@runtypelabs/sdk 4.15.0 → 4.17.0

package/dist/index.d.ts

@@ -723,6 +723,10 @@ interface paths {
                             };
                             tools?: {
                                 approval?: {
+                                    choices?: {
+                                        alwaysAllow?: boolean;
+                                        alwaysDeny?: boolean;
+                                    };
                                     requestReason?: boolean;
                                     require: string[] | boolean;
                                     timeout?: number;
@@ -1092,6 +1096,10 @@ interface paths {
                                 };
                                 tools?: {
                                     approval?: {
+                                        choices?: {
+                                            alwaysAllow?: boolean;
+                                            alwaysDeny?: boolean;
+                                        };
                                         requestReason?: boolean;
                                         require: string[] | boolean;
                                         timeout?: number;
@@ -1733,6 +1741,10 @@ interface paths {
                             };
                             tools?: {
                                 approval?: {
+                                    choices?: {
+                                        alwaysAllow?: boolean;
+                                        alwaysDeny?: boolean;
+                                    };
                                     requestReason?: boolean;
                                     require: string[] | boolean;
                                     timeout?: number;
@@ -10654,6 +10666,13 @@ interface paths {
                         };
                     };
                 };
+                /** @description Canonical first page (no cursor/search, includeCount=true) is unchanged since the ETag echoed in If-None-Match. No body. */
+                304: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
                 /** @description Invalid parameters */
                 400: {
                     headers: {
@@ -21744,6 +21763,227 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/products/{id}/surfaces/ensure": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ensure surface (config-as-code converge)
+         * @description Idempotently converge a repo-defined surface definition onto a product. Identity is name + product. Hash-only probes skip the payload in the steady state (a miss is a normal 200 `definitionRequired` response, not an error); full requests create the surface or update it when the canonical content hash differs. The response always carries the server-computed canonical hash. Set dryRun to plan without writing (CI drift gate), and onConflict: "overwrite" to converge over dashboard/API edits. Surfaces have no version snapshots, so there is no publish option.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        contentHash?: string;
+                        definition?: {
+                            behavior?: {
+                                [key: string]: unknown;
+                            };
+                            /** @enum {string} */
+                            environment?: "production" | "development";
+                            inbound?: {
+                                [key: string]: unknown;
+                            };
+                            name: string;
+                            outbound?: {
+                                [key: string]: unknown;
+                            };
+                            /** @enum {string} */
+                            status?: "draft" | "active" | "paused";
+                            /** @enum {string} */
+                            type: "chat" | "mcp" | "mcp_code" | "api" | "webhook" | "schedule" | "a2a" | "email" | "slack" | "sms" | "imessage" | "discord" | "whatsapp" | "telegram" | "hosted-page" | "chrome_extension";
+                        };
+                        dryRun?: boolean;
+                        expectedRemoteHash?: string;
+                        name: string;
+                        /** @enum {string} */
+                        onConflict?: "error" | "overwrite";
+                    };
+                };
+            };
+            responses: {
+                /** @description Converge result: unchanged | created | updated | definitionRequired (hash miss — retry with the full definition) | plan (dryRun) */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SurfaceEnsureResponse"];
+                    };
+                };
+                /** @description Validation error */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Plan surface limit reached for the target environment (only a create counts against the quota) */
+                402: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Insufficient permissions */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Product not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Conflict: external_modification (last write was not ensure; pass onConflict: "overwrite") or remote_changed (expectedRemoteHash guard) */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SurfaceEnsureConflict"];
+                    };
+                };
+                /** @description Submitted contentHash does not match the server-recomputed canonical hash */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SurfaceEnsureHashMismatch"];
+                    };
+                };
+                /** @description Internal server error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/products/{id}/surfaces/pull": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Pull surface definition (config-as-code)
+         * @description Return the canonical config-as-code definition and provenance for a surface by name within a product — the absorb-drift direction of the ensure protocol. The contentHash is recomputed from the live surface state, so it is accurate even immediately after a dashboard edit.
+         */
+        get: {
+            parameters: {
+                query: {
+                    name: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Canonical definition + provenance */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SurfacePullResponse"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Insufficient permissions */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Product not found, or no surface with that name in the product */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Internal server error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/products/{id}/surfaces/{surfaceId}": {
         parameters: {
             query?: never;
@@ -31692,7 +31932,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/skills/import": {
+    "/v1/skills/ensure": {
         parameters: {
             query?: never;
             header?: never;
@@ -31702,8 +31942,8 @@ interface paths {
         get?: never;
         put?: never;
         /**
-         * Import a SKILL.md
-         * @description Import a single SKILL.md document. Lands with trustLevel=imported.
+         * Ensure skill (config-as-code converge)
+         * @description Idempotently converge a repo-defined skill (SKILL.md manifest) onto the platform. Identity is name + account scope. Hash-only probes skip the payload in the steady state (a miss is a normal 200 `definitionRequired` response, not an error); full requests create the skill or append a new version when the canonical content hash differs. The response always carries the server-computed canonical hash + the version id. Set dryRun to plan without writing (CI drift gate), onConflict: "overwrite" to converge over dashboard/API edits, and release: "publish" to publish the converged version. Admin/control plane only — no review queue.
          */
         post: {
             parameters: {
@@ -31715,23 +31955,35 @@ interface paths {
             requestBody?: {
                 content: {
                     "application/json": {
-                        markdown: string;
+                        contentHash?: string;
+                        definition?: {
+                            body?: string;
+                            frontmatter?: {
+                                [key: string]: unknown;
+                            };
+                            markdown?: string;
+                        };
+                        dryRun?: boolean;
+                        expectedRemoteHash?: string;
+                        name: string;
+                        /** @enum {string} */
+                        onConflict?: "error" | "overwrite";
+                        /** @enum {string} */
+                        release?: "none" | "publish";
                     };
                 };
             };
             responses: {
-                /** @description Imported */
-                201: {
+                /** @description Converge result: unchanged | created | updated | definitionRequired (hash miss — retry with the full definition) | plan (dryRun) */
+                200: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
-                        "application/json": {
-                            [key: string]: unknown;
-                        };
+                        "application/json": components["schemas"]["SkillEnsureResponse"];
                     };
                 };
-                /** @description Invalid manifest */
+                /** @description Validation error / invalid manifest */
                 400: {
                     headers: {
                         [name: string]: unknown;
@@ -31758,8 +32010,26 @@ interface paths {
                         "application/json": components["schemas"]["Error"];
                     };
                 };
-                /** @description Unsupported capability */
+                /** @description Conflict: external_modification (last write was not ensure; pass onConflict: "overwrite") or remote_changed (expectedRemoteHash guard) */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SkillEnsureConflict"];
+                    };
+                };
+                /** @description Submitted contentHash does not match the server-recomputed canonical hash (code: content_hash_mismatch), or the manifest carries an unsupported capability such as mcpServers (code: unsupported_capability) */
                 422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SkillEnsureUnprocessable"];
+                    };
+                };
+                /** @description Internal server error */
+                500: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -31775,7 +32045,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/skills/propose": {
+    "/v1/skills/import": {
         parameters: {
             query?: never;
             header?: never;
@@ -31785,8 +32055,8 @@ interface paths {
         get?: never;
         put?: never;
         /**
-         * Propose a skill (deployed-agent data plane)
-         * @description Agent self-authoring endpoint hit by the `propose_skill` runtime tool. Review-by-default; auto-publishes only under the owner-set opt-out. NOT the admin create path.
+         * Import a SKILL.md
+         * @description Import a single SKILL.md document. Lands with trustLevel=imported.
          */
         post: {
             parameters: {
@@ -31798,20 +32068,13 @@ interface paths {
             requestBody?: {
                 content: {
                     "application/json": {
-                        body: string;
-                        capabilities?: {
-                            [key: string]: unknown;
-                        };
-                        description: string;
-                        name: string;
-                        proposingAgentExecutionId: string;
-                        proposingAgentId: string;
+                        markdown: string;
                     };
                 };
             };
             responses: {
-                /** @description Proposal outcome */
-                200: {
+                /** @description Imported */
+                201: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -31839,6 +32102,15 @@ interface paths {
                         "application/json": components["schemas"]["Error"];
                     };
                 };
+                /** @description Insufficient permissions */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
                 /** @description Unsupported capability */
                 422: {
                     headers: {
@@ -31856,6 +32128,238 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/skills/propose": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Propose a skill (deployed-agent data plane)
+         * @description Agent self-authoring endpoint hit by the `propose_skill` runtime tool. Review-by-default; auto-publishes only under the owner-set opt-out. NOT the admin create path.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        body: string;
+                        capabilities?: {
+                            [key: string]: unknown;
+                        };
+                        description: string;
+                        name: string;
+                        proposingAgentExecutionId: string;
+                        proposingAgentId: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Proposal outcome */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            [key: string]: unknown;
+                        };
+                    };
+                };
+                /** @description Invalid manifest */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unsupported capability */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/skills/pull": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Pull skill definition (config-as-code)
+         * @description Return the canonical config-as-code definition and provenance for a skill by name — the absorb-drift direction of the ensure protocol. The contentHash is recomputed from the live skill state, so it is accurate even immediately after a dashboard edit.
+         */
+        get: {
+            parameters: {
+                query: {
+                    name: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Canonical definition + provenance */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SkillPullResponse"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Insufficient permissions */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description No skill with that name in the account scope */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Internal server error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/skills/scan": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Scan a skill for malicious patterns
+         * @description Statically scan a SKILL.md string (`markdown`) or structured manifest (`frontmatter` + `body`) and return a two-tier verdict (warning when suspected malicious, error when high-confidence malicious). Does not persist or gate.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            responses: {
+                /** @description Scan verdict */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            [key: string]: unknown;
+                        };
+                    };
+                };
+                /** @description Invalid manifest */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Insufficient permissions */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/skills/{id}": {
         parameters: {
             query?: never;
@@ -32322,6 +32826,119 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/tool-approval-grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List remembered tool-approval grants
+         * @description List the authenticated owner's active cross-session "Always allow" grants. Optionally filter to a single agent with ?agentId=. A null endUserRef is an account-level grant.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    agentId?: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Active grants */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            data: components["schemas"]["ToolApprovalGrant"][];
+                        };
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/tool-approval-grants/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a remembered tool-approval grant
+         * @description Revoke (soft-delete) a grant so the tool prompts for approval again on future dispatches. Ownership-scoped.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Revoked */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            revoked: boolean;
+                        };
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Grant not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/tools": {
         parameters: {
             query?: never;
@@ -34283,6 +34900,7 @@ interface paths {
                                 enableChromeSurface: boolean;
                                 enableDashboardAssistant: boolean;
                                 enableRuntypeApps: boolean;
+                                enableSkillScanner: boolean;
                                 productGeneratorModel: string;
                             };
                             id: string;
@@ -34853,6 +35471,10 @@ interface components {
                     };
                     tools?: {
                         approval?: {
+                            choices?: {
+                                alwaysAllow?: boolean;
+                                alwaysDeny?: boolean;
+                            };
                             requestReason?: boolean;
                             require: string[] | boolean;
                             timeout?: number;
@@ -35619,6 +36241,7 @@ interface components {
             /** @enum {string} */
             type: "flow_start";
         } | {
+            claudeManagedAgentId?: string;
             completedAt?: string;
             completedSteps?: number;
             duration?: number;
@@ -36103,6 +36726,7 @@ interface components {
             /** @enum {string} */
             type: "flow_start";
         } | {
+            claudeManagedAgentId?: string;
             completedAt?: string;
             completedSteps?: number;
             duration?: number;
@@ -36552,6 +37176,47 @@ interface components {
             op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "between" | "contains" | "startsWith" | "endsWith" | "in" | "notIn" | "isSet" | "isNotSet" | "isTrue" | "isFalse" | "withinLastDays" | "olderThanDays";
             value?: unknown;
         };
+        SkillEnsureConflict: {
+            /** @enum {string} */
+            code: "external_modification" | "remote_changed";
+            currentHash?: string | null;
+            error: string;
+            lastModifiedSource?: string;
+            modifiedAt?: string | null;
+        };
+        SkillEnsureHashMismatch: {
+            /** @enum {string} */
+            code: "content_hash_mismatch";
+            /** @description The server-computed canonical hash of the submitted manifest. */
+            contentHash: string;
+            error: string;
+        };
+        SkillEnsureResponse: {
+            /** @description Server-computed canonical content hash. Clients should echo this hash in probes. */
+            contentHash: string;
+            /** @enum {string} */
+            result: "unchanged" | "created" | "updated";
+            skillId: string;
+            versionId: string | null;
+        } | {
+            /** @enum {string} */
+            result: "definitionRequired";
+        } | {
+            changedKeys: string[];
+            /** @enum {string} */
+            changes: "none" | "create" | "update";
+            contentHash: string;
+            remoteHash?: string;
+            /** @enum {string} */
+            result: "plan";
+            skillId?: string;
+        };
+        SkillEnsureUnprocessable: components["schemas"]["SkillEnsureHashMismatch"] | components["schemas"]["SkillEnsureUnsupportedCapability"];
+        SkillEnsureUnsupportedCapability: {
+            /** @enum {string} */
+            code: "unsupported_capability";
+            error: string;
+        };
         SkillProposal: {
             createdAt: string;
             id: string;
@@ -36564,6 +37229,89 @@ interface components {
             skillVersionId: string;
             status: string;
         };
+        SkillPullResponse: {
+            contentHash: string;
+            definition: {
+                manifest: {
+                    [key: string]: unknown;
+                };
+                name: string;
+            };
+            lastModifiedSource: string | null;
+            skillId: string;
+            updatedAt: string | null;
+            versionId: string | null;
+        };
+        SurfaceEnsureConflict: {
+            /** @enum {string} */
+            code: "external_modification" | "remote_changed";
+            currentHash?: string | null;
+            error: string;
+            lastModifiedSource?: string;
+            modifiedAt?: string | null;
+        };
+        SurfaceEnsureHashMismatch: {
+            /** @enum {string} */
+            code: "content_hash_mismatch";
+            /** @description The server-computed canonical hash of the submitted definition. */
+            contentHash: string;
+            error: string;
+        };
+        SurfaceEnsureResponse: {
+            /** @description Server-computed canonical content hash. Clients should echo this hash in probes. */
+            contentHash: string;
+            /** @enum {string} */
+            result: "unchanged" | "created" | "updated";
+            surfaceId: string;
+        } | {
+            /** @enum {string} */
+            result: "definitionRequired";
+        } | {
+            changedKeys: string[];
+            /** @enum {string} */
+            changes: "none" | "create" | "update";
+            contentHash: string;
+            remoteHash?: string;
+            /** @enum {string} */
+            result: "plan";
+            surfaceId?: string;
+        };
+        SurfacePullResponse: {
+            contentHash: string;
+            definition: {
+                behavior?: {
+                    [key: string]: unknown;
+                };
+                /** @enum {string} */
+                environment?: "production" | "development";
+                inbound?: {
+                    [key: string]: unknown;
+                };
+                name: string;
+                outbound?: {
+                    [key: string]: unknown;
+                };
+                /** @enum {string} */
+                status?: "draft" | "active" | "paused";
+                /** @enum {string} */
+                type: "chat" | "mcp" | "mcp_code" | "api" | "webhook" | "schedule" | "a2a" | "email" | "slack" | "sms" | "imessage" | "discord" | "whatsapp" | "telegram" | "hosted-page" | "chrome_extension";
+            };
+            lastModifiedSource: string | null;
+            surfaceId: string;
+            updatedAt: string | null;
+        };
+        ToolApprovalGrant: {
+            agentId: string;
+            createdAt: string;
+            decision: string;
+            endUserRef: string | null;
+            expiresAt: string | null;
+            id: string;
+            sourceApprovalId: string | null;
+            sourceExecutionId: string | null;
+            toolName: string;
+            toolType: string;
+        };
         ToolEnsureConflict: {
             /** @enum {string} */
             code: "external_modification" | "remote_changed";
@@ -36922,7 +37670,7 @@ interface FetchUrlStepConfig$1 {
         [key: string]: any;
     };
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     defaultValue?: unknown;
     streamOutput?: boolean;
     enabled?: boolean;
@@ -36951,7 +37699,7 @@ interface CrawlStepConfig$1 {
     jsonOptions?: Record<string, unknown>;
     outputVariable?: string;
     streamOutput?: boolean;
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     pollIntervalMs?: number;
     completionTimeoutMs?: number;
     defaultValue?: unknown;
@@ -36974,7 +37722,7 @@ interface TransformDataStepConfig$1 {
     networkAccess?: 'off' | 'on' | {
         allowedHostnames: string[];
     };
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     defaultValue?: unknown;
     tools?: {
         toolIds?: string[];
@@ -37026,7 +37774,7 @@ interface SearchStepConfig$1 {
     outputVariable?: string;
     returnCitations?: boolean;
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     streamOutput?: boolean;
     enabled?: boolean;
     /** JavaScript predicate evaluated at runtime. If falsy, the step is skipped. */
@@ -37049,7 +37797,7 @@ interface SendEmailStepConfig$1 {
     }>;
     outputVariable?: string;
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     defaultValue?: unknown;
     streamOutput?: boolean;
     enabled?: boolean;
@@ -37114,7 +37862,7 @@ interface UpsertRecordStepConfig$1 {
     mergeStrategy?: 'merge' | 'replace';
     outputVariable?: string;
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     streamOutput?: boolean;
     enabled?: boolean;
     /** JavaScript predicate evaluated at runtime. If falsy, the step is skipped. */
@@ -37176,7 +37924,7 @@ interface WaitUntilStepConfig$1 {
     };
     outputVariable?: string;
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     streamOutput?: boolean;
     enabled?: boolean;
     /** JavaScript predicate evaluated at runtime. If falsy, the step is skipped. */
@@ -37189,7 +37937,7 @@ interface SendEventStepConfig$1 {
     properties?: Record<string, any>;
     outputVariable?: string;
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     streamOutput?: boolean;
     enabled?: boolean;
     /** JavaScript predicate evaluated at runtime. If falsy, the step is skipped. */
@@ -37202,7 +37950,7 @@ interface SendTextStepConfig$1 {
     message: string;
     outputVariable?: string;
     /** Error handling configuration - supports simple mode or fallback chains */
-    errorHandling?: ErrorHandlingMode | ContextErrorHandling;
+    errorHandling?: ContextErrorHandling;
     streamOutput?: boolean;
     enabled?: boolean;
     /** JavaScript predicate evaluated at runtime. If falsy, the step is skipped. */
@@ -40025,6 +40773,144 @@ declare class PromptsNamespace {
     delete(promptId: string): Promise<void>;
 }
 
+/**
+ * Skill config-as-code: `defineSkill`, `skills.ensure`, `skills.pull`.
+ *
+ * The deploy-time convergence postcondition for Agent Skills: "make the
+ * platform's definition of this skill match this manifest; no-op if it already
+ * does." Identity is name + account scope (the API key's org, else personal);
+ * environment is whichever API the client points at. `ensure` never deletes,
+ * and renaming a manifest orphans the old skill and creates a new one.
+ *
+ * This is the admin/control-plane converge — API scopes only, no review queue.
+ * It is NOT the deployed-agent `propose_skill` data plane.
+ *
+ * Wire protocol (POST /v1/skills/ensure — APQ-shaped, both APQ scars fixed):
+ *   1. Hash-only probe `{ name, contentHash }`. A match is
+ *      `{ result: 'unchanged' }`; a miss is a NORMAL 200
+ *      `{ result: 'definitionRequired' }`, never an error.
+ *   2. On a miss, retry with the full `definition`. The server recomputes the
+ *      canonical hash itself and returns it on every response — this SDK echoes
+ *      the server's hash (memoized per client instance) rather than trusting its
+ *      own serialization.
+ *
+ * Like agents/flows (and unlike tools), skills HAVE version snapshots: every
+ * change appends an immutable version, the result carries a `versionId`, and
+ * `release: 'publish'` re-aims the published-version pointer.
+ *
+ * The content hash is the canonical skill hash (`computeSkillContentHash` —
+ * mirrored from `packages/shared/src/utils/skill-content-hash.ts`; this package
+ * is dependency-free by convention) over the manifest `{ frontmatter (name
+ * excluded), runtype, body }`. `name` is identity, not content.
+ *
+ * See docs/adr/0003-agent-config-as-code-ensure.md for the design rationale.
+ */
+
+interface SkillContentInput {
+    /** Identity — excluded from the hash. */
+    name: string;
+    manifest: SkillManifest | Record<string, unknown>;
+}
+/** Canonical normalized form of a skill manifest (frontmatter name excluded). */
+declare function normalizeSkillDefinition(definition: SkillContentInput): {
+    frontmatter: Record<string, unknown>;
+    runtype: Record<string, unknown>;
+    body: string;
+};
+/** SHA-256 (hex) over the canonical normalized skill manifest. */
+declare function computeSkillContentHash(definition: SkillContentInput): Promise<string>;
+/** `defineSkill` input: identity (name) + the convergeable manifest content. */
+interface DefineSkillInput {
+    name: string;
+    manifest: SkillManifest;
+}
+/** The canonical (wire) definition produced by `defineSkill`. */
+interface SkillDefinition {
+    name: string;
+    manifest: SkillManifest;
+}
+/**
+ * Pure-local declarative constructor for a skill definition. No I/O. Validates
+ * structure, rejects unknown fields, and asserts the manifest's frontmatter
+ * name matches the identity name. Deep validation (capability gate, length
+ * limits) happens server-side at ensure time, mirroring the create/update
+ * routes.
+ *
+ * @example
+ * ```typescript
+ * const reviewer = defineSkill({
+ *   name: 'code_reviewer',
+ *   manifest: {
+ *     frontmatter: { name: 'code_reviewer', description: 'Reviews pull requests' },
+ *     runtype: { trustLevel: 'org' },
+ *     body: '# Code Reviewer\n\nReview the diff for bugs...',
+ *   },
+ * })
+ * ```
+ */
+declare function defineSkill(input: DefineSkillInput): SkillDefinition;
+interface EnsureSkillOptions {
+    /** Plan without writing (the CI drift gate). Sends the full definition. */
+    dryRun?: boolean;
+    /**
+     * What to do when the skill's last write came from the dashboard/API rather
+     * than ensure. Default 'error' (HTTP 409 → SkillEnsureConflictError).
+     */
+    onConflict?: 'error' | 'overwrite';
+    /** 'publish' also re-aims the published-version pointer. Default 'none'. */
+    release?: 'none' | 'publish';
+    /**
+     * TOCTOU guard binding a dry run to its apply: the write only proceeds if the
+     * remote still hashes to this value (409 remote_changed otherwise).
+     */
+    expectedRemoteHash?: string;
+    /** Implies dryRun; throws SkillDriftError unless the plan is 'none'. */
+    expectNoChanges?: boolean;
+}
+interface EnsureSkillConverged {
+    result: 'unchanged' | 'created' | 'updated';
+    skillId: string;
+    versionId: string | null;
+    /** The server-computed canonical hash (echo this — never your own). */
+    contentHash: string;
+}
+interface EnsureSkillPlan {
+    result: 'plan';
+    changes: 'none' | 'create' | 'update';
+    changedKeys: string[];
+    contentHash: string;
+    remoteHash?: string;
+    skillId?: string;
+}
+type EnsureSkillResult = EnsureSkillConverged | EnsureSkillPlan;
+interface SkillPullResult {
+    skillId: string;
+    definition: SkillDefinition;
+    contentHash: string;
+    lastModifiedSource: string | null;
+    updatedAt: string | null;
+    versionId: string | null;
+}
+/** A 409 from the ensure protocol (external_modification or remote_changed). */
+declare class SkillEnsureConflictError extends Error {
+    readonly code: 'external_modification' | 'remote_changed';
+    readonly lastModifiedSource?: string;
+    readonly modifiedAt?: string | null;
+    readonly currentHash?: string | null;
+    constructor(body: {
+        error?: string;
+        code: 'external_modification' | 'remote_changed';
+        lastModifiedSource?: string;
+        modifiedAt?: string | null;
+        currentHash?: string | null;
+    });
+}
+/** Thrown by `ensure(def, { expectNoChanges: true })` when drift is detected. */
+declare class SkillDriftError extends Error {
+    readonly plan: EnsureSkillPlan;
+    constructor(plan: EnsureSkillPlan);
+}
+
 /**
  * SkillsNamespace — admin/control-plane operations for Agent Skills.
  *
@@ -40221,6 +41107,43 @@ interface SkillManifestInput {
 }
 /** A skill create/update payload — either a SKILL.md string or a manifest. */
 type SkillWriteInput = SkillMarkdownInput | SkillManifestInput;
+/** Per-finding tier surfaced to the user. */
+interface SkillScanFinding {
+    ruleId: string;
+    category: string | null;
+    severity: 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
+    confidence: number;
+    tier: 'warning' | 'error';
+    hardBlock: boolean;
+    message: string;
+    file: string;
+    startLine: number;
+    remediation: string | null;
+}
+/** Two-tier verdict over a skill scan. `tier` is authoritative. */
+interface SkillScanVerdict {
+    tier: 'clean' | 'warning' | 'error';
+    riskScore: number;
+    riskSeverity: 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
+    recommendation: 'SAFE' | 'CAUTION' | 'DO_NOT_INSTALL';
+    errors: SkillScanFinding[];
+    warnings: SkillScanFinding[];
+    summary: string;
+    scannerVersion: string;
+    verdictVersion: number;
+}
+/** The `POST /v1/skills/scan` response. */
+interface SkillScanResult {
+    status: 'passed' | 'warning' | 'blocked' | 'scanner_error';
+    verdict: SkillScanVerdict;
+    reportBody: string;
+    scannerVersion: string;
+    completedAt: string;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
 /** Options for binding a skill to an agent. */
 interface BindSkillInput {
     agentId: string;
@@ -40381,6 +41304,19 @@ declare class SkillsNamespace {
      * ```
      */
     publishVersion(skillId: string, versionId: string): Promise<void>;
+    /**
+     * Statically scan a SKILL.md document for malicious patterns and return a
+     * two-tier verdict — `warning` when a skill appears suspicious (low–medium
+     * confidence), `error` when high-confidence malicious. Does not persist or
+     * gate; use it as a "scan before save" affordance.
+     *
+     * @example
+     * ```typescript
+     * const { verdict } = await Runtype.skills.scan(skillMarkdown)
+     * if (verdict.tier === 'error') console.warn(verdict.summary)
+     * ```
+     */
+    scan(markdown: string): Promise<SkillScanResult>;
     /**
      * Import a single SKILL.md document. The imported skill lands with
      * `trustLevel: 'imported'` and a draft version.
@@ -40409,6 +41345,36 @@ declare class SkillsNamespace {
      * ```
      */
     listBindings(agentId: string): Promise<AgentSkillBinding[]>;
+    /**
+     * Idempotently converge a `defineSkill` definition onto the platform.
+     * Hash-first: the steady state is one tiny probe request. Creates or appends a
+     * new version; never deletes. Identity is name + account scope. Pass
+     * `release: 'publish'` to publish the converged version.
+     *
+     * @example
+     * ```typescript
+     * const reviewer = defineSkill({
+     *   name: 'code_reviewer',
+     *   manifest: {
+     *     frontmatter: { name: 'code_reviewer', description: 'Reviews pull requests' },
+     *     runtype: { trustLevel: 'org' },
+     *     body: '# Code Reviewer\n\nReview the diff...',
+     *   },
+     * })
+     *
+     * // Converge + publish (CI/deploy).
+     * const result = await Runtype.skills.ensure(reviewer, { release: 'publish' })
+     *
+     * // PR drift gate.
+     * await Runtype.skills.ensure(reviewer, { expectNoChanges: true })
+     * ```
+     */
+    ensure(definition: SkillDefinition, options?: EnsureSkillOptions): Promise<EnsureSkillResult>;
+    /**
+     * Pull the canonical definition + provenance for a skill by name — the
+     * absorb-drift direction of the ensure protocol.
+     */
+    pull(name: string): Promise<SkillPullResult>;
 }
 
 /**
@@ -41025,6 +41991,201 @@ declare class ProductsNamespace {
     pull(name: string): Promise<ProductPullResult>;
 }
 
+/**
+ * Surface config-as-code: `defineSurface`, `surfaces.ensure`, `surfaces.pull`.
+ *
+ * The deploy-time convergence postcondition for product surfaces: "make the
+ * platform's definition of this surface match this object; no-op if it already
+ * does." Surfaces are PRODUCT-scoped: identity is (productId, name) — NOT
+ * account scope. `ensure` never deletes, and renaming a definition orphans the
+ * old surface and creates a new one.
+ *
+ * Wire protocol (POST /v1/products/{id}/surfaces/ensure — APQ-shaped, both APQ
+ * scars fixed):
+ *   1. Hash-only probe `{ name, contentHash }`. A match is
+ *      `{ result: 'unchanged' }`; a miss is a NORMAL 200
+ *      `{ result: 'definitionRequired' }`, never an error.
+ *   2. On a miss, retry with the full `definition`. The server recomputes the
+ *      canonical hash itself and returns it on every response — this SDK echoes
+ *      the server's hash (memoized per client instance) rather than trusting
+ *      its own serialization.
+ *
+ * Unlike agents/flows, surfaces have NO version snapshots: there is no
+ * `release: 'publish'` option and no `versionId` on the result.
+ *
+ * The content hash is the canonical surface hash (`computeSurfaceContentHash` —
+ * mirrored from `packages/shared/src/utils/surface-content-hash.ts`; this
+ * package is dependency-free by convention) over `{ type, behavior, status,
+ * environment }`. `name` is identity, not content, so it is excluded; `inbound` /
+ * `outbound` are also EXCLUDED — they carry sealed secrets that hash
+ * non-deterministically against the stored row (see `normalizeSurfaceDefinition`).
+ *
+ * See docs/adr/0003-agent-config-as-code-ensure.md for the design rationale.
+ */
+
+/**
+ * Canonical normalized form of a surface definition (name excluded — identity).
+ * `inbound` / `outbound` are EXCLUDED — they carry sealed secrets that hash
+ * non-deterministically against the stored row. MUST stay in sync with the
+ * canonical copy in @runtypelabs/shared (utils/surface-content-hash.ts).
+ */
+declare function normalizeSurfaceDefinition(definition: SurfaceContentInput): {
+    type: string;
+    behavior: Record<string, unknown>;
+    status: string;
+    environment: string;
+};
+/** SHA-256 (hex) over the canonical normalized surface definition. */
+declare function computeSurfaceContentHash(definition: SurfaceContentInput): Promise<string>;
+interface SurfaceContentInput {
+    type: string;
+    behavior?: Record<string, unknown> | null;
+    inbound?: Record<string, unknown> | null;
+    outbound?: Record<string, unknown> | null;
+    status?: string | null;
+    environment?: string | null;
+}
+/** The surface types `ensure` accepts (mirrors the server's createSurfaceSchema). */
+type SurfaceDefinitionType = 'chat' | 'mcp' | 'mcp_code' | 'api' | 'webhook' | 'schedule' | 'a2a' | 'email' | 'slack' | 'sms' | 'imessage' | 'discord' | 'whatsapp' | 'telegram' | 'hosted-page' | 'chrome_extension';
+type SurfaceDefinitionStatus = 'draft' | 'active' | 'paused';
+type SurfaceDefinitionEnvironment = 'production' | 'development';
+/** `defineSurface` input: identity (name) + the convergeable content fields. */
+interface DefineSurfaceInput {
+    name: string;
+    type: SurfaceDefinitionType;
+    behavior?: Record<string, unknown>;
+    inbound?: Record<string, unknown>;
+    outbound?: Record<string, unknown>;
+    status?: SurfaceDefinitionStatus;
+    environment?: SurfaceDefinitionEnvironment;
+}
+/** The canonical (wire) definition produced by `defineSurface`. */
+interface SurfaceDefinition {
+    name: string;
+    type: SurfaceDefinitionType;
+    behavior?: Record<string, unknown>;
+    inbound?: Record<string, unknown>;
+    outbound?: Record<string, unknown>;
+    status?: SurfaceDefinitionStatus;
+    environment?: SurfaceDefinitionEnvironment;
+}
+/**
+ * Pure-local declarative constructor for a surface definition. No I/O.
+ * Validates structure and rejects unknown fields. Deep validation (credential
+ * sealing, prerelease-type-in-production guard) happens server-side at ensure
+ * time, mirroring the create/update routes.
+ *
+ * @example
+ * ```typescript
+ * const chat = defineSurface({
+ *   name: 'Support Chat',
+ *   type: 'chat',
+ *   behavior: { type: 'chat', greeting: 'Hi there!' },
+ *   status: 'active',
+ * })
+ * ```
+ */
+declare function defineSurface(input: DefineSurfaceInput): SurfaceDefinition;
+interface EnsureSurfaceOptions {
+    /** Plan without writing (the CI drift gate). Sends the full definition. */
+    dryRun?: boolean;
+    /**
+     * What to do when the surface's last write came from the dashboard/API
+     * rather than ensure. Default 'error' (HTTP 409 → SurfaceEnsureConflictError).
+     */
+    onConflict?: 'error' | 'overwrite';
+    /**
+     * TOCTOU guard binding a dry run to its apply: the write only proceeds if
+     * the remote still hashes to this value (409 remote_changed otherwise).
+     */
+    expectedRemoteHash?: string;
+    /** Implies dryRun; throws SurfaceDriftError unless the plan is 'none'. */
+    expectNoChanges?: boolean;
+}
+interface EnsureSurfaceConverged {
+    result: 'unchanged' | 'created' | 'updated';
+    surfaceId: string;
+    /** The server-computed canonical hash (echo this — never your own). */
+    contentHash: string;
+}
+interface EnsureSurfacePlan {
+    result: 'plan';
+    changes: 'none' | 'create' | 'update';
+    changedKeys: string[];
+    contentHash: string;
+    remoteHash?: string;
+    surfaceId?: string;
+}
+type EnsureSurfaceResult = EnsureSurfaceConverged | EnsureSurfacePlan;
+interface SurfacePullResult {
+    surfaceId: string;
+    definition: SurfaceDefinition;
+    contentHash: string;
+    lastModifiedSource: string | null;
+    updatedAt: string | null;
+}
+/** A 409 from the ensure protocol (external_modification or remote_changed). */
+declare class SurfaceEnsureConflictError extends Error {
+    readonly code: 'external_modification' | 'remote_changed';
+    readonly lastModifiedSource?: string;
+    readonly modifiedAt?: string | null;
+    readonly currentHash?: string | null;
+    constructor(body: {
+        error?: string;
+        code: 'external_modification' | 'remote_changed';
+        lastModifiedSource?: string;
+        modifiedAt?: string | null;
+        currentHash?: string | null;
+    });
+}
+/** Thrown by `ensure(def, { expectNoChanges: true })` when drift is detected. */
+declare class SurfaceDriftError extends Error {
+    readonly plan: EnsureSurfacePlan;
+    constructor(plan: EnsureSurfacePlan);
+}
+
+/**
+ * SurfacesNamespace — config-as-code operations for product surfaces.
+ *
+ * `surfaces.ensure` is the deploy-time, non-executing converge (create-or-update
+ * a surface by name within a product); `surfaces.pull` is the absorb-drift
+ * direction. Both delegate to the implementation in `surfaces-ensure.ts`.
+ *
+ * Surfaces are PRODUCT-scoped: every operation takes the owning `productId`.
+ */
+
+declare class SurfacesNamespace {
+    private getClient;
+    constructor(getClient: () => RuntypeClient$1);
+    /**
+     * Idempotently converge a `defineSurface` definition onto a product.
+     * Hash-first: the steady state is one tiny probe request. Creates or updates
+     * the surface; never deletes. Identity is name + product.
+     *
+     * @example
+     * ```typescript
+     * const chat = defineSurface({
+     *   name: 'Support Chat',
+     *   type: 'chat',
+     *   behavior: { type: 'chat', greeting: 'Hi there!' },
+     *   status: 'active',
+     * })
+     *
+     * // Converge (CI/deploy).
+     * const result = await Runtype.surfaces.ensure('product_abc', chat)
+     *
+     * // PR drift gate.
+     * await Runtype.surfaces.ensure('product_abc', chat, { expectNoChanges: true })
+     * ```
+     */
+    ensure(productId: string, definition: SurfaceDefinition, options?: EnsureSurfaceOptions): Promise<EnsureSurfaceResult>;
+    /**
+     * Pull the canonical definition + provenance for a surface by name within a
+     * product — the absorb-drift direction of the ensure protocol.
+     */
+    pull(productId: string, name: string): Promise<SurfacePullResult>;
+}
+
 /**
  * Runtype - The unified SDK client for building and executing flows, batches, evals, and prompts
  *
@@ -41355,6 +42516,33 @@ declare class Runtype {
      * ```
      */
     static get products(): ProductsNamespace;
+    /**
+     * Config-as-code operations for product surfaces. `surfaces.ensure` is the
+     * deploy-time, non-executing converge (create-or-update a surface by name
+     * within a product); `surfaces.pull` is the absorb-drift direction.
+     *
+     * @example
+     * ```typescript
+     * import { Runtype, defineSurface } from '@runtypelabs/sdk'
+     *
+     * const chat = defineSurface({
+     *   name: 'Support Chat',
+     *   type: 'chat',
+     *   behavior: { type: 'chat', greeting: 'Hi there!' },
+     *   status: 'active',
+     * })
+     *
+     * // Converge at deploy time (idempotent; one tiny probe in steady state)
+     * await Runtype.surfaces.ensure('product_abc', chat)
+     *
+     * // CI drift gate
+     * await Runtype.surfaces.ensure('product_abc', chat, { expectNoChanges: true })
+     *
+     * // Absorb a dashboard edit back into the repo
+     * const { definition } = await Runtype.surfaces.pull('product_abc', 'Support Chat')
+     * ```
+     */
+    static get surfaces(): SurfacesNamespace;
 }
 
 /**
@@ -44055,6 +45243,45 @@ interface UpdateAppRequest {
     visibility?: 'public' | 'unlisted';
     status?: 'active' | 'suspended';
 }
+/**
+ * Tool approval grant (cross-session "Always allow") returned by the grants
+ * API. A null `endUserRef` is an account-level grant.
+ */
+interface ToolApprovalGrant {
+    id: string;
+    agentId: string;
+    endUserRef: string | null;
+    toolType: string;
+    toolName: string;
+    decision: string;
+    sourceExecutionId: string | null;
+    sourceApprovalId: string | null;
+    createdAt: string;
+    expiresAt: string | null;
+}
+/**
+ * Tool Approval Grants API
+ *
+ * Manage cross-session "Always allow" tool-approval grants: list the
+ * authenticated owner's remembered approvals and revoke them so the tool
+ * prompts for approval again on future dispatches.
+ */
+declare class ToolApprovalGrantsEndpoint {
+    private client;
+    constructor(client: ApiClient);
+    /**
+     * List active remembered tool-approval grants for the authenticated owner,
+     * optionally filtered to a single agent.
+     */
+    list(agentId?: string): Promise<ToolApprovalGrant[]>;
+    /**
+     * Revoke (soft-delete) a remembered grant so the tool prompts for approval
+     * again on future dispatches.
+     */
+    revoke(id: string): Promise<{
+        revoked: boolean;
+    }>;
+}
 /**
  * Apps endpoint handlers — Runtype Apps are hosted AI apps served at
  * {slug}-{shortId}.runtype.run. Deploy = upload a version (zip), then
@@ -44154,6 +45381,19 @@ interface RunWithLocalToolsOptions {
  * Automatically transforms field names between camelCase (client) and snake_case (API)
  * to provide an idiomatic JavaScript/TypeScript experience while maintaining API consistency.
  */
+/**
+ * Result of a conditional GET ({@link RuntypeClient.getConditional}). `304`
+ * surfaces as `notModified: true` (no body) rather than throwing; `200` returns
+ * the parsed `data` plus the server's fresh `etag`.
+ */
+type ConditionalGetResult<T> = {
+    notModified: true;
+    etag: string | null;
+} | {
+    notModified: false;
+    etag: string | null;
+    data: T;
+};
 declare class RuntypeClient implements ApiClient {
     private baseUrl;
     private apiVersion;
@@ -44185,6 +45425,7 @@ declare class RuntypeClient implements ApiClient {
     flowVersions: FlowVersionsEndpoint;
     integrations: IntegrationsEndpoint;
     billing: BillingEndpoint;
+    toolApprovalGrants: ToolApprovalGrantsEndpoint;
     constructor(config?: ClientConfig);
     /**
      * Set the API key for authentication
@@ -44226,6 +45467,16 @@ declare class RuntypeClient implements ApiClient {
      * Generic GET request
      */
     get<T>(path: string, params?: Record<string, unknown>): Promise<T>;
+    /**
+     * Conditional GET (`ETag` / `If-None-Match`).
+     *
+     * Unlike {@link get}, this does NOT throw on `304` — it surfaces the not-modified
+     * outcome so callers can keep their cached copy. Used by the dashboard's primary
+     * lists to revalidate the canonical first page in a single round trip on both
+     * the changed and unchanged paths. The `304` path returns no body; the `200`
+     * path returns the parsed body plus the server's fresh `ETag`.
+     */
+    getConditional<T>(path: string, params?: Record<string, unknown>, ifNoneMatch?: string | null): Promise<ConditionalGetResult<T>>;
     /**
      * Generic POST request
      */
@@ -44261,6 +45512,15 @@ declare class RuntypeClient implements ApiClient {
     /**
      * Make HTTP request with timeout and error handling
      */
+    /**
+     * Run a fetch under the client timeout and return the raw `Response`. Maps a
+     * timeout-driven `AbortError` to a descriptive timeout `Error`; does NOT inspect
+     * status, so callers decide how to treat non-2xx (throw, intercept `304`, etc.).
+     *
+     * `makeRawRequest` keeps its own variant: it additionally composes a
+     * caller-supplied `signal` (user-initiated stream aborts) with the timeout.
+     */
+    private fetchWithTimeout;
     private makeRequest;
     /**
      * Make HTTP request that returns raw Response (for streaming)
@@ -45753,4 +47013,4 @@ declare function getLikelySupportingCandidatePaths(bestCandidatePath: string | u
 declare function getDefaultPlanPath(taskName: string): string;
 declare function sanitizeTaskSlug(taskName: string): string;
 
-export { type Agent, type AgentApprovalCompleteEvent, type AgentApprovalStartEvent, type AgentCompleteEvent, type AgentDefinition, type AgentDefinitionConfig, AgentDriftError, AgentEnsureConflictError, type AgentErrorEvent, type AgentEvent, type AgentEventType, type AgentExecuteRequest, type AgentExecuteResponse, type AgentIterationCompleteEvent, type AgentIterationStartEvent, type AgentMediaEvent, type AgentMessage, type AgentPausedEvent, type AgentPingEvent, type AgentPullResult, type AgentReflectionEvent, type AgentRuntimeToolDefinition, type AgentStartEvent, type AgentStreamCallbacks, type AgentStreamEvent, type AgentSubagentConfig, type AgentToolCompleteEvent, type AgentToolDeltaEvent, type AgentToolInputCompleteEvent, type AgentToolInputDeltaEvent, type AgentToolStartEvent, type AgentTurnCompleteEvent, type AgentTurnDeltaEvent, type AgentTurnStartEvent, type AgentVersionDetail, type AgentVersionListItem, type AgentVersionPublishResponse, AgentVersionsEndpoint, type AgentVersionsListResponse, AgentsEndpoint, AgentsNamespace, AnalyticsEndpoint, type ApiClient, type ApiKey, ApiKeysEndpoint, type ApiResponse, type App, type AppManifest, type AppVersion, type ApplyGeneratedProposalOptions, type ApplyGeneratedProposalResult, AppsEndpoint, type AssetReferenceContentPart, type AttachRuntimeToolsOptions, type BaseAgentEvent, BatchBuilder, type BatchClient, type BatchListParams, type BatchOptions, type BatchRequest, type BatchResult, type BatchScheduleConfig, type BatchStatus, BatchesNamespace, BillingEndpoint, type BillingSpendAnalyticsParams, type BindSkillInput, type BuiltInTool, type BulkEditCondition, type BulkEditRequest, type BulkEditResponse, type BulkEditResult, ChatEndpoint, ClientBatchBuilder, type ClientConfig, type ClientConversation, ClientEvalBuilder, ClientFlowBuilder, type ClientToken, type ClientTokenConfig, type ClientTokenEnvironment, type ClientTokenVersionPin, ClientTokensEndpoint, type ClientToolDefinition, type ClientWidgetTheme, type ConditionalStepConfig$1 as ConditionalStepConfig, type ContextErrorHandling, type ContextFallback, ContextTemplatesEndpoint, type Conversation, type ConversationListItem, type ConversationListParams, type ConversationMessage, type ConversationSource, ConversationsEndpoint, type ConversationsListResponse, type CreateApiKeyRequest, type CreateAppRequest, type CreateClientTokenRequest, type CreateClientTokenResponse, type CreateConversationRequest, type CreateFlowRequest, type CreateModelConfigRequest, type CreatePromptData, type CreatePromptRequest, type CreateProviderKeyRequest, type CreateRecordRequest, type CreateScheduleRequest, type CreateSecretRequest, type CreateToolRequest, type CustomMCPServer, type CustomMCPServerAuth, type CustomToolConfig, DEFAULT_RECOVERY_AFTER_EMPTY_SESSIONS, DEFAULT_STALL_STOP_AFTER, type DefineAgentInput, type DefineFlowInput, type DefineProductInput, type DefineToolInput, type DeployCfSandboxRequest, type DeployCfSandboxResponse, type DeploySandboxRequest, type DeploySandboxResponse, type DiscoveredModel, type DispatchClient, DispatchEndpoint, type DispatchEnvironment, type DispatchEvent, type DispatchOptions$1 as DispatchOptions, type DispatchRequest, type EnsureAgentConverged, type EnsureAgentOptions, type EnsureAgentPlan, type EnsureAgentResult, type EnsureFlowConverged, type EnsureFlowOptions, type EnsureFlowPlan, type EnsureFlowResult, type EnsureProductConverged, type EnsureProductOptions, type EnsureProductPlan, type EnsureProductResult, type EnsureToolConverged, type EnsureToolOptions, type EnsureToolPlan, type EnsureToolResult, type ErrorHandlingMode, EvalBuilder, type EvalClient, EvalEndpoint, type EvalListParams, type EvalOptions, type EvalRecord, type EvalRequest, type EvalResult, type EvalRunConfig, EvalRunner, type EvalStatus, EvalsNamespace, type ExecuteToolRequest, type ExecuteToolResponse, type ExternalAgentContext, type ExternalToolConfig, type FallbackFailEvent, type FallbackStartEvent, type FallbackSuccessEvent, type FallbackTrigger, type FallbackTriggerType, type FallbacksExhaustedEvent, type FallbacksInitiatedEvent, type FetchGitHubStepConfig$1 as FetchGitHubStepConfig, type FetchUrlStepConfig$1 as FetchUrlStepConfig, type FieldFormat, type FileContentPart, type Flow, type FlowAttachment, FlowBuilder, type FlowCompleteEvent, type FlowConfig$1 as FlowConfig, type FlowDefinition, type FlowDefinitionStep, FlowDriftError, FlowEnsureConflictError, type FlowErrorEvent, type FlowFallback, type FlowListItem, type FlowPausedEvent, type FlowPullResult, FlowResult, type FlowStartEvent, type FlowStep, type FlowStepDefinition, type FlowStepType, FlowStepsEndpoint, type FlowStreamEvent, type FlowSummary, type FlowToolConfig, type FlowValidationClient, type FlowValidationIssue, type FlowValidationResult, type FlowVersionDetail, type FlowVersionListItem, type FlowVersionPublishResponse, FlowVersionsEndpoint, type FlowVersionsListResponse, FlowsEndpoint, FlowsNamespace, type GenerateEmbeddingStepConfig$1 as GenerateEmbeddingStepConfig, type GeneratedRuntimeToolGateDecision, type GeneratedRuntimeToolGateOptions, type ImageContentPart, type Integration, type IntegrationTool, IntegrationsEndpoint, type IntegrationsListResponse, type JSONSchema, type JsonArray, type JsonObject, type JsonPrimitive, type JsonValue, LEDGER_ARTIFACT_LINE_PREFIX, type ListConversationsResponse, type ListParams, type LocalToolConfig, type LocalToolDefinition, type LocalToolExecutionCompleteEvent, type LocalToolExecutionLoopSnapshotSlice, type LocalToolExecutionStartEvent, type LogEntry, type LogQueryParams, type LogQueryResponse, type LogQueryResult, type LogStatsParams, type LogStatsResponse, type LogStatsResult, LogsEndpoint, type Message$1 as Message, type MessageContent, type MessageFallback, type Metadata, type ModelConfig, ModelConfigsEndpoint, type ModelFallback, type ModelOverride, type ModelUsageDetail, type ModelUsageQueryParams, type ModelUsageResponse, type ModelUsageSummary, type ModelUsageTimeSeries, type PaginationResponse, type ProductDefinition, ProductDriftError, ProductEnsureConflictError, type ProductPullResult, ProductsNamespace, type Prompt$1 as Prompt, type PromptErrorHandling, type PromptFallback, type PromptListParams, type PromptRunOptions, PromptRunner, type PromptStepConfig$1 as PromptStepConfig, PromptsEndpoint, PromptsNamespace, type ProviderApiKey, type ProviderKeyModel, ProviderKeysEndpoint, type ReasoningConfig, type ReasoningContentPart, type ReasoningValue, type RecordConfig$1 as RecordConfig, type RecordCostAggregation, type RecordCostModelBreakdown, type RecordFilter, type RecordFilterCondition, type RecordFilterGroup, type RecordFilterOperator, type RecordListItem, type RecordListParams, type RecordStepResult, type RecordStepResultsParams, type RecordStepResultsResponse, type RecordWriteResponse, RecordsEndpoint, type RetrieveRecordStepConfig$1 as RetrieveRecordStepConfig, type RetryFallback, type RunTaskContextBudgetBreakdown, type RunTaskContextCompactionEvent, type RunTaskContextCompactionStrategy, type RunTaskContextNoticeEvent, type RunTaskContextSummaryEntry, type RunTaskContinuation, type RunTaskOffloadRecorder, type RunTaskOnContextCompaction, type RunTaskOnContextNotice, type RunTaskOnSession, type RunTaskOptions, type RunTaskResult, type RunTaskResumeState, type RunTaskSessionSummary, type RunTaskState, type RunTaskStateSlice, type RunTaskStatus, type RunTaskToolTraceSlice, type RuntimeCustomToolConfig, type RuntimeExternalToolConfig, type RuntimeFlowToolConfig, type RuntimeLocalToolConfig, type RuntimeSubagentToolConfig, type RuntimeTool, type RuntimeToolConfig, Runtype, type AgentSkillBinding as RuntypeAgentSkillBinding, RuntypeApiError, RuntypeClient, type ConditionalStepConfig as RuntypeConditionalStepConfig, type RuntypeConfig, type FetchGitHubStepConfig as RuntypeFetchGitHubStepConfig, type FetchUrlStepConfig as RuntypeFetchUrlStepConfig, RuntypeFlowBuilder, type FlowConfig as RuntypeFlowConfig, type GenerateEmbeddingStepConfig as RuntypeGenerateEmbeddingStepConfig, type Message as RuntypeMessage, type ModelOverride$1 as RuntypeModelOverride, type Prompt as RuntypePrompt, type PromptStepConfig as RuntypePromptStepConfig, type RuntypeRecord, type RecordConfig as RuntypeRecordConfig, type RetrieveRecordStepConfig as RuntypeRetrieveRecordStepConfig, type SearchStepConfig as RuntypeSearchStepConfig, type SendEmailStepConfig as RuntypeSendEmailStepConfig, type SendEventStepConfig as RuntypeSendEventStepConfig, type SendStreamStepConfig as RuntypeSendStreamStepConfig, type SendTextStepConfig as RuntypeSendTextStepConfig, type SetVariableStepConfig as RuntypeSetVariableStepConfig, type Skill as RuntypeSkill, type SkillCapabilities as RuntypeSkillCapabilities, type SkillFrontmatter as RuntypeSkillFrontmatter, type SkillManifest as RuntypeSkillManifest, type SkillProposal as RuntypeSkillProposal, type SkillRuntypeExtensions as RuntypeSkillRuntypeExtensions, type SkillVersion as RuntypeSkillVersion, type TransformDataStepConfig as RuntypeTransformDataStepConfig, type UpsertFlowConfig as RuntypeUpsertFlowConfig, type UpsertRecordStepConfig as RuntypeUpsertRecordStepConfig, type VectorSearchStepConfig as RuntypeVectorSearchStepConfig, type WaitUntilStepConfig as RuntypeWaitUntilStepConfig, STEP_FIELD_REGISTRY, STEP_TYPE_TO_METHOD, type Schedule, type ScheduleExecutionOptions, type ScheduleListParams, type ScheduleMessage, type ScheduleMessageSet, type ScheduleMessages, type ScheduleMutationResponse, type ScheduleRun, type ScheduleRunNowResponse, type ScheduleStatusResponse, type ScheduleTarget, type ScheduleTrigger, SchedulesEndpoint, type SearchStepConfig$1 as SearchStepConfig, type Secret, type SecretCheckResponse, type SecretDeleteResponse, type SecretSetupUrlRequest, type SecretSetupUrlResponse, SecretsEndpoint, type SendEmailStepConfig$1 as SendEmailStepConfig, type SendEventStepConfig$1 as SendEventStepConfig, type SendStreamStepConfig$1 as SendStreamStepConfig, type SendTextStepConfig$1 as SendTextStepConfig, type SetVariableStepConfig$1 as SetVariableStepConfig, type SkillListPage, type SkillListPagination, type SkillListParams, type SkillManifestInput, type SkillMarkdownInput, type SkillOrigin, type SkillProposalStatus, SkillProposalsNamespace, type SkillStatus, type SkillTrustLevel, type SkillVersionStatus, type SkillWithVersion, type SkillWriteInput, SkillsNamespace, type SlackInstallRequest, type StepCompleteEvent, type StepDeltaEvent, type StepFallback, type StepFieldMeta, type StepStartEvent, type StepWaitingLocalEvent, type StreamCallbacks, type StreamEvent, type StreamEventOf, type SubagentToolConfig, type Surface, type SurfaceListParams, SurfacesEndpoint, type TextContentPart, type Tool, type ToolConfig, type ToolDefinition, type ToolDefinitionType, ToolDriftError, ToolEnsureConflictError, type ToolPullResult, type ToolWithValidation, type ToolsConfig, ToolsEndpoint, ToolsNamespace, type TransformDataStepConfig$1 as TransformDataStepConfig, type UpdateAppRequest, type UpdateClientTokenRequest, type UpdateConversationRequest, type UpdatePromptData, type UpdateProviderKeyRequest, type UpdateScheduleRequest, type UpdateSecretRequest, type UpdateToolRequest, type UpdatedFlow, type UpsertFlowConfig$1 as UpsertFlowConfig, type UpsertOptions, type UpsertRecordStepConfig$1 as UpsertRecordStepConfig, type UserProfile, UsersEndpoint, type VectorSearchStepConfig$1 as VectorSearchStepConfig, type VersionType, type WaitUntilStepConfig$1 as WaitUntilStepConfig, type WorkflowCompileDeps, type WorkflowCompletionCriteriaConfig, type WorkflowConfig, type WorkflowConfigFactory, type WorkflowContext, type WorkflowDefinition, type WorkflowHookEntry, type WorkflowHookKind, type WorkflowHookRef, type WorkflowHookSignatures, type WorkflowMilestoneConfig, type WorkflowPhase, type WorkflowPolicyConfig, type WorkflowRecoveryConfig, type WorkflowSlot, type WorkflowStallPolicy, applyGeneratedRuntimeToolProposalToDispatchRequest, attachRuntimeToolsToDispatchRequest, buildEmptySessionNudge, buildGeneratedRuntimeToolGateOutput, buildLedgerOffloadReference, buildPolicyGuidance, buildSendViewOffloadMarker, compileWorkflowConfig, computeAgentContentHash, computeFlowContentHash, computeProductContentHash, computeToolContentHash, createClient, createExternalTool, defaultWorkflow, defaultWorkflowConfig, defineAgent, defineFlow, definePlaybook, defineProduct, defineTool, deployWorkflow, ensureDefaultWorkflowHooks, evaluateGeneratedRuntimeToolProposal, extractDeclaredToolResultChars, gameWorkflow, getDefaultPlanPath, getLikelySupportingCandidatePaths, interpolateWorkflowTemplate, isDiscoveryToolName, isMarathonArtifactPath, isPreservationSensitiveTask, isWorkflowHookRef, listWorkflowHooks, normalizeAgentDefinition, normalizeCandidatePath, normalizeProductDefinition, normalizeToolDefinition, parseFinalBuffer, parseLedgerArtifactRelativePath, parseOffloadedOutputId, parseSSEChunk, processStream, registerWorkflowHook, resolveStallStopAfter, resolveWorkflowHook, sanitizeTaskSlug, shouldInjectEmptySessionNudge, shouldRequestModelEscalation, streamEvents, unregisterWorkflowHook };
+export { type Agent, type AgentApprovalCompleteEvent, type AgentApprovalStartEvent, type AgentCompleteEvent, type AgentDefinition, type AgentDefinitionConfig, AgentDriftError, AgentEnsureConflictError, type AgentErrorEvent, type AgentEvent, type AgentEventType, type AgentExecuteRequest, type AgentExecuteResponse, type AgentIterationCompleteEvent, type AgentIterationStartEvent, type AgentMediaEvent, type AgentMessage, type AgentPausedEvent, type AgentPingEvent, type AgentPullResult, type AgentReflectionEvent, type AgentRuntimeToolDefinition, type AgentStartEvent, type AgentStreamCallbacks, type AgentStreamEvent, type AgentSubagentConfig, type AgentToolCompleteEvent, type AgentToolDeltaEvent, type AgentToolInputCompleteEvent, type AgentToolInputDeltaEvent, type AgentToolStartEvent, type AgentTurnCompleteEvent, type AgentTurnDeltaEvent, type AgentTurnStartEvent, type AgentVersionDetail, type AgentVersionListItem, type AgentVersionPublishResponse, AgentVersionsEndpoint, type AgentVersionsListResponse, AgentsEndpoint, AgentsNamespace, AnalyticsEndpoint, type ApiClient, type ApiKey, ApiKeysEndpoint, type ApiResponse, type App, type AppManifest, type AppVersion, type ApplyGeneratedProposalOptions, type ApplyGeneratedProposalResult, AppsEndpoint, type AssetReferenceContentPart, type AttachRuntimeToolsOptions, type BaseAgentEvent, BatchBuilder, type BatchClient, type BatchListParams, type BatchOptions, type BatchRequest, type BatchResult, type BatchScheduleConfig, type BatchStatus, BatchesNamespace, BillingEndpoint, type BillingSpendAnalyticsParams, type BindSkillInput, type BuiltInTool, type BulkEditCondition, type BulkEditRequest, type BulkEditResponse, type BulkEditResult, ChatEndpoint, ClientBatchBuilder, type ClientConfig, type ClientConversation, ClientEvalBuilder, ClientFlowBuilder, type ClientToken, type ClientTokenConfig, type ClientTokenEnvironment, type ClientTokenVersionPin, ClientTokensEndpoint, type ClientToolDefinition, type ClientWidgetTheme, type ConditionalGetResult, type ConditionalStepConfig$1 as ConditionalStepConfig, type ContextErrorHandling, type ContextFallback, ContextTemplatesEndpoint, type Conversation, type ConversationListItem, type ConversationListParams, type ConversationMessage, type ConversationSource, ConversationsEndpoint, type ConversationsListResponse, type CreateApiKeyRequest, type CreateAppRequest, type CreateClientTokenRequest, type CreateClientTokenResponse, type CreateConversationRequest, type CreateFlowRequest, type CreateModelConfigRequest, type CreatePromptData, type CreatePromptRequest, type CreateProviderKeyRequest, type CreateRecordRequest, type CreateScheduleRequest, type CreateSecretRequest, type CreateToolRequest, type CustomMCPServer, type CustomMCPServerAuth, type CustomToolConfig, DEFAULT_RECOVERY_AFTER_EMPTY_SESSIONS, DEFAULT_STALL_STOP_AFTER, type DefineAgentInput, type DefineFlowInput, type DefineProductInput, type DefineSkillInput, type DefineSurfaceInput, type DefineToolInput, type DeployCfSandboxRequest, type DeployCfSandboxResponse, type DeploySandboxRequest, type DeploySandboxResponse, type DiscoveredModel, type DispatchClient, DispatchEndpoint, type DispatchEnvironment, type DispatchEvent, type DispatchOptions$1 as DispatchOptions, type DispatchRequest, type EnsureAgentConverged, type EnsureAgentOptions, type EnsureAgentPlan, type EnsureAgentResult, type EnsureFlowConverged, type EnsureFlowOptions, type EnsureFlowPlan, type EnsureFlowResult, type EnsureProductConverged, type EnsureProductOptions, type EnsureProductPlan, type EnsureProductResult, type EnsureSkillConverged, type EnsureSkillOptions, type EnsureSkillPlan, type EnsureSkillResult, type EnsureSurfaceConverged, type EnsureSurfaceOptions, type EnsureSurfacePlan, type EnsureSurfaceResult, type EnsureToolConverged, type EnsureToolOptions, type EnsureToolPlan, type EnsureToolResult, type ErrorHandlingMode, EvalBuilder, type EvalClient, EvalEndpoint, type EvalListParams, type EvalOptions, type EvalRecord, type EvalRequest, type EvalResult, type EvalRunConfig, EvalRunner, type EvalStatus, EvalsNamespace, type ExecuteToolRequest, type ExecuteToolResponse, type ExternalAgentContext, type ExternalToolConfig, type FallbackFailEvent, type FallbackStartEvent, type FallbackSuccessEvent, type FallbackTrigger, type FallbackTriggerType, type FallbacksExhaustedEvent, type FallbacksInitiatedEvent, type FetchGitHubStepConfig$1 as FetchGitHubStepConfig, type FetchUrlStepConfig$1 as FetchUrlStepConfig, type FieldFormat, type FileContentPart, type Flow, type FlowAttachment, FlowBuilder, type FlowCompleteEvent, type FlowConfig$1 as FlowConfig, type FlowDefinition, type FlowDefinitionStep, FlowDriftError, FlowEnsureConflictError, type FlowErrorEvent, type FlowFallback, type FlowListItem, type FlowPausedEvent, type FlowPullResult, FlowResult, type FlowStartEvent, type FlowStep, type FlowStepDefinition, type FlowStepType, FlowStepsEndpoint, type FlowStreamEvent, type FlowSummary, type FlowToolConfig, type FlowValidationClient, type FlowValidationIssue, type FlowValidationResult, type FlowVersionDetail, type FlowVersionListItem, type FlowVersionPublishResponse, FlowVersionsEndpoint, type FlowVersionsListResponse, FlowsEndpoint, FlowsNamespace, type GenerateEmbeddingStepConfig$1 as GenerateEmbeddingStepConfig, type GeneratedRuntimeToolGateDecision, type GeneratedRuntimeToolGateOptions, type ImageContentPart, type Integration, type IntegrationTool, IntegrationsEndpoint, type IntegrationsListResponse, type JSONSchema, type JsonArray, type JsonObject, type JsonPrimitive, type JsonValue, LEDGER_ARTIFACT_LINE_PREFIX, type ListConversationsResponse, type ListParams, type LocalToolConfig, type LocalToolDefinition, type LocalToolExecutionCompleteEvent, type LocalToolExecutionLoopSnapshotSlice, type LocalToolExecutionStartEvent, type LogEntry, type LogQueryParams, type LogQueryResponse, type LogQueryResult, type LogStatsParams, type LogStatsResponse, type LogStatsResult, LogsEndpoint, type Message$1 as Message, type MessageContent, type MessageFallback, type Metadata, type ModelConfig, ModelConfigsEndpoint, type ModelFallback, type ModelOverride, type ModelUsageDetail, type ModelUsageQueryParams, type ModelUsageResponse, type ModelUsageSummary, type ModelUsageTimeSeries, type PaginationResponse, type ProductDefinition, ProductDriftError, ProductEnsureConflictError, type ProductPullResult, ProductsNamespace, type Prompt$1 as Prompt, type PromptErrorHandling, type PromptFallback, type PromptListParams, type PromptRunOptions, PromptRunner, type PromptStepConfig$1 as PromptStepConfig, PromptsEndpoint, PromptsNamespace, type ProviderApiKey, type ProviderKeyModel, ProviderKeysEndpoint, type ReasoningConfig, type ReasoningContentPart, type ReasoningValue, type RecordConfig$1 as RecordConfig, type RecordCostAggregation, type RecordCostModelBreakdown, type RecordFilter, type RecordFilterCondition, type RecordFilterGroup, type RecordFilterOperator, type RecordListItem, type RecordListParams, type RecordStepResult, type RecordStepResultsParams, type RecordStepResultsResponse, type RecordWriteResponse, RecordsEndpoint, type RetrieveRecordStepConfig$1 as RetrieveRecordStepConfig, type RetryFallback, type RunTaskContextBudgetBreakdown, type RunTaskContextCompactionEvent, type RunTaskContextCompactionStrategy, type RunTaskContextNoticeEvent, type RunTaskContextSummaryEntry, type RunTaskContinuation, type RunTaskOffloadRecorder, type RunTaskOnContextCompaction, type RunTaskOnContextNotice, type RunTaskOnSession, type RunTaskOptions, type RunTaskResult, type RunTaskResumeState, type RunTaskSessionSummary, type RunTaskState, type RunTaskStateSlice, type RunTaskStatus, type RunTaskToolTraceSlice, type RuntimeCustomToolConfig, type RuntimeExternalToolConfig, type RuntimeFlowToolConfig, type RuntimeLocalToolConfig, type RuntimeSubagentToolConfig, type RuntimeTool, type RuntimeToolConfig, Runtype, type AgentSkillBinding as RuntypeAgentSkillBinding, RuntypeApiError, RuntypeClient, type ConditionalStepConfig as RuntypeConditionalStepConfig, type RuntypeConfig, type FetchGitHubStepConfig as RuntypeFetchGitHubStepConfig, type FetchUrlStepConfig as RuntypeFetchUrlStepConfig, RuntypeFlowBuilder, type FlowConfig as RuntypeFlowConfig, type GenerateEmbeddingStepConfig as RuntypeGenerateEmbeddingStepConfig, type Message as RuntypeMessage, type ModelOverride$1 as RuntypeModelOverride, type Prompt as RuntypePrompt, type PromptStepConfig as RuntypePromptStepConfig, type RuntypeRecord, type RecordConfig as RuntypeRecordConfig, type RetrieveRecordStepConfig as RuntypeRetrieveRecordStepConfig, type SearchStepConfig as RuntypeSearchStepConfig, type SendEmailStepConfig as RuntypeSendEmailStepConfig, type SendEventStepConfig as RuntypeSendEventStepConfig, type SendStreamStepConfig as RuntypeSendStreamStepConfig, type SendTextStepConfig as RuntypeSendTextStepConfig, type SetVariableStepConfig as RuntypeSetVariableStepConfig, type Skill as RuntypeSkill, type SkillCapabilities as RuntypeSkillCapabilities, type SkillFrontmatter as RuntypeSkillFrontmatter, type SkillManifest as RuntypeSkillManifest, type SkillProposal as RuntypeSkillProposal, type SkillRuntypeExtensions as RuntypeSkillRuntypeExtensions, type SkillScanFinding as RuntypeSkillScanFinding, type SkillScanResult as RuntypeSkillScanResult, type SkillScanVerdict as RuntypeSkillScanVerdict, type SkillVersion as RuntypeSkillVersion, type TransformDataStepConfig as RuntypeTransformDataStepConfig, type UpsertFlowConfig as RuntypeUpsertFlowConfig, type UpsertRecordStepConfig as RuntypeUpsertRecordStepConfig, type VectorSearchStepConfig as RuntypeVectorSearchStepConfig, type WaitUntilStepConfig as RuntypeWaitUntilStepConfig, STEP_FIELD_REGISTRY, STEP_TYPE_TO_METHOD, type Schedule, type ScheduleExecutionOptions, type ScheduleListParams, type ScheduleMessage, type ScheduleMessageSet, type ScheduleMessages, type ScheduleMutationResponse, type ScheduleRun, type ScheduleRunNowResponse, type ScheduleStatusResponse, type ScheduleTarget, type ScheduleTrigger, SchedulesEndpoint, type SearchStepConfig$1 as SearchStepConfig, type Secret, type SecretCheckResponse, type SecretDeleteResponse, type SecretSetupUrlRequest, type SecretSetupUrlResponse, SecretsEndpoint, type SendEmailStepConfig$1 as SendEmailStepConfig, type SendEventStepConfig$1 as SendEventStepConfig, type SendStreamStepConfig$1 as SendStreamStepConfig, type SendTextStepConfig$1 as SendTextStepConfig, type SetVariableStepConfig$1 as SetVariableStepConfig, type SkillDefinition, SkillDriftError, SkillEnsureConflictError, type SkillListPage, type SkillListPagination, type SkillListParams, type SkillManifestInput, type SkillMarkdownInput, type SkillOrigin, type SkillProposalStatus, SkillProposalsNamespace, type SkillPullResult, type SkillStatus, type SkillTrustLevel, type SkillVersionStatus, type SkillWithVersion, type SkillWriteInput, SkillsNamespace, type SlackInstallRequest, type StepCompleteEvent, type StepDeltaEvent, type StepFallback, type StepFieldMeta, type StepStartEvent, type StepWaitingLocalEvent, type StreamCallbacks, type StreamEvent, type StreamEventOf, type SubagentToolConfig, type Surface, type SurfaceDefinition, type SurfaceDefinitionEnvironment, type SurfaceDefinitionStatus, type SurfaceDefinitionType, SurfaceDriftError, SurfaceEnsureConflictError, type SurfaceListParams, type SurfacePullResult, SurfacesEndpoint, SurfacesNamespace, type TextContentPart, type Tool, type ToolApprovalGrant, ToolApprovalGrantsEndpoint, type ToolConfig, type ToolDefinition, type ToolDefinitionType, ToolDriftError, ToolEnsureConflictError, type ToolPullResult, type ToolWithValidation, type ToolsConfig, ToolsEndpoint, ToolsNamespace, type TransformDataStepConfig$1 as TransformDataStepConfig, type UpdateAppRequest, type UpdateClientTokenRequest, type UpdateConversationRequest, type UpdatePromptData, type UpdateProviderKeyRequest, type UpdateScheduleRequest, type UpdateSecretRequest, type UpdateToolRequest, type UpdatedFlow, type UpsertFlowConfig$1 as UpsertFlowConfig, type UpsertOptions, type UpsertRecordStepConfig$1 as UpsertRecordStepConfig, type UserProfile, UsersEndpoint, type VectorSearchStepConfig$1 as VectorSearchStepConfig, type VersionType, type WaitUntilStepConfig$1 as WaitUntilStepConfig, type WorkflowCompileDeps, type WorkflowCompletionCriteriaConfig, type WorkflowConfig, type WorkflowConfigFactory, type WorkflowContext, type WorkflowDefinition, type WorkflowHookEntry, type WorkflowHookKind, type WorkflowHookRef, type WorkflowHookSignatures, type WorkflowMilestoneConfig, type WorkflowPhase, type WorkflowPolicyConfig, type WorkflowRecoveryConfig, type WorkflowSlot, type WorkflowStallPolicy, applyGeneratedRuntimeToolProposalToDispatchRequest, attachRuntimeToolsToDispatchRequest, buildEmptySessionNudge, buildGeneratedRuntimeToolGateOutput, buildLedgerOffloadReference, buildPolicyGuidance, buildSendViewOffloadMarker, compileWorkflowConfig, computeAgentContentHash, computeFlowContentHash, computeProductContentHash, computeSkillContentHash, computeSurfaceContentHash, computeToolContentHash, createClient, createExternalTool, defaultWorkflow, defaultWorkflowConfig, defineAgent, defineFlow, definePlaybook, defineProduct, defineSkill, defineSurface, defineTool, deployWorkflow, ensureDefaultWorkflowHooks, evaluateGeneratedRuntimeToolProposal, extractDeclaredToolResultChars, gameWorkflow, getDefaultPlanPath, getLikelySupportingCandidatePaths, interpolateWorkflowTemplate, isDiscoveryToolName, isMarathonArtifactPath, isPreservationSensitiveTask, isWorkflowHookRef, listWorkflowHooks, normalizeAgentDefinition, normalizeCandidatePath, normalizeProductDefinition, normalizeSkillDefinition, normalizeSurfaceDefinition, normalizeToolDefinition, parseFinalBuffer, parseLedgerArtifactRelativePath, parseOffloadedOutputId, parseSSEChunk, processStream, registerWorkflowHook, resolveStallStopAfter, resolveWorkflowHook, sanitizeTaskSlug, shouldInjectEmptySessionNudge, shouldRequestModelEscalation, streamEvents, unregisterWorkflowHook };