"
 			},
 			{
-				"name": "value",
-				"description": "Secret value (will be encrypted)",
+				"name": "version",
+				"description": "The archived version number",
 				"required": true,
-				"type": "string",
-				"in": "body"
+				"type": "integer",
+				"in": "path"
 			}
 		]
 	},
-	"get-secret": {
-		serviceClass: "Secrets",
-		operationId: "getSecret",
-		description: "Returns a specific secret",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
-		httpMethod: "get",
-		pathParams: ["project_id", "secret_id"],
-		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}, {
-			"name": "secret_id",
-			"description": "Secret ID",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
-	},
-	"update-secret": {
-		serviceClass: "Secrets",
-		operationId: "updateSecret",
-		description: "Updates a secret's name and/or value",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
-		httpMethod: "patch",
-		pathParams: ["project_id", "secret_id"],
+	"restore-orchestration-version": {
+		serviceClass: "Orchestrations",
+		operationId: "restoreOrchestrationVersion",
+		description: "Writes an archived version's graph back as the orchestration's live definition, which archives it again as a **new** version rather than rewinding the counter — so a run pinned to any version in between still resolves the graph it started on. The restore runs through the ordinary update path, so the archived graph goes through the same static validation as an authored one. Node resource references (`agent_id`, `tool_id`, `orchestration_id`) resolve when a run reaches the node, so a target deleted since the snapshot was taken restores cleanly and surfaces as a failed run rather than a `400`. Restoring the graph the orchestration already holds is a no-op and archives nothing. Runs already in flight are unaffected either way — a restore is an ordinary edit, and pinning is what keeps it from reaching them.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "post",
+		pathParams: [
+			"project_id",
+			"orchestration_id",
+			"version"
+		],
 		queryParams: [],
 		flags: [
 			{
@@ -7969,61 +8592,37 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "secret_id",
-				"description": "Secret ID",
+				"name": "orchestration_id",
+				"description": "Public ID of the orchestration (orch_...)",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "name",
-				"description": "New secret name",
-				"required": false,
-				"type": "string",
-				"in": "body"
+				"name": "version",
+				"description": "The archived version number",
+				"required": true,
+				"type": "integer",
+				"in": "path"
 			},
 			{
-				"name": "value",
-				"description": "New secret value",
+				"name": "label",
+				"description": "Optional tag for the version the restore creates. Defaults to `restored from v<version>`.",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			}
 		]
 	},
-	"delete-secret": {
-		serviceClass: "Secrets",
-		operationId: "deleteSecret",
-		description: "Deletes a secret",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
-		httpMethod: "delete",
-		pathParams: ["project_id", "secret_id"],
-		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}, {
-			"name": "secret_id",
-			"description": "Secret ID",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
-	},
-	"list-sessions": {
-		serviceClass: "Sessions",
-		operationId: "listSessions",
-		description: "Returns sessions the caller can access, optionally filtered by agent, actor and status.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+	"list-orchestration-runs": {
+		serviceClass: "Orchestrations",
+		operationId: "listOrchestrationRuns",
+		description: "Returns orchestration runs the caller can access, optionally filtered by orchestration.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
 		httpMethod: "get",
 		pathParams: ["project_id"],
 		queryParams: [
-			"agent_id",
-			"actor_id",
-			"status",
+			"orchestration_id",
 			"limit",
 			"offset"
 		],
@@ -8036,47 +8635,33 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "agent_id",
-				"description": "Filter by agent public ID",
-				"required": false,
-				"type": "string",
-				"in": "query"
-			},
-			{
-				"name": "actor_id",
-				"description": "Filter by actor public ID",
-				"required": false,
-				"type": "string",
-				"in": "query"
-			},
-			{
-				"name": "status",
-				"description": "Filter by session status (open, closed, or expired)",
+				"name": "orchestration_id",
+				"description": "Filter by orchestration public ID (orch_...)",
 				"required": false,
 				"type": "string",
 				"in": "query"
 			},
 			{
 				"name": "limit",
-				"description": "",
+				"description": "Maximum number of results to return",
 				"required": false,
 				"type": "integer",
 				"in": "query"
 			},
 			{
 				"name": "offset",
-				"description": "",
+				"description": "Number of results to skip",
 				"required": false,
 				"type": "integer",
 				"in": "query"
 			}
 		]
 	},
-	"create-session": {
-		serviceClass: "Sessions",
-		operationId: "createSession",
-		description: "Creates a new session for the specified agent, along with the underlying conversation, so the caller only needs this single call to start interacting with the agent. No actor is created: pass `actor_id` to attach an existing actor as the session's end user. When it is omitted the session has no actor, and generations in it carry no end-user attribution — they are not billed to an actor in the usage meter and they match no `actor`-scoped quota.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+	"start-orchestration-run": {
+		serviceClass: "Orchestrations",
+		operationId: "startOrchestrationRun",
+		description: "Creates a new run for the orchestration named by orchestration_id. By default the run executes durably in the background: the response returns immediately with status \"queued\" (a worker then claims it and moves it to \"running\") and progress is observed via get-orchestration-run or run lifecycle webhook events (orchestration_runs.started/awaiting_input/succeeded/failed). Delay and poll waits park the run as \"sleeping\" and are woken by a background scheduler, surviving restarts. Pass wait=true to block until the run reaches a terminal or awaiting_input state.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
 		httpMethod: "post",
 		pathParams: ["project_id"],
 		queryParams: [],
@@ -8089,63 +8674,42 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "agent_id",
-				"description": "Agent this session belongs to",
+				"name": "orchestration_id",
+				"description": "Orchestration to run (orch_...).",
 				"required": true,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "name",
-				"description": "Optional session name",
-				"required": false,
-				"type": "string",
-				"in": "body"
-			},
-			{
-				"name": "actor_id",
-				"description": "Optional public ID of an existing actor to use as the user actor. Actors are created separately (POST /actors); this field only links one. Omit it and the session has no end user, so its generations match no actor-scoped quota.\n",
-				"required": false,
-				"type": "string",
-				"in": "body"
-			},
-			{
-				"name": "auto_generate",
-				"description": "When true, automatically triggers generation after each user message.",
+				"name": "input",
+				"description": "Initial state for the run (merged with orchestration defaults).",
 				"required": false,
-				"type": "boolean",
+				"type": "object",
 				"in": "body"
 			},
 			{
 				"name": "tool_context",
-				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this session. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. A key that is not a valid HTTP header name, or two keys that map to the same header, are rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call made by an agent node of this run — including the agents of any child run a `loop` or `sub_orchestration` node starts. The header name is `X-Naturali-Context-` plus the key verbatim; no character is re-cased.\n\nThe bag is stored on the run and re-read on every step, so it survives an `awaiting_input` pause, a `sleeping` wait, a background worker drive and a crash redrive. A key that is not a valid HTTP header name, or two keys that map to the same header, are rejected with `400 INVALID_TOOL_CONTEXT_KEY` and no run is created.\n\nThe reserved identity keys (`sessionId`, `actorId`, `actorExternalId`) are stripped at generation time — a caller cannot address them from here.",
 				"required": false,
 				"type": "object",
 				"in": "body"
 			},
 			{
-				"name": "inactivity_ttl_seconds",
-				"description": "Number of seconds of inactivity after which the session expires. 0 means the session never expires.",
-				"required": false,
-				"type": "integer",
-				"in": "body"
-			},
-			{
-				"name": "message_delay_seconds",
-				"description": "Number of seconds to wait after the last user message before sending to the LLM. Acts as a debounce: each new message resets the timer. null or absent means no delay (immediate processing).\n",
+				"name": "wait",
+				"description": "When true, block until the run reaches a terminal (succeeded/failed) or awaiting_input state and return the settled run. When false (default), return immediately with status \"queued\" and execute the run in the background.",
 				"required": false,
-				"type": "integer",
+				"type": "boolean",
 				"in": "body"
 			}
 		]
 	},
-	"get-session": {
-		serviceClass: "Sessions",
-		operationId: "getSession",
-		description: "Returns details of a single session.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "get",
-		pathParams: ["project_id", "session_id"],
+	"cancel-orchestration-run": {
+		serviceClass: "Orchestrations",
+		operationId: "cancelOrchestrationRun",
+		description: "Cancels a run that has not yet reached a terminal state.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "post",
+		pathParams: ["project_id", "orchestration_run_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8154,20 +8718,20 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "session_id",
-			"description": "Session public ID",
+			"name": "orchestration_run_id",
+			"description": "Public ID of the run (run_...)",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"update-session": {
-		serviceClass: "Sessions",
-		operationId: "updateSession",
-		description: "Updates the session name and/or status.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "patch",
-		pathParams: ["project_id", "session_id"],
+	"submit-human-input": {
+		serviceClass: "Orchestrations",
+		operationId: "submitHumanInput",
+		description: "Provides human input to a run that is awaiting_input at a human node.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "post",
+		pathParams: ["project_id", "orchestration_run_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -8178,63 +8742,35 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "session_id",
-				"description": "Session public ID",
+				"name": "orchestration_run_id",
+				"description": "Public ID of the run (run_...)",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "name",
-				"description": "Session name (set to null to clear)",
-				"required": false,
-				"type": "string",
-				"in": "body"
-			},
-			{
-				"name": "status",
-				"description": "Session status",
-				"required": false,
+				"name": "node_id",
+				"description": "ID of the human node to satisfy.",
+				"required": true,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "auto_generate",
-				"description": "Enable or disable automatic generation after user messages.",
-				"required": false,
-				"type": "boolean",
-				"in": "body"
-			},
-			{
-				"name": "tool_context",
-				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this session. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. A key that is not a valid HTTP header name, or two keys that map to the same header, are rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"name": "output",
+				"description": "Output/response provided by the human reviewer.",
 				"required": false,
 				"type": "object",
 				"in": "body"
-			},
-			{
-				"name": "inactivity_ttl_seconds",
-				"description": "Number of seconds of inactivity after which the session expires. 0 means the session never expires. Updates the stored TTL; the inactivity clock continues from the last activity timestamp.\n",
-				"required": false,
-				"type": "integer",
-				"in": "body"
-			},
-			{
-				"name": "message_delay_seconds",
-				"description": "Number of seconds to wait after the last user message before sending to the LLM. Acts as a debounce: each new message resets the timer. Set to null to disable the delay.\n",
-				"required": false,
-				"type": "integer",
-				"in": "body"
 			}
 		]
 	},
-	"delete-session": {
-		serviceClass: "Sessions",
-		operationId: "deleteSession",
-		description: "Deletes the session and its underlying conversation and messages. The session's actor is not deleted. Generations and traces produced by the session are not deleted either, since they are not linked to the session or conversation.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "delete",
-		pathParams: ["project_id", "session_id"],
+	"resume-orchestration-run": {
+		serviceClass: "Orchestrations",
+		operationId: "resumeOrchestrationRun",
+		description: "Re-drives an awaiting_input orchestration run from its last checkpoint. This does not satisfy the pause itself — it carries no node_id or payload, so a run parked on a human or webhook-receive node re-parks on the same node. Use submit-human-input to supply the awaited payload and advance the run.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "post",
+		pathParams: ["project_id", "orchestration_run_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8243,20 +8779,96 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "session_id",
-			"description": "Session public ID",
+			"name": "orchestration_run_id",
+			"description": "Public ID of the run (run_...)",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"add-session-message": {
-		serviceClass: "Sessions",
-		operationId: "addSessionMessage",
-		description: "Saves a user message to the session. When autoGenerate is enabled on the session and no generation is currently in progress, generation is triggered automatically and the response mirrors GenerateSessionResponse. Otherwise returns the saved user message.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+	"get-orchestration-run": {
+		serviceClass: "Orchestrations",
+		operationId: "getOrchestrationRun",
+		description: "Returns the status, state, and artifacts of a specific run.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/orchestrations",
+		httpMethod: "get",
+		pathParams: ["project_id", "orchestration_run_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "orchestration_run_id",
+			"description": "Public ID of the run (run_...)",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-projects": {
+		serviceClass: "Projects",
+		operationId: "listProjects",
+		description: "Lists the projects the caller is a member of. A project-scoped API key lists only its own project.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+		httpMethod: "get",
+		pathParams: [],
+		queryParams: ["limit", "cursor"],
+		flags: [{
+			"name": "limit",
+			"description": "Maximum items per page — an integer from 1 to 100 (default 20).",
+			"required": false,
+			"type": "integer",
+			"in": "query"
+		}, {
+			"name": "cursor",
+			"description": "Opaque pagination cursor from a previous response's next_cursor.",
+			"required": false,
+			"type": "string",
+			"in": "query"
+		}]
+	},
+	"create-project": {
+		serviceClass: "Projects",
+		operationId: "createProject",
+		description: "Creates a project (one per client or per environment).",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
 		httpMethod: "post",
-		pathParams: ["project_id", "session_id"],
+		pathParams: [],
+		queryParams: [],
+		flags: [{
+			"name": "name",
+			"description": "Human-readable project name.",
+			"required": true,
+			"type": "string",
+			"in": "body"
+		}]
+	},
+	"get-project": {
+		serviceClass: "Projects",
+		operationId: "getProject",
+		description: "Returns one project you are a member of, and your `role` in it. An id you are not a member of — including one that does not exist — responds `404`, not `403`: the API never confirms that an id exists elsewhere. `403` is reserved for the cases where there is nothing to hide: a project you *are* in, addressed with a credential scoped to a different one, or an action your role does not carry. There the message is what makes the failure fixable.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"update-project": {
+		serviceClass: "Projects",
+		operationId: "updateProject",
+		description: "Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained. Requires the `admin` role in the project (an `owner` has it too). The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+		httpMethod: "patch",
+		pathParams: ["project_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -8267,95 +8879,1266 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "session_id",
-				"description": "Session public ID",
-				"required": true,
-				"type": "string",
-				"in": "path"
-			},
-			{
-				"name": "message",
-				"description": "User message text",
+				"name": "name",
+				"description": "",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "tool_context",
-				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this generation. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. An invalid or colliding key is rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"name": "status",
+				"description": "",
 				"required": false,
-				"type": "object",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "idempotency_key",
-				"description": "Optional deduplication key scoped to this session. If a message with the same key already exists in the session, the original message is returned with HTTP 200 and no new message or generation is triggered.\n",
+				"name": "trace_content_retention_days",
+				"description": "Days of trace and generation content retention before the daily sweep purges it. Send `null` to disable retention (content is then kept until purged on demand). Omitting the field leaves the current window unchanged — `null` and absent are different instructions.\n",
 				"required": false,
-				"type": "string",
+				"type": "integer",
 				"in": "body"
 			},
 			{
-				"name": "document_id",
-				"description": "Public ID of a document used as the user message content.",
+				"name": "trace_content_mode",
+				"description": "Set `none` for zero-retention: content is never written for any agent in this project. Tightening to `none` does not erase content already on disk — purge it explicitly, or set a retention window to have the sweep do it.\n",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			}
 		]
 	},
-	"generate-session-response": {
-		serviceClass: "Sessions",
-		operationId: "generateSessionResponse",
-		description: "Triggers the agent to generate a response based on the current conversation. Background by default: returns `202 Accepted` immediately while the generation runs. Pass ?wait=true to block and receive the assistant reply (or a requires_action status if the agent needs client tool outputs) in the response.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "post",
-		pathParams: ["project_id", "session_id"],
-		queryParams: ["wait"],
-		flags: [
-			{
-				"name": "project_id",
-				"description": "Project public ID (proj_ prefix).",
-				"required": true,
+	"delete-project": {
+		serviceClass: "Projects",
+		operationId: "deleteProject",
+		description: "Permanently deletes the project and its backing runtime project. Fails with 409 if the runtime project still has dependent resources — remove them first, or pass `force=true` to delete the project and all its dependents (agents, providers, tools, sessions, generations, traces). Forcing is destructive and irreversible. Requires the `owner` role — an `admin` runs the project day to day, but destroying it is the billing owner's call.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+		httpMethod: "delete",
+		pathParams: ["project_id"],
+		queryParams: ["force"],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "force",
+			"description": "When true, delete the resource together with its dependents instead of returning 409. Destructive and irreversible.\n",
+			"required": false,
+			"type": "boolean",
+			"in": "query"
+		}]
+	},
+	"list-project-members": {
+		serviceClass: "Projects",
+		operationId: "listProjectMembers",
+		description: "Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes \"why can that person see my agents?\" unanswerable. Read-only for now — adding and removing members arrives with the invitation flow, since an invitee may not have an account yet.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"get-project-usage": {
+		serviceClass: "Projects",
+		operationId: "getProjectUsage",
+		description: "The per-project meter — the re-billing view (A11/C12/P3). Aggregates the project's usage over an optional [from, to] window, bucketed by a single dimension. Costs are the billing-grade cost_usd the runtime freezes at write time; null means nothing in the bucket was priced (never that it was free). Only managed providers are priced (on the runtime), so cost reflects managed usage; BYOK usage carries no LLM cost. Every bucket also carries components — the amounts actually measured. The token counts describe LLM usage alone, so that is where a storage, api_request or compute_execution bucket reports its real quantity instead of zeroed token fields.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [
+			"group_by",
+			"meter_type",
+			"from",
+			"to"
+		],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "group_by",
+				"description": "Dimension to bucket by.",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "meter_type",
+				"description": "Narrow the rollup to one meter type (llm_tokens, compute_execution, api_request, storage). Omit to include every meter. Useful with group_by=model, whose dimension otherwise mixes model ids with platform SKUs. An unrecognized value yields an empty rollup, not an error.\n",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "from",
+				"description": "Inclusive lower bound (ISO-8601) on event time. Omit for no lower bound.",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "to",
+				"description": "Inclusive upper bound (ISO-8601) on event time. Omit for no upper bound.",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			}
+		]
+	},
+	"list-secrets": {
+		serviceClass: "Secrets",
+		operationId: "listSecrets",
+		description: "Returns a list of secrets for a project",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: ["limit", "offset"],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "limit",
+				"description": "Number of results per page",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "offset",
+				"description": "Number of results to skip",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			}
+		]
+	},
+	"create-secret": {
+		serviceClass: "Secrets",
+		operationId: "createSecret",
+		description: "Creates a new encrypted secret in a project",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
+		httpMethod: "post",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "name",
+				"description": "Secret name",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "value",
+				"description": "Secret value (will be encrypted)",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			}
+		]
+	},
+	"get-secret": {
+		serviceClass: "Secrets",
+		operationId: "getSecret",
+		description: "Returns a specific secret",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
+		httpMethod: "get",
+		pathParams: ["project_id", "secret_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "secret_id",
+			"description": "Secret ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"update-secret": {
+		serviceClass: "Secrets",
+		operationId: "updateSecret",
+		description: "Updates a secret's name and/or value",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
+		httpMethod: "patch",
+		pathParams: ["project_id", "secret_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "secret_id",
+				"description": "Secret ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "name",
+				"description": "New secret name",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "value",
+				"description": "New secret value",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			}
+		]
+	},
+	"delete-secret": {
+		serviceClass: "Secrets",
+		operationId: "deleteSecret",
+		description: "Deletes a secret",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/secrets",
+		httpMethod: "delete",
+		pathParams: ["project_id", "secret_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "secret_id",
+			"description": "Secret ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-sessions": {
+		serviceClass: "Sessions",
+		operationId: "listSessions",
+		description: "Returns sessions the caller can access, optionally filtered by agent, actor and status.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [
+			"agent_id",
+			"actor_id",
+			"status",
+			"limit",
+			"offset"
+		],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "agent_id",
+				"description": "Filter by agent public ID",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "actor_id",
+				"description": "Filter by actor public ID",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "status",
+				"description": "Filter by session status (open, closed, or expired)",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "limit",
+				"description": "",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "offset",
+				"description": "",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			}
+		]
+	},
+	"create-session": {
+		serviceClass: "Sessions",
+		operationId: "createSession",
+		description: "Creates a new session for the specified agent, along with the underlying conversation, so the caller only needs this single call to start interacting with the agent. No actor is created: pass `actor_id` to attach an existing actor as the session's end user. When it is omitted the session has no actor, and generations in it carry no end-user attribution — they are not billed to an actor in the usage meter and they match no `actor`-scoped quota.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "post",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "agent_id",
+				"description": "Agent this session belongs to",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "name",
+				"description": "Optional session name",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "actor_id",
+				"description": "Optional public ID of an existing actor to use as the user actor. Actors are created separately (POST /actors); this field only links one. Omit it and the session has no end user, so its generations match no actor-scoped quota.\n",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "auto_generate",
+				"description": "When true, automatically triggers generation after each user message.",
+				"required": false,
+				"type": "boolean",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this session. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. A key that is not a valid HTTP header name, or two keys that map to the same header, are rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "inactivity_ttl_seconds",
+				"description": "Number of seconds of inactivity after which the session expires. 0 means the session never expires.",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			},
+			{
+				"name": "message_delay_seconds",
+				"description": "Number of seconds to wait after the last user message before sending to the LLM. Acts as a debounce: each new message resets the timer. null or absent means no delay (immediate processing).\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			}
+		]
+	},
+	"get-session": {
+		serviceClass: "Sessions",
+		operationId: "getSession",
+		description: "Returns details of a single session.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "get",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "session_id",
+			"description": "Session public ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"update-session": {
+		serviceClass: "Sessions",
+		operationId: "updateSession",
+		description: "Updates the session name and/or status.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "patch",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "session_id",
+				"description": "Session public ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "name",
+				"description": "Session name (set to null to clear)",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "status",
+				"description": "Session status",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "auto_generate",
+				"description": "Enable or disable automatic generation after user messages.",
+				"required": false,
+				"type": "boolean",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this session. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. A key that is not a valid HTTP header name, or two keys that map to the same header, are rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "inactivity_ttl_seconds",
+				"description": "Number of seconds of inactivity after which the session expires. 0 means the session never expires. Updates the stored TTL; the inactivity clock continues from the last activity timestamp.\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			},
+			{
+				"name": "message_delay_seconds",
+				"description": "Number of seconds to wait after the last user message before sending to the LLM. Acts as a debounce: each new message resets the timer. Set to null to disable the delay.\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			}
+		]
+	},
+	"delete-session": {
+		serviceClass: "Sessions",
+		operationId: "deleteSession",
+		description: "Deletes the session and its underlying conversation and messages. The session's actor is not deleted. Generations and traces produced by the session are not deleted either, since they are not linked to the session or conversation.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "delete",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "session_id",
+			"description": "Session public ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"add-session-message": {
+		serviceClass: "Sessions",
+		operationId: "addSessionMessage",
+		description: "Saves a user message to the session. When autoGenerate is enabled on the session and no generation is currently in progress, generation is triggered automatically and the response mirrors GenerateSessionResponse. Otherwise returns the saved user message.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "post",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "session_id",
+				"description": "Session public ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "message",
+				"description": "User message text",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this generation. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. An invalid or colliding key is rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "idempotency_key",
+				"description": "Optional deduplication key scoped to this session. If a message with the same key already exists in the session, the original message is returned with HTTP 200 and no new message or generation is triggered.\n",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "document_id",
+				"description": "Public ID of a document used as the user message content.",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			}
+		]
+	},
+	"generate-session-response": {
+		serviceClass: "Sessions",
+		operationId: "generateSessionResponse",
+		description: "Triggers the agent to generate a response based on the current conversation. Background by default: returns `202 Accepted` immediately while the generation runs. Pass ?wait=true to block and receive the assistant reply (or a requires_action status if the agent needs client tool outputs) in the response.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "post",
+		pathParams: ["project_id", "session_id"],
+		queryParams: ["wait"],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "session_id",
+				"description": "Session public ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "wait",
+				"description": "When omitted or `false` (default), generation runs in the background and `202 Accepted` is returned immediately. Pass `true` to block until the generation settles and receive the result.",
+				"required": false,
+				"type": "boolean",
+				"in": "query"
+			},
+			{
+				"name": "model",
+				"description": "Optional model override",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this generation. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. An invalid or colliding key is rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			}
+		]
+	},
+	"submit-session-tool-outputs": {
+		serviceClass: "Sessions",
+		operationId: "submitSessionToolOutputs",
+		description: "Submits client tool outputs for a generation that returned requires_action. The agent continues its loop and returns the final or next requires_action result.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "post",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "session_id",
+				"description": "Session public ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "generation_id",
+				"description": "The generation ID from the requires_action response",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "tool_outputs",
+				"description": "",
+				"required": true,
+				"type": "array",
+				"in": "body"
+			}
+		]
+	},
+	"fork-session": {
+		serviceClass: "Sessions",
+		operationId: "forkSession",
+		description: "Branches a new session from a point in this session's history: same context, different continuation. The fork gets its own conversation whose messages **reference the same documents** as the parent rather than copying them, so there is one stored copy of the content and a retention purge erases it from both. Recorded tool results ride along on those messages and are **replayed** as model input on the fork's next turn — forking never re-invokes a tool, so exploring a \"what if\" cannot send an email or charge a card a second time. The consequence to accept is that a forked turn sees the tool data as it was, not as it is now. The fork is created **inert**: `auto_generate` is false and no generation is triggered. Drive it with the normal message and generate endpoints. The fork has no actor — attach one only if the branch is meant to be driven by the same end user, since `single_session_per_actor` agents allow one open session per actor.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "post",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "session_id",
+				"description": "Session public ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "fork_at_position",
+				"description": "The parent conversation `position` to branch after. Messages at positions 0..N are carried into the fork. Omit it to branch at the tip (the whole history).\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			},
+			{
+				"name": "agent_id",
+				"description": "Agent the fork runs against. Defaults to the parent session's agent; overriding it is the point of forking — same context, a different agent or agent version. Must belong to the same project as the session being forked.\n",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "name",
+				"description": "Optional name for the forked session",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "tags",
+				"description": "Optional tags for the forked session",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Overrides the parent's `tool_context` on the fork. Omit it and the fork inherits the parent's, so the branch is faithful to the run it came from.\n",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			}
+		]
+	},
+	"list-session-forks": {
+		serviceClass: "Sessions",
+		operationId: "listSessionForks",
+		description: "Returns the sessions forked directly from this one. One level of lineage: a fork of a fork is listed under its own parent.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "get",
+		pathParams: ["project_id", "session_id"],
+		queryParams: ["limit", "offset"],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "session_id",
+				"description": "Session public ID",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "limit",
+				"description": "",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "offset",
+				"description": "",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			}
+		]
+	},
+	"get-session-tags": {
+		serviceClass: "Sessions",
+		operationId: "getSessionTags",
+		description: "Returns the session's tags object.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "get",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "session_id",
+			"description": "Session public ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"replace-session-tags": {
+		serviceClass: "Sessions",
+		operationId: "replaceSessionTags",
+		description: "Replaces all tags on the session.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "put",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "session_id",
+			"description": "Session public ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"merge-session-tags": {
+		serviceClass: "Sessions",
+		operationId: "mergeSessionTags",
+		description: "Merges the provided tags into the session's existing tags.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+		httpMethod: "patch",
+		pathParams: ["project_id", "session_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "session_id",
+			"description": "Session public ID",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-tasks": {
+		serviceClass: "Tasks",
+		operationId: "listTasks",
+		description: "Lists tasks (the board query). Filter by workflow, state, status, or assignee — `GET /tasks?workflow_id=...&state=...` is one board column.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [
+			"workflow_id",
+			"state",
+			"status",
+			"assignee",
+			"limit",
+			"offset"
+		],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "workflow_id",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "state",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "status",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "assignee",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "limit",
+				"description": "Maximum number of results to return",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "offset",
+				"description": "Number of results to skip",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			}
+		]
+	},
+	"create-task": {
+		serviceClass: "Tasks",
+		operationId: "createTask",
+		description: "Creates a task bound to a workflow. By default the task is placed in the workflow's initial state; passing `state` places it directly in that named state instead — an alternate entry point for starting a task mid-flow (e.g. \"a new recorte for an existing theme by id\"), rather than re-submitting from the initial state and hoping a guard or similarity gate recognizes it. Entering the resulting state, initial or named, behaves identically: that state's `on_enter` automation fires and its `stalled_after` clock arms.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "post",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "workflow_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "title",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "payload",
+				"description": "",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "assignee",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "state",
+				"description": "Name of a declared workflow state to create the task in directly, instead of the workflow's `initial` state. Must name a state declared on the workflow, or the request is rejected with `TASK_STATE_NOT_FOUND` (400). Defaults to the `initial` state.",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call made by this task's automation dispatches — the agent generations a state's `on_enter` starts, and the agent nodes of any orchestration run it starts. The header name is `X-Naturali-Context-` plus the key verbatim; no character is re-cased.\nCreation is the task's first move, so this is the bag the entry state's `on_enter` runs with. Each transition may replace it (see `TransitionTaskRequest.tool_context`).\nThe reserved identity keys (`sessionId`, `actorId`, `actorExternalId`) are stripped in any casing and re-derived server-side, so a task-dispatched generation cannot forge them. A key outside the HTTP header-name grammar is rejected with `INVALID_TOOL_CONTEXT_KEY` (400).\nWrite-only: the stored bag is never returned by any task read, and it is cleared when the task reaches a terminal state.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			}
+		]
+	},
+	"get-task": {
+		serviceClass: "Tasks",
+		operationId: "getTask",
+		description: "Retrieves a task, including its active dispatch and automation status.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "get",
+		pathParams: ["project_id", "task_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "task_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"update-task": {
+		serviceClass: "Tasks",
+		operationId: "updateTask",
+		description: "Updates a task's payload, title, or assignee. `state` is never directly writable — move it with a transition; sending a `state` field is rejected as an unknown field (`VALIDATION_FAILED`). `payload` is shallow-merged over the existing payload (PATCH semantics): keys the request omits are preserved. The payload is caller-owned; the automation result lives in the read-only `last_result` field, which no patch can reach. The merged payload is validated against the workflow's `payload_schema`.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "patch",
+		pathParams: ["project_id", "task_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "task_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "title",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "payload",
+				"description": "Partial payload, shallow-merged over the existing payload. Omitted keys are preserved; provided keys overwrite. The merged result must satisfy the workflow's payload_schema.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "assignee",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			}
+		]
+	},
+	"delete-task": {
+		serviceClass: "Tasks",
+		operationId: "deleteTask",
+		description: "Deletes a task. Its transition history cascades.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "delete",
+		pathParams: ["project_id", "task_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "task_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"transition-task": {
+		serviceClass: "Tasks",
+		operationId: "transitionTask",
+		description: "Fires a named transition on a task. The transition must exist in the workflow and be valid from the task's current state; its guard must pass. This is the single path every state change routes through. A transition declaring `requires_approval` does not move the task — it parks a pending ApprovalItem and returns the task with `pending_transition` set; the move applies only when the approval is approved.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "post",
+		pathParams: ["project_id", "task_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "task_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "transition",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "note",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "tool_context",
+				"description": "Caller context for the automation dispatches the task makes from here on, forwarded as `X-Naturali-Context-<key>` headers on their tool calls.\nSupplying it **replaces** the task's stored bag wholesale; omitting it keeps the current one, so the context follows whoever last moved the task and survives every move that does not speak about it — including an approval gate, a retry, and an automation hop. Send an empty object to clear it without closing the task.\nThe reserved identity keys (`sessionId`, `actorId`, `actorExternalId`) are stripped in any casing and re-derived server-side. A key outside the HTTP header-name grammar is rejected with `INVALID_TOOL_CONTEXT_KEY` (400).\nWrite-only: never returned by a task read, and cleared when the transition closes the task.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			}
+		]
+	},
+	"get-task-history": {
+		serviceClass: "Tasks",
+		operationId: "getTaskHistory",
+		description: "Returns the append-only transition history of a task.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tasks",
+		httpMethod: "get",
+		pathParams: ["project_id", "task_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "task_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-tools": {
+		serviceClass: "Tools",
+		operationId: "listTools",
+		description: "Returns all tools in the project.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: ["limit", "offset"],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "limit",
+				"description": "Maximum number of results to return",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "offset",
+				"description": "Number of results to skip",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			}
+		]
+	},
+	"create-tool": {
+		serviceClass: "Tools",
+		operationId: "createTool",
+		description: "Creates a new tool in the project.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+		httpMethod: "post",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "session_id",
-				"description": "Session public ID",
+				"name": "name",
+				"description": "Tool name",
 				"required": true,
 				"type": "string",
-				"in": "path"
+				"in": "body"
 			},
 			{
-				"name": "wait",
-				"description": "When omitted or `false` (default), generation runs in the background and `202 Accepted` is returned immediately. Pass `true` to block until the generation settles and receive the result.",
+				"name": "type",
+				"description": "Tool type (default http)",
 				"required": false,
-				"type": "boolean",
-				"in": "query"
+				"type": "string",
+				"in": "body"
 			},
 			{
-				"name": "model",
-				"description": "Optional model override",
+				"name": "description",
+				"description": "What the tool does",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "tool_context",
-				"description": "Key-value pairs forwarded as `X-Naturali-Context-<key>` headers on every `http` and `mcp` tool call in this generation. The header name is the deployment's configured context prefix (`X-Naturali-Context-` by default) plus the key verbatim — no character is re-cased. Keys are never case-converted — they round-trip exactly as sent. An invalid or colliding key is rejected with `400 INVALID_TOOL_CONTEXT_KEY`.",
+				"name": "parameters",
+				"description": "JSON Schema for tool input",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "execute",
+				"description": "Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, and `body_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself).\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "mcp",
+				"description": "MCP server config (`url`, `headers`). `headers` values accept `{{secret:...}}` and `{{context:<key>}}` references, resolved right before the outbound MCP request; `url` accepts `{{secret:...}}` only.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "actions",
+				"description": "Allowlist of actions. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface — omit or set `null` to expose every tool the MCP server offers. Ignored for other tool types.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "denied_actions",
+				"description": "For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. Omit or set `null` to deny nothing. Ignored for other tool types.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "context_keys",
+				"description": "Optional allowlist of `tool_context` keys that may be forwarded to this tool as prefixed context headers (`X-Naturali-Context-<key>` by default). When `null` or omitted, every key in the caller's `tool_context` is forwarded — the behavior of every tool created before this field existed. When set, only the listed keys are, so a per-user credential in `tool_context` can be confined to the tools that need it; `[]` forwards none. The server-pinned identity keys (`sessionId`, `actorId`, `actorExternalId`) are always forwarded. A key consumed by a `{{context:<key>}}` token in this tool's own headers is substituted regardless of this list — the tool declared that header itself.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "preset_parameters",
+				"description": "Fixed parameters merged into every action-based tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "pipeline",
+				"description": "Pipeline definition for `pipeline` tools. See the `pipeline` field on the Tool schema for the full structure.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "output_mapping",
+				"description": "Universal JSON Logic mapping applied to the tool's raw result. See the `output_mapping` field on the Tool schema for details.",
 				"required": false,
 				"type": "object",
 				"in": "body"
+			},
+			{
+				"name": "guardrail_ids",
+				"description": "Guardrails attached at the tool scope.",
+				"required": false,
+				"type": "array",
+				"in": "body"
 			}
 		]
 	},
-	"submit-session-tool-outputs": {
-		serviceClass: "Sessions",
-		operationId: "submitSessionToolOutputs",
-		description: "Submits client tool outputs for a generation that returned requires_action. The agent continues its loop and returns the final or next requires_action result.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "post",
-		pathParams: ["project_id", "session_id"],
+	"get-tool": {
+		serviceClass: "Tools",
+		operationId: "getTool",
+		description: "Returns a single tool by ID.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+		httpMethod: "get",
+		pathParams: ["project_id", "tool_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "tool_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"update-tool": {
+		serviceClass: "Tools",
+		operationId: "updateTool",
+		description: "Updates an existing tool.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+		httpMethod: "patch",
+		pathParams: ["project_id", "tool_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -8366,35 +10149,134 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "session_id",
-				"description": "Session public ID",
+				"name": "tool_id",
+				"description": "",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "generation_id",
-				"description": "The generation ID from the requires_action response",
-				"required": true,
+				"name": "name",
+				"description": "",
+				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "tool_outputs",
+				"name": "type",
 				"description": "",
-				"required": true,
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "description",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "parameters",
+				"description": "",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "execute",
+				"description": "Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, and `body_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself).\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "mcp",
+				"description": "MCP server config (`url`, `headers`). `headers` values accept `{{secret:...}}` and `{{context:<key>}}` references, resolved right before the outbound MCP request; `url` accepts `{{secret:...}}` only.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "actions",
+				"description": "Allowlist of actions. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface (`null` exposes every tool). Ignored for other tool types.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "denied_actions",
+				"description": "For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. `null` denies nothing. Ignored for other tool types.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "context_keys",
+				"description": "Optional allowlist of `tool_context` keys that may be forwarded to this tool as prefixed context headers (`X-Naturali-Context-<key>` by default). When `null` or omitted, every key in the caller's `tool_context` is forwarded — the behavior of every tool created before this field existed. When set, only the listed keys are, so a per-user credential in `tool_context` can be confined to the tools that need it; `[]` forwards none. The server-pinned identity keys (`sessionId`, `actorId`, `actorExternalId`) are always forwarded. A key consumed by a `{{context:<key>}}` token in this tool's own headers is substituted regardless of this list — the tool declared that header itself.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
+			{
+				"name": "preset_parameters",
+				"description": "Fixed parameters merged into every action-based tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "pipeline",
+				"description": "Pipeline definition for `pipeline` tools. See the `pipeline` field on the Tool schema for the full structure.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "output_mapping",
+				"description": "Universal JSON Logic mapping applied to the tool's raw result. See the `output_mapping` field on the Tool schema for details.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "guardrail_ids",
+				"description": "Guardrails attached at the tool scope.",
+				"required": false,
 				"type": "array",
 				"in": "body"
 			}
 		]
 	},
-	"fork-session": {
-		serviceClass: "Sessions",
-		operationId: "forkSession",
-		description: "Branches a new session from a point in this session's history: same context, different continuation. The fork gets its own conversation whose messages **reference the same documents** as the parent rather than copying them, so there is one stored copy of the content and a retention purge erases it from both. Recorded tool results ride along on those messages and are **replayed** as model input on the fork's next turn — forking never re-invokes a tool, so exploring a \"what if\" cannot send an email or charge a card a second time. The consequence to accept is that a forked turn sees the tool data as it was, not as it is now. The fork is created **inert**: `auto_generate` is false and no generation is triggered. Drive it with the normal message and generate endpoints. The fork has no actor — attach one only if the branch is meant to be driven by the same end user, since `single_session_per_actor` agents allow one open session per actor.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+	"delete-tool": {
+		serviceClass: "Tools",
+		operationId: "deleteTool",
+		description: "Deletes a tool by ID.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+		httpMethod: "delete",
+		pathParams: ["project_id", "tool_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "tool_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"call-tool": {
+		serviceClass: "Tools",
+		operationId: "callTool",
+		description: "Directly invokes a tool and returns its output. Supported for `http`, `mcp` and `pipeline` tools. `client` tools cannot be invoked server-side and will return 422. A `pipeline` tool runs its declared steps in order and returns the mapped `output` (or the last step's output); `action` is ignored and `input` is the pipeline input. For `mcp` tools the `action` field is required and identifies which tool name to invoke. For `http` tools `action` is ignored. When an `mcp` tool declares an `actions` allowlist, an action outside it is rejected with `400 VALIDATION_FAILED` (\"not available on this tool\") before any outbound request is made. `preset_parameters` stored on the tool are merged with the caller-supplied `input` before execution; preset keys take lower precedence.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
 		httpMethod: "post",
-		pathParams: ["project_id", "session_id"],
+		pathParams: ["project_id", "tool_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -8405,56 +10287,35 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "session_id",
-				"description": "Session public ID",
+				"name": "tool_id",
+				"description": "",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "fork_at_position",
-				"description": "The parent conversation `position` to branch after. Messages at positions 0..N are carried into the fork. Omit it to branch at the tip (the whole history).\n",
-				"required": false,
-				"type": "integer",
-				"in": "body"
-			},
-			{
-				"name": "agent_id",
-				"description": "Agent the fork runs against. Defaults to the parent session's agent; overriding it is the point of forking — same context, a different agent or agent version. Must belong to the same project as the session being forked.\n",
-				"required": false,
-				"type": "string",
-				"in": "body"
-			},
-			{
-				"name": "name",
-				"description": "Optional name for the forked session",
+				"name": "action",
+				"description": "For `mcp` tools: the MCP tool name to invoke (must be in the tool's `actions` allowlist when one is set, and must not be in its `denied_actions` denylist). Ignored for `http` tools.\n",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "tags",
-				"description": "Optional tags for the forked session",
-				"required": false,
-				"type": "object",
-				"in": "body"
-			},
-			{
-				"name": "tool_context",
-				"description": "Overrides the parent's `tool_context` on the fork. Omit it and the fork inherits the parent's, so the branch is faithful to the run it came from.\n",
+				"name": "input",
+				"description": "Input parameters for the tool call. These are merged with the tool's `preset_parameters` before execution (caller-supplied values take precedence).\n",
 				"required": false,
 				"type": "object",
 				"in": "body"
 			}
 		]
 	},
-	"list-session-forks": {
-		serviceClass: "Sessions",
-		operationId: "listSessionForks",
-		description: "Returns the sessions forked directly from this one. One level of lineage: a fork of a fork is listed under its own parent.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+	"list-traces": {
+		serviceClass: "Traces",
+		operationId: "listTraces",
+		description: "Returns a paginated list of execution traces for the project.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
 		httpMethod: "get",
-		pathParams: ["project_id", "session_id"],
+		pathParams: ["project_id"],
 		queryParams: ["limit", "offset"],
 		flags: [
 			{
@@ -8464,36 +10325,29 @@ const routes = {
 				"type": "string",
 				"in": "path"
 			},
-			{
-				"name": "session_id",
-				"description": "Session public ID",
-				"required": true,
-				"type": "string",
-				"in": "path"
-			},
 			{
 				"name": "limit",
-				"description": "",
+				"description": "Maximum number of results to return",
 				"required": false,
 				"type": "integer",
 				"in": "query"
 			},
 			{
 				"name": "offset",
-				"description": "",
+				"description": "Number of results to skip",
 				"required": false,
 				"type": "integer",
 				"in": "query"
 			}
 		]
 	},
-	"get-session-tags": {
-		serviceClass: "Sessions",
-		operationId: "getSessionTags",
-		description: "Returns the session's tags object.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
+	"get-trace": {
+		serviceClass: "Traces",
+		operationId: "getTrace",
+		description: "Returns a single trace by ID.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
 		httpMethod: "get",
-		pathParams: ["project_id", "session_id"],
+		pathParams: ["project_id", "trace_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8502,42 +10356,52 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "session_id",
-			"description": "Session public ID",
+			"name": "trace_id",
+			"description": "Public ID of the trace",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"replace-session-tags": {
-		serviceClass: "Sessions",
-		operationId: "replaceSessionTags",
-		description: "Replaces all tags on the session.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "put",
-		pathParams: ["project_id", "session_id"],
-		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}, {
-			"name": "session_id",
-			"description": "Session public ID",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
+	"get-trace-tree": {
+		serviceClass: "Traces",
+		operationId: "getTraceTree",
+		description: "Returns the full execution tree rooted at the given trace (or its root if the given trace is a child). Each node represents one agent's execution session. The `children` array contains traces triggered by sub-agent tool calls from that trace.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
+		httpMethod: "get",
+		pathParams: ["project_id", "trace_id"],
+		queryParams: ["include"],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "trace_id",
+				"description": "Public ID of any trace in the tree (root or child)",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "include",
+				"description": "Comma-separated list of related resources to embed on each node. Supported value: `generations` — attaches all generations that belong to each trace node (including sub-agent generations linked via `initiator_generation_id`).\n",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			}
+		]
 	},
-	"merge-session-tags": {
-		serviceClass: "Sessions",
-		operationId: "mergeSessionTags",
-		description: "Merges the provided tags into the session's existing tags.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/sessions",
-		httpMethod: "patch",
-		pathParams: ["project_id", "session_id"],
+	"purge-trace-content": {
+		serviceClass: "Traces",
+		operationId: "purgeTraceContent",
+		description: "Deletes the trace's steps object from storage and clears its content columns (`file_id`, `error`), cascading to every descendant trace and to all of their generations. A descendant holds its own steps object covering the same run, so the cascade is what makes the erasure complete rather than merely partial. The rows survive as auditable skeletons with `content_redacted_at` set — ids, timestamps, step counts, and the generations' usage-attribution fields are preserved, because the billing and audit ledger must outlive a tenant's erasure of the content. A purged trace therefore reads back as a skeleton, not a 404: a 404 would prove nothing. Idempotent — purging an already-purged trace succeeds and leaves the original `content_redacted_at` in place.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
+		httpMethod: "delete",
+		pathParams: ["project_id", "trace_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8546,21 +10410,26 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "session_id",
-			"description": "Session public ID",
+			"name": "trace_id",
+			"description": "Public ID of the trace",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"list-tools": {
-		serviceClass: "Tools",
-		operationId: "listTools",
-		description: "Returns all tools in the project.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+	"list-triggers": {
+		serviceClass: "Triggers",
+		operationId: "listTriggers",
+		description: "Lists triggers. Filter by project, starter type, or target type.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
 		httpMethod: "get",
 		pathParams: ["project_id"],
-		queryParams: ["limit", "offset"],
+		queryParams: [
+			"type",
+			"target_type",
+			"limit",
+			"offset"
+		],
 		flags: [
 			{
 				"name": "project_id",
@@ -8569,6 +10438,20 @@ const routes = {
 				"type": "string",
 				"in": "path"
 			},
+			{
+				"name": "type",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "target_type",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
 			{
 				"name": "limit",
 				"description": "Maximum number of results to return",
@@ -8585,11 +10468,11 @@ const routes = {
 			}
 		]
 	},
-	"create-tool": {
-		serviceClass: "Tools",
-		operationId: "createTool",
-		description: "Creates a new tool in the project.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
+	"create-trigger": {
+		serviceClass: "Triggers",
+		operationId: "createTrigger",
+		description: "Creates a new trigger for a project",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
 		httpMethod: "post",
 		pathParams: ["project_id"],
 		queryParams: [],
@@ -8603,104 +10486,193 @@ const routes = {
 			},
 			{
 				"name": "name",
-				"description": "Tool name",
+				"description": "",
 				"required": true,
 				"type": "string",
 				"in": "body"
 			},
+			{
+				"name": "description",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
 			{
 				"name": "type",
-				"description": "Tool type (default http)",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "target_type",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "target_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "action",
+				"description": "Tool targets only — the action for mcp tools",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "description",
-				"description": "What the tool does",
+				"name": "input",
+				"description": "",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "cron",
+				"description": "5-field cron expression (UTC). Required when type is schedule",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "active",
+				"description": "",
+				"required": false,
+				"type": "boolean",
+				"in": "body"
+			},
+			{
+				"name": "policy_id",
+				"description": "",
 				"required": false,
 				"type": "string",
-				"in": "body"
+				"in": "body"
+			}
+		]
+	},
+	"get-trigger": {
+		serviceClass: "Triggers",
+		operationId: "getTrigger",
+		description: "Retrieves the details of a specific trigger",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "get",
+		pathParams: ["project_id", "trigger_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "trigger_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"update-trigger": {
+		serviceClass: "Triggers",
+		operationId: "updateTrigger",
+		description: "Updates an existing trigger's configuration. The type is immutable.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "patch",
+		pathParams: ["project_id", "trigger_id"],
+		queryParams: [],
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
 			},
 			{
-				"name": "parameters",
-				"description": "JSON Schema for tool input",
-				"required": false,
-				"type": "object",
-				"in": "body"
+				"name": "trigger_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "path"
 			},
 			{
-				"name": "execute",
-				"description": "Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, and `body_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself).\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
+				"name": "name",
+				"description": "",
 				"required": false,
-				"type": "object",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "mcp",
-				"description": "MCP server config (`url`, `headers`). `headers` values accept `{{secret:...}}` and `{{context:<key>}}` references, resolved right before the outbound MCP request; `url` accepts `{{secret:...}}` only.",
+				"name": "description",
+				"description": "",
 				"required": false,
-				"type": "object",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "actions",
-				"description": "Allowlist of actions. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface — omit or set `null` to expose every tool the MCP server offers. Ignored for other tool types.",
+				"name": "target_type",
+				"description": "",
 				"required": false,
-				"type": "array",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "denied_actions",
-				"description": "For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. Omit or set `null` to deny nothing. Ignored for other tool types.",
+				"name": "target_id",
+				"description": "",
 				"required": false,
-				"type": "array",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "context_keys",
-				"description": "Optional allowlist of `tool_context` keys that may be forwarded to this tool as prefixed context headers (`X-Naturali-Context-<key>` by default). When `null` or omitted, every key in the caller's `tool_context` is forwarded — the behavior of every tool created before this field existed. When set, only the listed keys are, so a per-user credential in `tool_context` can be confined to the tools that need it; `[]` forwards none. The server-pinned identity keys (`sessionId`, `actorId`, `actorExternalId`) are always forwarded. A key consumed by a `{{context:<key>}}` token in this tool's own headers is substituted regardless of this list — the tool declared that header itself.",
+				"name": "action",
+				"description": "",
 				"required": false,
-				"type": "array",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "preset_parameters",
-				"description": "Fixed parameters merged into every action-based tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.",
+				"name": "input",
+				"description": "",
 				"required": false,
 				"type": "object",
 				"in": "body"
 			},
 			{
-				"name": "pipeline",
-				"description": "Pipeline definition for `pipeline` tools. See the `pipeline` field on the Tool schema for the full structure.",
+				"name": "cron",
+				"description": "",
 				"required": false,
-				"type": "object",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "output_mapping",
-				"description": "Universal JSON Logic mapping applied to the tool's raw result. See the `output_mapping` field on the Tool schema for details.",
+				"name": "active",
+				"description": "",
 				"required": false,
-				"type": "object",
+				"type": "boolean",
 				"in": "body"
 			},
 			{
-				"name": "guardrail_ids",
-				"description": "Guardrails attached at the tool scope.",
+				"name": "policy_id",
+				"description": "",
 				"required": false,
-				"type": "array",
+				"type": "string",
 				"in": "body"
 			}
 		]
 	},
-	"get-tool": {
-		serviceClass: "Tools",
-		operationId: "getTool",
-		description: "Returns a single tool by ID.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
-		httpMethod: "get",
-		pathParams: ["project_id", "tool_id"],
+	"delete-trigger": {
+		serviceClass: "Triggers",
+		operationId: "deleteTrigger",
+		description: "Deletes a trigger",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "delete",
+		pathParams: ["project_id", "trigger_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8709,20 +10681,20 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "tool_id",
+			"name": "trigger_id",
 			"description": "",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"update-tool": {
-		serviceClass: "Tools",
-		operationId: "updateTool",
-		description: "Updates an existing tool.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
-		httpMethod: "patch",
-		pathParams: ["project_id", "tool_id"],
+	"fire-trigger": {
+		serviceClass: "Triggers",
+		operationId: "fireTrigger",
+		description: "Fires a trigger synchronously and returns the terminal firing record. The firing itself always settles here; an `eval` target's run is queued rather than executed inline, so the record names a `queued` run to poll.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "post",
+		pathParams: ["project_id", "trigger_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -8733,112 +10705,241 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "tool_id",
+				"name": "trigger_id",
 				"description": "",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "name",
-				"description": "",
+				"name": "input",
+				"description": "Fire-time input, shallow-merged over the trigger's static input. For `eval` targets it may carry `agent_version` and `baseline_run_id`.",
 				"required": false,
-				"type": "string",
+				"type": "object",
 				"in": "body"
-			},
+			}
+		]
+	},
+	"get-trigger-secret": {
+		serviceClass: "Triggers",
+		operationId: "getTriggerSecret",
+		description: "Retrieves the signing secret for a webhook trigger",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "get",
+		pathParams: ["project_id", "trigger_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "trigger_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"rotate-trigger-secret": {
+		serviceClass: "Triggers",
+		operationId: "rotateTriggerSecret",
+		description: "Rotates the signing secret for a webhook trigger",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "post",
+		pathParams: ["project_id", "trigger_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "trigger_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-trigger-firings": {
+		serviceClass: "Triggers",
+		operationId: "listTriggerFirings",
+		description: "Lists firings for a trigger (trigger_id is required).",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: [
+			"trigger_id",
+			"limit",
+			"offset"
+		],
+		flags: [
 			{
-				"name": "type",
-				"description": "",
-				"required": false,
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
 				"type": "string",
-				"in": "body"
+				"in": "path"
 			},
 			{
-				"name": "description",
-				"description": "",
-				"required": false,
+				"name": "trigger_id",
+				"description": "Trigger to list firings for (trg_...)",
+				"required": true,
 				"type": "string",
-				"in": "body"
+				"in": "query"
 			},
 			{
-				"name": "parameters",
+				"name": "limit",
 				"description": "",
 				"required": false,
-				"type": "object",
-				"in": "body"
+				"type": "integer",
+				"in": "query"
 			},
 			{
-				"name": "execute",
-				"description": "Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, and `body_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself).\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
+				"name": "offset",
+				"description": "",
 				"required": false,
-				"type": "object",
-				"in": "body"
-			},
+				"type": "integer",
+				"in": "query"
+			}
+		]
+	},
+	"get-trigger-firing": {
+		serviceClass: "Triggers",
+		operationId: "getTriggerFiring",
+		description: "Retrieves the details of a specific trigger firing",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/triggers",
+		httpMethod: "get",
+		pathParams: ["project_id", "firing_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "firing_id",
+			"description": "",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"get-current-user": {
+		serviceClass: "Users",
+		operationId: "getCurrentUser",
+		description: "Returns the account the presented credential resolves to.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/users",
+		httpMethod: "get",
+		pathParams: [],
+		queryParams: [],
+		flags: []
+	},
+	"update-current-user": {
+		serviceClass: "Users",
+		operationId: "updateCurrentUser",
+		description: "Edits the account's display name. `name` is required in the body — send null to clear it — so a request that misspelled the field is rejected rather than answered with a silent 200.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/users",
+		httpMethod: "patch",
+		pathParams: [],
+		queryParams: [],
+		flags: [{
+			"name": "name",
+			"description": "Display name; null clears it.",
+			"required": true,
+			"type": "string",
+			"in": "body"
+		}]
+	},
+	"list-webhooks": {
+		serviceClass: "Webhooks",
+		operationId: "listWebhooks",
+		description: "The endpoints registered in the project, newest first.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "get",
+		pathParams: ["project_id"],
+		queryParams: ["limit", "cursor"],
+		flags: [
 			{
-				"name": "mcp",
-				"description": "MCP server config (`url`, `headers`). `headers` values accept `{{secret:...}}` and `{{context:<key>}}` references, resolved right before the outbound MCP request; `url` accepts `{{secret:...}}` only.",
-				"required": false,
-				"type": "object",
-				"in": "body"
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
 			},
 			{
-				"name": "actions",
-				"description": "Allowlist of actions. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface (`null` exposes every tool). Ignored for other tool types.",
+				"name": "limit",
+				"description": "Maximum items per page — an integer from 1 to 100 (default 20).",
 				"required": false,
-				"type": "array",
-				"in": "body"
+				"type": "integer",
+				"in": "query"
 			},
 			{
-				"name": "denied_actions",
-				"description": "For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. `null` denies nothing. Ignored for other tool types.",
+				"name": "cursor",
+				"description": "Opaque pagination cursor from a previous response's next_cursor.",
 				"required": false,
-				"type": "array",
-				"in": "body"
-			},
+				"type": "string",
+				"in": "query"
+			}
+		]
+	},
+	"create-webhook": {
+		serviceClass: "Webhooks",
+		operationId: "createWebhook",
+		description: "Register an endpoint and subscribe it to one or more event types. The response carries `secret` — the signing key, in plaintext. **This is the only time it is returned.** Store it where your receiver can read it; if you lose it, rotate rather than re-create, so the endpoint keeps its delivery history. Returns `501` on a deployment with no credential-sealing key configured, since the secret could not then be stored safely.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "post",
+		pathParams: ["project_id"],
+		queryParams: [],
+		flags: [
 			{
-				"name": "context_keys",
-				"description": "Optional allowlist of `tool_context` keys that may be forwarded to this tool as prefixed context headers (`X-Naturali-Context-<key>` by default). When `null` or omitted, every key in the caller's `tool_context` is forwarded — the behavior of every tool created before this field existed. When set, only the listed keys are, so a per-user credential in `tool_context` can be confined to the tools that need it; `[]` forwards none. The server-pinned identity keys (`sessionId`, `actorId`, `actorExternalId`) are always forwarded. A key consumed by a `{{context:<key>}}` token in this tool's own headers is substituted regardless of this list — the tool declared that header itself.",
-				"required": false,
-				"type": "array",
-				"in": "body"
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
 			},
 			{
-				"name": "preset_parameters",
-				"description": "Fixed parameters merged into every action-based tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.",
-				"required": false,
-				"type": "object",
+				"name": "url",
+				"description": "An `https://` endpoint (`http://` is accepted for localhost, so a tunnel works in development).\n",
+				"required": true,
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "pipeline",
-				"description": "Pipeline definition for `pipeline` tools. See the `pipeline` field on the Tool schema for the full structure.",
-				"required": false,
-				"type": "object",
+				"name": "events",
+				"description": "Which events this endpoint receives. Each entry is an exact type (`generation.completed`), a resource wildcard (`generation.*`), or `*` for everything. A bare resource name (`generation`) matches nothing and is rejected.\n",
+				"required": true,
+				"type": "array",
 				"in": "body"
 			},
 			{
-				"name": "output_mapping",
-				"description": "Universal JSON Logic mapping applied to the tool's raw result. See the `output_mapping` field on the Tool schema for details.",
+				"name": "description",
+				"description": "",
 				"required": false,
-				"type": "object",
+				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "guardrail_ids",
-				"description": "Guardrails attached at the tool scope.",
+				"name": "active",
+				"description": "",
 				"required": false,
-				"type": "array",
+				"type": "boolean",
 				"in": "body"
 			}
 		]
 	},
-	"delete-tool": {
-		serviceClass: "Tools",
-		operationId: "deleteTool",
-		description: "Deletes a tool by ID.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
-		httpMethod: "delete",
-		pathParams: ["project_id", "tool_id"],
+	"get-webhook": {
+		serviceClass: "Webhooks",
+		operationId: "getWebhook",
+		description: "Get a webhook",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "get",
+		pathParams: ["project_id", "webhook_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8847,20 +10948,20 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "tool_id",
-			"description": "",
+			"name": "webhook_id",
+			"description": "Webhook public ID (whk_ prefix).",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"call-tool": {
-		serviceClass: "Tools",
-		operationId: "callTool",
-		description: "Directly invokes a tool and returns its output. Supported for `http`, `mcp` and `pipeline` tools. `client` tools cannot be invoked server-side and will return 422. A `pipeline` tool runs its declared steps in order and returns the mapped `output` (or the last step's output); `action` is ignored and `input` is the pipeline input. For `mcp` tools the `action` field is required and identifies which tool name to invoke. For `http` tools `action` is ignored. When an `mcp` tool declares an `actions` allowlist, an action outside it is rejected with `400 VALIDATION_FAILED` (\"not available on this tool\") before any outbound request is made. `preset_parameters` stored on the tool are merged with the caller-supplied `input` before execution; preset keys take lower precedence.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/tools",
-		httpMethod: "post",
-		pathParams: ["project_id", "tool_id"],
+	"update-webhook": {
+		serviceClass: "Webhooks",
+		operationId: "updateWebhook",
+		description: "Change the destination, the subscription, the label, or whether deliveries are attempted at all. At least one field is required. Setting `active: false` is the reversible half of `DELETE`: deliveries stop, the endpoint and its history stay. It is what to reach for while a receiver is being repaired.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "patch",
+		pathParams: ["project_id", "webhook_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -8871,67 +10972,49 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "tool_id",
-				"description": "",
+				"name": "webhook_id",
+				"description": "Webhook public ID (whk_ prefix).",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "action",
-				"description": "For `mcp` tools: the MCP tool name to invoke (must be in the tool's `actions` allowlist when one is set, and must not be in its `denied_actions` denylist). Ignored for `http` tools.\n",
+				"name": "url",
+				"description": "",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "input",
-				"description": "Input parameters for the tool call. These are merged with the tool's `preset_parameters` before execution (caller-supplied values take precedence).\n",
+				"name": "events",
+				"description": "Which events this endpoint receives. Each entry is an exact type (`generation.completed`), a resource wildcard (`generation.*`), or `*` for everything. A bare resource name (`generation`) matches nothing and is rejected.\n",
 				"required": false,
-				"type": "object",
+				"type": "array",
 				"in": "body"
-			}
-		]
-	},
-	"list-traces": {
-		serviceClass: "Traces",
-		operationId: "listTraces",
-		description: "Returns a paginated list of execution traces for the project.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
-		httpMethod: "get",
-		pathParams: ["project_id"],
-		queryParams: ["limit", "offset"],
-		flags: [
-			{
-				"name": "project_id",
-				"description": "Project public ID (proj_ prefix).",
-				"required": true,
-				"type": "string",
-				"in": "path"
 			},
 			{
-				"name": "limit",
-				"description": "Maximum number of results to return",
+				"name": "description",
+				"description": "",
 				"required": false,
-				"type": "integer",
-				"in": "query"
+				"type": "string",
+				"in": "body"
 			},
 			{
-				"name": "offset",
-				"description": "Number of results to skip",
+				"name": "active",
+				"description": "",
 				"required": false,
-				"type": "integer",
-				"in": "query"
+				"type": "boolean",
+				"in": "body"
 			}
 		]
 	},
-	"get-trace": {
-		serviceClass: "Traces",
-		operationId: "getTrace",
-		description: "Returns a single trace by ID.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
-		httpMethod: "get",
-		pathParams: ["project_id", "trace_id"],
+	"delete-webhook": {
+		serviceClass: "Webhooks",
+		operationId: "deleteWebhook",
+		description: "Removes the endpoint and its delivery records. To stop deliveries while keeping the audit trail, `PATCH` it to `active: false` instead.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "delete",
+		pathParams: ["project_id", "webhook_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8940,21 +11023,49 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "trace_id",
-			"description": "Public ID of the trace",
+			"name": "webhook_id",
+			"description": "Webhook public ID (whk_ prefix).",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"get-trace-tree": {
-		serviceClass: "Traces",
-		operationId: "getTraceTree",
-		description: "Returns the full execution tree rooted at the given trace (or its root if the given trace is a child). Each node represents one agent's execution session. The `children` array contains traces triggered by sub-agent tool calls from that trace.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
+	"rotate-webhook-secret": {
+		serviceClass: "Webhooks",
+		operationId: "rotateWebhookSecret",
+		description: "Issues a new signing secret for the same endpoint and returns it — the second and last time a secret is ever returned. This is the `…:rotate-secret` action; the path segment is `{webhook_id}:rotate-secret`. The change takes effect on the next delivery, including retries of deliveries already queued, so roll the new secret out to your receiver promptly. There is no overlap window in which both secrets verify.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "post",
+		pathParams: ["project_id", "webhook_id"],
+		queryParams: [],
+		flags: [{
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}, {
+			"name": "webhook_id",
+			"description": "Webhook public ID (whk_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
+		}]
+	},
+	"list-webhook-deliveries": {
+		serviceClass: "Webhooks",
+		operationId: "listWebhookDeliveries",
+		description: "Every delivery attempted in the project, newest first — what was sent, where, how many times, and what came back. Filter by endpoint, by lifecycle status, or by event type. Deliveries are per (event, endpoint): an event matching two subscribed endpoints produces two rows, retried and observed independently.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
 		httpMethod: "get",
-		pathParams: ["project_id", "trace_id"],
-		queryParams: ["include"],
+		pathParams: ["project_id"],
+		queryParams: [
+			"limit",
+			"cursor",
+			"webhook_id",
+			"status",
+			"event_type"
+		],
 		flags: [
 			{
 				"name": "project_id",
@@ -8964,28 +11075,49 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "trace_id",
-				"description": "Public ID of any trace in the tree (root or child)",
-				"required": true,
+				"name": "limit",
+				"description": "Maximum items per page — an integer from 1 to 100 (default 20).",
+				"required": false,
+				"type": "integer",
+				"in": "query"
+			},
+			{
+				"name": "cursor",
+				"description": "Opaque pagination cursor from a previous response's next_cursor.",
+				"required": false,
 				"type": "string",
-				"in": "path"
+				"in": "query"
 			},
 			{
-				"name": "include",
-				"description": "Comma-separated list of related resources to embed on each node. Supported value: `generations` — attaches all generations that belong to each trace node (including sub-agent generations linked via `initiator_generation_id`).\n",
+				"name": "webhook_id",
+				"description": "Only deliveries addressed to this endpoint.",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "status",
+				"description": "Only deliveries in this state.",
+				"required": false,
+				"type": "string",
+				"in": "query"
+			},
+			{
+				"name": "event_type",
+				"description": "Only deliveries of this event type.",
 				"required": false,
 				"type": "string",
 				"in": "query"
 			}
 		]
 	},
-	"purge-trace-content": {
-		serviceClass: "Traces",
-		operationId: "purgeTraceContent",
-		description: "Deletes the trace's steps object from storage and clears its content columns (`file_id`, `error`), cascading to every descendant trace and to all of their generations. A descendant holds its own steps object covering the same run, so the cascade is what makes the erasure complete rather than merely partial. The rows survive as auditable skeletons with `content_redacted_at` set — ids, timestamps, step counts, and the generations' usage-attribution fields are preserved, because the billing and audit ledger must outlive a tenant's erasure of the content. A purged trace therefore reads back as a skeleton, not a 404: a 404 would prove nothing. Idempotent — purging an already-purged trace succeeds and leaves the original `content_redacted_at` in place.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/traces",
-		httpMethod: "delete",
-		pathParams: ["project_id", "trace_id"],
+	"get-webhook-delivery": {
+		serviceClass: "Webhooks",
+		operationId: "getWebhookDelivery",
+		description: "One delivery, including the exact payload that was signed and sent.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "get",
+		pathParams: ["project_id", "delivery_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -8994,47 +11126,43 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "trace_id",
-			"description": "Public ID of the trace",
+			"name": "delivery_id",
+			"description": "Delivery public ID (whd_ prefix).",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"get-current-user": {
-		serviceClass: "Users",
-		operationId: "getCurrentUser",
-		description: "Returns the account the presented credential resolves to.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/users",
-		httpMethod: "get",
-		pathParams: [],
-		queryParams: [],
-		flags: []
-	},
-	"update-current-user": {
-		serviceClass: "Users",
-		operationId: "updateCurrentUser",
-		description: "Edits the account's display name. `name` is required in the body — send null to clear it — so a request that misspelled the field is rejected rather than answered with a silent 200.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/users",
-		httpMethod: "patch",
-		pathParams: [],
+	"redeliver-webhook-delivery": {
+		serviceClass: "Webhooks",
+		operationId: "redeliverWebhookDelivery",
+		description: "Queue the same event at the same endpoint again — the recovery path for a delivery that failed, or one your receiver dropped. This is the `…:redeliver` action; the path segment is `{delivery_id}:redeliver`. A **new** delivery is created and returned; the original record is left untouched, because its attempt history is the evidence you redelivered on. The event's `id` is carried over unchanged, so a receiver deduping on the event sees the same event twice while one deduping on `X-Naturali-Delivery` sees a distinct delivery.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+		httpMethod: "post",
+		pathParams: ["project_id", "delivery_id"],
 		queryParams: [],
 		flags: [{
-			"name": "name",
-			"description": "Display name; null clears it.",
+			"name": "project_id",
+			"description": "Project public ID (proj_ prefix).",
 			"required": true,
 			"type": "string",
-			"in": "body"
+			"in": "path"
+		}, {
+			"name": "delivery_id",
+			"description": "Delivery public ID (whd_ prefix).",
+			"required": true,
+			"type": "string",
+			"in": "path"
 		}]
 	},
-	"list-webhooks": {
-		serviceClass: "Webhooks",
-		operationId: "listWebhooks",
-		description: "The endpoints registered in the project, newest first.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"list-workflows": {
+		serviceClass: "Workflows",
+		operationId: "listWorkflows",
+		description: "Lists workflow definitions in a project.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "get",
 		pathParams: ["project_id"],
-		queryParams: ["limit", "cursor"],
+		queryParams: ["limit", "offset"],
 		flags: [
 			{
 				"name": "project_id",
@@ -9045,25 +11173,25 @@ const routes = {
 			},
 			{
 				"name": "limit",
-				"description": "Maximum items per page — an integer from 1 to 100 (default 20).",
+				"description": "Maximum number of results to return",
 				"required": false,
 				"type": "integer",
 				"in": "query"
 			},
 			{
-				"name": "cursor",
-				"description": "Opaque pagination cursor from a previous response's next_cursor.",
+				"name": "offset",
+				"description": "Number of results to skip",
 				"required": false,
-				"type": "string",
+				"type": "integer",
 				"in": "query"
 			}
 		]
 	},
-	"create-webhook": {
-		serviceClass: "Webhooks",
-		operationId: "createWebhook",
-		description: "Register an endpoint and subscribe it to one or more event types. The response carries `secret` — the signing key, in plaintext. **This is the only time it is returned.** Store it where your receiver can read it; if you lose it, rotate rather than re-create, so the endpoint keeps its delivery history. Returns `501` on a deployment with no credential-sealing key configured, since the secret could not then be stored safely.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"create-workflow": {
+		serviceClass: "Workflows",
+		operationId: "createWorkflow",
+		description: "Creates a new workflow definition. The definition is statically validated.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "post",
 		pathParams: ["project_id"],
 		queryParams: [],
@@ -9076,42 +11204,56 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "url",
-				"description": "An `https://` endpoint (`http://` is accepted for localhost, so a tunnel works in development).\n",
+				"name": "name",
+				"description": "",
 				"required": true,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "events",
-				"description": "Which events this endpoint receives. Each entry is an exact type (`generation.completed`), a resource wildcard (`generation.*`), or `*` for everything. A bare resource name (`generation`) matches nothing and is rejected.\n",
+				"name": "description",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "states",
+				"description": "",
 				"required": true,
 				"type": "array",
 				"in": "body"
 			},
 			{
-				"name": "description",
+				"name": "transitions",
 				"description": "",
-				"required": false,
-				"type": "string",
+				"required": true,
+				"type": "array",
 				"in": "body"
 			},
 			{
-				"name": "active",
+				"name": "payload_schema",
 				"description": "",
 				"required": false,
-				"type": "boolean",
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "version_label",
+				"description": "Optional tag for the version this create archives, e.g. `initial`.",
+				"required": false,
+				"type": "string",
 				"in": "body"
 			}
 		]
 	},
-	"get-webhook": {
-		serviceClass: "Webhooks",
-		operationId: "getWebhook",
-		description: "Get a webhook",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"get-workflow": {
+		serviceClass: "Workflows",
+		operationId: "getWorkflow",
+		description: "Retrieves a workflow definition.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "get",
-		pathParams: ["project_id", "webhook_id"],
+		pathParams: ["project_id", "workflow_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -9120,20 +11262,20 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "webhook_id",
-			"description": "Webhook public ID (whk_ prefix).",
+			"name": "workflow_id",
+			"description": "",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"update-webhook": {
-		serviceClass: "Webhooks",
-		operationId: "updateWebhook",
-		description: "Change the destination, the subscription, the label, or whether deliveries are attempted at all. At least one field is required. Setting `active: false` is the reversible half of `DELETE`: deliveries stop, the endpoint and its history stay. It is what to reach for while a receiver is being repaired.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"update-workflow": {
+		serviceClass: "Workflows",
+		operationId: "updateWorkflow",
+		description: "Updates a workflow definition. Structural changes (states/transitions) are re-validated. Existing tasks in a removed state stay put but can only leave via transitions valid in the new definition.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "patch",
-		pathParams: ["project_id", "webhook_id"],
+		pathParams: ["project_id", "workflow_id"],
 		queryParams: [],
 		flags: [
 			{
@@ -9144,49 +11286,63 @@ const routes = {
 				"in": "path"
 			},
 			{
-				"name": "webhook_id",
-				"description": "Webhook public ID (whk_ prefix).",
+				"name": "workflow_id",
+				"description": "",
 				"required": true,
 				"type": "string",
 				"in": "path"
 			},
 			{
-				"name": "url",
+				"name": "name",
 				"description": "",
 				"required": false,
 				"type": "string",
 				"in": "body"
 			},
 			{
-				"name": "events",
-				"description": "Which events this endpoint receives. Each entry is an exact type (`generation.completed`), a resource wildcard (`generation.*`), or `*` for everything. A bare resource name (`generation`) matches nothing and is rejected.\n",
+				"name": "description",
+				"description": "",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			},
+			{
+				"name": "states",
+				"description": "",
 				"required": false,
 				"type": "array",
 				"in": "body"
 			},
 			{
-				"name": "description",
+				"name": "transitions",
 				"description": "",
 				"required": false,
-				"type": "string",
+				"type": "array",
 				"in": "body"
 			},
 			{
-				"name": "active",
+				"name": "payload_schema",
 				"description": "",
 				"required": false,
-				"type": "boolean",
+				"type": "object",
+				"in": "body"
+			},
+			{
+				"name": "version_label",
+				"description": "Optional tag for the version this write archives, e.g. `pre-rewire`. Ignored when the write changes no definition field, since no version is archived.",
+				"required": false,
+				"type": "string",
 				"in": "body"
 			}
 		]
 	},
-	"delete-webhook": {
-		serviceClass: "Webhooks",
-		operationId: "deleteWebhook",
-		description: "Removes the endpoint and its delivery records. To stop deliveries while keeping the audit trail, `PATCH` it to `active: false` instead.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"delete-workflow": {
+		serviceClass: "Workflows",
+		operationId: "deleteWorkflow",
+		description: "Deletes a workflow. Rejected while open tasks exist.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "delete",
-		pathParams: ["project_id", "webhook_id"],
+		pathParams: ["project_id", "workflow_id"],
 		queryParams: [],
 		flags: [{
 			"name": "project_id",
@@ -9195,49 +11351,21 @@ const routes = {
 			"type": "string",
 			"in": "path"
 		}, {
-			"name": "webhook_id",
-			"description": "Webhook public ID (whk_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
-	},
-	"rotate-webhook-secret": {
-		serviceClass: "Webhooks",
-		operationId: "rotateWebhookSecret",
-		description: "Issues a new signing secret for the same endpoint and returns it — the second and last time a secret is ever returned. This is the `…:rotate-secret` action; the path segment is `{webhook_id}:rotate-secret`. The change takes effect on the next delivery, including retries of deliveries already queued, so roll the new secret out to your receiver promptly. There is no overlap window in which both secrets verify.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
-		httpMethod: "post",
-		pathParams: ["project_id", "webhook_id"],
-		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}, {
-			"name": "webhook_id",
-			"description": "Webhook public ID (whk_ prefix).",
+			"name": "workflow_id",
+			"description": "",
 			"required": true,
 			"type": "string",
 			"in": "path"
 		}]
 	},
-	"list-webhook-deliveries": {
-		serviceClass: "Webhooks",
-		operationId: "listWebhookDeliveries",
-		description: "Every delivery attempted in the project, newest first — what was sent, where, how many times, and what came back. Filter by endpoint, by lifecycle status, or by event type. Deliveries are per (event, endpoint): an event matching two subscribed endpoints produces two rows, retried and observed independently.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"list-workflow-versions": {
+		serviceClass: "Workflows",
+		operationId: "listWorkflowVersions",
+		description: "Returns the workflow's archived state machines, newest first. A version is written on create and on every subsequent write that changes the definition (`states`, `transitions`, `payload_schema`) — through the REST API or a formation apply alike. Metadata-only edits (name, description) do not archive a version. See [Versioning](/docs/modules/workflows#versioning).",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "get",
-		pathParams: ["project_id"],
-		queryParams: [
-			"limit",
-			"cursor",
-			"webhook_id",
-			"status",
-			"event_type"
-		],
+		pathParams: ["project_id", "workflow_id"],
+		queryParams: ["limit", "offset"],
 		flags: [
 			{
 				"name": "project_id",
@@ -9246,86 +11374,107 @@ const routes = {
 				"type": "string",
 				"in": "path"
 			},
+			{
+				"name": "workflow_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
 			{
 				"name": "limit",
-				"description": "Maximum items per page — an integer from 1 to 100 (default 20).",
+				"description": "Maximum number of results to return",
 				"required": false,
 				"type": "integer",
 				"in": "query"
 			},
 			{
-				"name": "cursor",
-				"description": "Opaque pagination cursor from a previous response's next_cursor.",
+				"name": "offset",
+				"description": "Number of results to skip",
 				"required": false,
-				"type": "string",
+				"type": "integer",
 				"in": "query"
-			},
+			}
+		]
+	},
+	"get-workflow-version": {
+		serviceClass: "Workflows",
+		operationId: "getWorkflowVersion",
+		description: "Returns the exact state machine a given version describes. Every task records the version it entered on in `workflow_version` and runs on that machine for its whole life, so this is how you read the definition a task is actually being validated against — including a task whose workflow has been rewired since.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
+		httpMethod: "get",
+		pathParams: [
+			"project_id",
+			"workflow_id",
+			"version"
+		],
+		queryParams: [],
+		flags: [
 			{
-				"name": "webhook_id",
-				"description": "Only deliveries addressed to this endpoint.",
-				"required": false,
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
 				"type": "string",
-				"in": "query"
+				"in": "path"
 			},
 			{
-				"name": "status",
-				"description": "Only deliveries in this state.",
-				"required": false,
+				"name": "workflow_id",
+				"description": "",
+				"required": true,
 				"type": "string",
-				"in": "query"
+				"in": "path"
 			},
 			{
-				"name": "event_type",
-				"description": "Only deliveries of this event type.",
-				"required": false,
-				"type": "string",
-				"in": "query"
+				"name": "version",
+				"description": "The archived version number",
+				"required": true,
+				"type": "integer",
+				"in": "path"
 			}
 		]
 	},
-	"get-webhook-delivery": {
-		serviceClass: "Webhooks",
-		operationId: "getWebhookDelivery",
-		description: "One delivery, including the exact payload that was signed and sent.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
-		httpMethod: "get",
-		pathParams: ["project_id", "delivery_id"],
-		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}, {
-			"name": "delivery_id",
-			"description": "Delivery public ID (whd_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
-	},
-	"redeliver-webhook-delivery": {
-		serviceClass: "Webhooks",
-		operationId: "redeliverWebhookDelivery",
-		description: "Queue the same event at the same endpoint again — the recovery path for a delivery that failed, or one your receiver dropped. This is the `…:redeliver` action; the path segment is `{delivery_id}:redeliver`. A **new** delivery is created and returned; the original record is left untouched, because its attempt history is the evidence you redelivered on. The event's `id` is carried over unchanged, so a receiver deduping on the event sees the same event twice while one deduping on `X-Naturali-Delivery` sees a distinct delivery.",
-		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/webhooks",
+	"restore-workflow-version": {
+		serviceClass: "Workflows",
+		operationId: "restoreWorkflowVersion",
+		description: "Writes an archived version's state machine back as the workflow's live definition, which archives it again as a **new** version rather than rewinding the counter — so a task pinned to any version in between still runs on the machine it entered on. The restore runs through the ordinary update path, so the archived definition goes through the same validation as an authored one. That includes resolving every `on_enter` dispatch target, so restoring a version whose agent or orchestration has since been deleted fails with `400` rather than writing a definition that would strand a task on entry. Restoring the definition the workflow already holds is a no-op and archives nothing. Tasks already in flight are unaffected either way — a restore is an ordinary edit, and pinning is what keeps it from reaching them.",
+		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/workflows",
 		httpMethod: "post",
-		pathParams: ["project_id", "delivery_id"],
+		pathParams: [
+			"project_id",
+			"workflow_id",
+			"version"
+		],
 		queryParams: [],
-		flags: [{
-			"name": "project_id",
-			"description": "Project public ID (proj_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}, {
-			"name": "delivery_id",
-			"description": "Delivery public ID (whd_ prefix).",
-			"required": true,
-			"type": "string",
-			"in": "path"
-		}]
+		flags: [
+			{
+				"name": "project_id",
+				"description": "Project public ID (proj_ prefix).",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "workflow_id",
+				"description": "",
+				"required": true,
+				"type": "string",
+				"in": "path"
+			},
+			{
+				"name": "version",
+				"description": "The archived version number",
+				"required": true,
+				"type": "integer",
+				"in": "path"
+			},
+			{
+				"name": "label",
+				"description": "Optional tag for the new version the restore archives. Defaults to `restored from vN`.",
+				"required": false,
+				"type": "string",
+				"in": "body"
+			}
+		]
 	}
 };
 //#endregion