@vinaverse/server 0.1.0-alpha.21 → 0.1.0-alpha.22

package/dist/{vinaverse-v1.d-D-NPpZqW.d.cts → vinaverse-v1.d-C3ZVGBVA.d.cts}

@@ -87,7 +87,7 @@ interface paths {
          * @description v1-draft.21 (VIN-246): the conversations a history screen lists, for one subject and one agent, on one side of the app (`experience_mode`, and for a business `business_scope_id`, as the conversation was bound when it started). Newest activity first; ties by `id`.
          *     **Access.** A service key only, never a client secret: the app asks the tenant's backend, which checks the person and calls this. The key needs `conversations:read` (a key without scopes has every scope) and sees its own tenant and environment only.
          *     **What is listed.** Only what the tenant's `transcript_retention` still keeps: a conversation past it, a deleted one (`deleteConversation`) or an erased subject's is never listed, nor one where nothing was said (a session opened and left). A subject Vinaverse holds nothing for gets an empty page, the same as one with no conversations, so the answer never says whether a subject exists.
-         *     **The title** is deterministic and never the person's words: from the conversation's last search intent (`title_source: intent`, for example "Haircut · Los Angeles", in the subject's locale), else the date it started (`title_source: date`). There is no preview of the messages.
+         *     **The title** is deterministic and never the person's words, nor ever a date (v1-draft.45): the anchored object's title, else the professional or space it engaged with most, a registered task ("Business setup"), the last search's service and place ("Haircut · Los Angeles"), the label of the tenant's starter that opened it, else the side of the app it belongs to ("Home conversation"), in the subject's locale, with `title_source` saying which. There is no preview of the messages.
          *     **Paging.** `next_cursor` is opaque and signed. It is bound to the filters, the key's tenant and environment, and expires after 24 hours: a cursor changed, used with other filters or expired is `400 invalid_request` at `/cursor`, and the caller starts again without it. An outage is `503 unavailable` (retryable), never an empty page: the app does not take it as "no conversations".
          */
         get: operations["listConversations"];
@@ -497,7 +497,7 @@ interface paths {
         put?: never;
         /**
          * @description Erases the subject's data: transcripts, screening texts, memory (v1-draft.27: the preferences and the last search; a choice not to be remembered is kept, as a keyed hash of the subject id only), indexes, the conversation state of its guided flows (recorded answers, remarks, transcript), and the explore suggestion decisions made for it, and revokes its open sessions. `subject.erased` follows.
-         *     Backups are not edited (v1-draft.39): the erasure is re-applied after every restore of Vinaverse's database, so a backup never brings it back, and backups expire within 35 days.
+         *     Backups are not edited (v1-draft.39): the erasure is re-applied after every restore of Vinaverse's database, so a backup never brings it back, and backups expire within 35 days. `status: completed` means the live copies are gone; `backups_clear_by`, when present (v1-draft.48), is the day no backup holds them any more.
          *     **A subject Vinaverse holds nothing for** (never seen, or already erased) is `404` with `code: not_found` and `type: https://docs.vinaverse.com/problems/subject-not-found`; a client matches on the `type` ending in `/problems/subject-not-found`. Only that answer means nothing is held, and nothing needs erasing. Vinaverse keeps no record of erased subjects to tell the two apart. Any other `404` (a wrong base URL, say) is not that answer, and the caller retries.
          */
         post: operations["eraseSubject"];
@@ -524,13 +524,20 @@ interface paths {
          *       health fact or a never-store detail (v1-draft.39); a fact about someone else is the person's own note.
          *     - `last_search`: the last open search intent (a service and a place, as the search resolved them, never the
          *       person's words), for at most 7 days, which the agent may offer as a question.
+         *     - `items` (v1-draft.48): every kept thing as one `MemoryItem`, of any type, newest first (`updated_at`); the
+         *       app groups them by `type` and draws each label from `type` and `source` in its own language. `preferences`
+         *       and `last_search` are the same `told` and `search` items in their earlier shape.
+         *     - `off_types` (v1-draft.48): the types the person turned off; none of those is kept. - `deletions` (v1-draft.48): the newest 50 deletions the person asked for, each until every backup is clear
+         *       of it; `deletions_total` counts them all.
          *
+         *     **Paging** (v1-draft.48). A page holds up to 60 items, newest first; `next_cursor`, opaque, asks for the next page with `cursor`, and is null on the last. With a cursor, only `items` and `next_cursor` change; every other field is the same as on the first page. A cursor from another subject, side or business is `400` at `/cursor`.
          *     Preferences and the last search belong to one side of the app: `experience_mode` (left out, `customer`) and, for a business, `business_scope_id`. A subject Vinaverse holds nothing for reads as remembered, with nothing kept. Erasing the subject (`eraseSubject`) removes preferences and the last search; a choice not to be remembered outlives it, kept as a keyed hash of the subject id only.
          */
         get: operations["getSubjectMemory"];
         /**
          * Let the agent remember a person, or not
          * @description v1-draft.27 (VIN-223): the person's choice, through the tenant's backend (a service key with `memory:write`). `remembered: false` is "don't remember me": on both sides of the app at once, it deletes the preferences and the last search, and from then on no session reads or writes memory for the person and no earlier conversation is mentioned to the agent. It outlives an erasure. `remembered: true` turns memory back on, with nothing restored. Idempotent: the same choice again changes nothing.
+         *     `off_types` (v1-draft.48) turns single types off ("Don't learn from me": `learned`; "No summaries": `episode`; `search`): turning a type off deletes everything that type holds, at once, with a deletion status per item, and nothing of it is kept until it is turned back on; a type left out of the list is on. Left out of the body, the types stay as they were. `remembered: false` turns every type off, whatever the list.
          */
         put: operations["putSubjectMemory"];
         post?: never;
@@ -572,14 +579,64 @@ interface paths {
         post?: never;
         /**
          * Forget one thing the person asked the agent to remember
-         * @description v1-draft.27 (VIN-223): a service key with `memory:write`. The preference is deleted everywhere; the agent no longer reads it from the next turn. Another subject's, an unknown or an already deleted preference is the same `404 not_found`.
+         * @description v1-draft.27 (VIN-223): a service key with `memory:write`. The preference is deleted everywhere; the agent no longer reads it from the next turn. Another subject's, an unknown or an already deleted preference is the same `404 not_found`. A forget is final: it is erased at once and never restored, not even from a backup; an app's Undo is a short delay before the call is sent, never a second call. The same as `forgetMemoryItem` on a `told` item (v1-draft.48).
          */
         delete: operations["deleteMemoryPreference"];
         options?: never;
         head?: never;
+        /**
+         * Correct one thing the person asked the agent to remember
+         * @description v1-draft.48 (VIN-223): a service key with `memory:write`. The person's corrected words replace the preference from the next turn; the earlier words stay in Vinaverse's history of the record and are never shown to the agent again. `revision` is the one the app showed: any other is `409 revision_conflict` with `current_revision`, so the app shows the current words first.
+         *     A correction is refused, and nothing changes, as `400 invalid_request` at `/text` when the words are empty, longer than 200 characters, a health fact or a never-store detail (v1-draft.39), and as `403 feature_unavailable` when memory is not in use for the person (they turned it off, or have not acknowledged the current notice). Another subject's, an unknown or a deleted preference is `404 not_found`. A busy or unreachable store is `503`, to retry. No error carries the preference's words. The same as `correctMemoryItem` on a `told` item, which also corrects a `learned` one.
+         */
+        patch: operations["correctMemoryPreference"];
+        trace?: never;
+    };
+    "/v1/subjects/{subject_id}/memory/searches/{search_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Forget the person's kept search
+         * @description v1-draft.48 (VIN-223): a service key with `memory:write`. The kept search is deleted; the agent no longer offers it from the next turn. Another subject's, an unknown or an already deleted search is the same `404 not_found`. A forget is final: it is erased at once and never restored, not even from a backup; an app's Undo is a short delay before the call is sent, never a second call. The same as `forgetMemoryItem` on a `search` item.
+         */
+        delete: operations["deleteMemorySearch"];
+        options?: never;
+        head?: never;
         patch?: never;
         trace?: never;
     };
+    "/v1/subjects/{subject_id}/memory/items/{memory_item_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Forget one remembered item
+         * @description v1-draft.48 (VIN-223): a service key with `memory:write`. The item, of any type but `profile`, is deleted everywhere; the agent no longer uses it from the next turn, and it is listed in `SubjectMemory.deletions` until `backups_clear_by`. A forgotten `learned` item is never learned again. Forgetting a `business_fact` stops memory using it; the booking itself is the business's and is not deleted. A forget is final: it is erased at once and never restored, not even from a backup; an app's Undo is a short delay before the call is sent, never a second call. A `profile` item is disconnected in the profile, not forgotten here; it, another subject's, an unknown or an already deleted item is the same `404 not_found`.
+         */
+        delete: operations["forgetMemoryItem"];
+        options?: never;
+        head?: never;
+        /**
+         * Correct one remembered item in the person's own words
+         * @description v1-draft.48 (VIN-223): a service key with `memory:write`. Only an item with `editable: true` is corrected: a `told` item, or a `learned` one, which becomes a `told` item in the person's words. The words replace the item from the next turn; the earlier words stay in Vinaverse's history of the record and are never shown to the agent again. `revision` is the one the app showed: any other is `409 revision_conflict` with `current_revision`, so the app shows the current words first. Correcting a `learned` item while 20 `told` items are kept is `409 memory_limit_reached` ("Twenty things are kept already; forget one first."): the person forgets one, then corrects again.
+         *     A correction is refused, and nothing changes, as `400 invalid_request` at `/text` when the words are empty, longer than 200 characters, a health fact or a never-store detail (an id, a card or bank number, a password, a criminal or immigration detail), and as `403 feature_unavailable` when memory is not in use for the person (they turned it off, or have not acknowledged the current notice). An item that is not editable (a search, an episode, a business fact, setup progress, a profile item), another subject's, an unknown or a deleted one is the same `404 not_found`. A busy or unreachable store is `503`, to retry. No error carries the item's words.
+         */
+        patch: operations["correctMemoryItem"];
+        trace?: never;
+    };
     "/v1/events": {
         parameters: {
             query?: never;
@@ -1413,11 +1470,11 @@ interface components {
             title: string;
             status: number;
             /** @enum {string} */
-            code: "invalid_request" | "unauthenticated" | "forbidden" | "feature_unavailable" | "not_found" | "idempotency_conflict" | "session_closed" | "payload_too_large" | "unprocessable_media" | "rate_limited" | "internal" | "unavailable" | "conversation_mismatch" | "conversation_expired" | "conversation_completed" | "context_stale";
+            code: "invalid_request" | "unauthenticated" | "forbidden" | "feature_unavailable" | "not_found" | "idempotency_conflict" | "session_closed" | "payload_too_large" | "unprocessable_media" | "rate_limited" | "internal" | "unavailable" | "conversation_mismatch" | "conversation_expired" | "conversation_completed" | "context_stale" | "revision_conflict" | "memory_limit_reached";
             detail?: string;
             request_id: string;
             retryable: boolean;
-            /** @description v1-draft.23, with `context_stale` only, the session's screen-context revision now */
+            /** @description v1-draft.23, with `context_stale`: the session's screen-context revision now; v1-draft.48, with `revision_conflict`: the memory preference's revision now */
             current_revision?: number;
             /** @description field-level problems for invalid_request */
             errors?: {
@@ -1461,7 +1518,7 @@ interface components {
         /** @enum {string} */
         Feature: "assistant" | "moderation_image" | "moderation_video" | "moderation_text" | "screening" | "document_check" | "insights" | "suggestions";
         /**
-         * @description `quotes`: grants pricing a cart before booking it (`tool-provider-v1.yaml` `get_quote`), read only; never granted to a `guest` (v1-draft.31). `business_setup`: grants the business's own read tools and its `propose` tools (`tool-provider-v1.yaml`, `x-effect: propose`), for the `business_setup` agent; never a write tool. Only a subject of type `professional`, `host` or `staff` may be granted it. `booking_proposals`: grants the tenant's `propose` tools for a client's bookings (a booking, a reschedule, a cancellation the client confirms in the tenant's app), for the customer agent; never a write tool. Only a subject of type `client` may be granted it (`docs/agents-guardrails-suggestions-writes.md` §3.4). These two are the only capabilities that carry `propose` tools: `create_proposal` and every tenant `propose` tool require one of them. `flows`: grants the guided-flow endpoints (`tool-provider-v1.yaml`, `/flows/*`). It names no flow and no record: the tenant limits the `tool_access` token itself to one flow and one record. `my_orders`: grants reading the customer's own kits and orders from a styling-kit retailer (`tool-provider-v1.yaml`, `list_my_kits`, `get_my_kit`, `list_my_orders`, `get_my_order`), read only. Like `my_bookings`, it is meant for a signed-in `client`, and the tenant answers for the token's customer only. `business_bookings`: grants reading the business's own bookings, those waiting for its answer and those coming up, read only. `payouts`: grants reading the state of the business's own payout account (not set up, under review, active), read only, never an amount or a bank detail. Only a subject of type `professional`, `host` or `staff` may be granted either (v1-draft.38).
+         * @description `quotes`: grants pricing a cart before booking it (`tool-provider-v1.yaml` `get_quote`), read only; never granted to a `guest` (v1-draft.31). `business_setup`: grants the business's own read tools and its `propose` tools (`tool-provider-v1.yaml`, `x-effect: propose`), for the `business_setup` agent; never a write tool. Only a subject of type `professional`, `host` or `staff` may be granted it. `booking_proposals`: grants the tenant's `propose` tools for a client's bookings (a booking, a reschedule, a cancellation the client confirms in the tenant's app), for the customer agent; never a write tool. Only a subject of type `client` may be granted it (`docs/agents-guardrails-suggestions-writes.md` §3.4). These two are the only capabilities that carry `propose` tools: `create_proposal` and every tenant `propose` tool require one of them. `flows`: grants the guided-flow endpoints (`tool-provider-v1.yaml`, `/flows/*`). It names no flow and no record: the tenant limits the `tool_access` token itself to one flow and one record. `my_orders`: grants reading the customer's own kits and orders from a styling-kit retailer (`tool-provider-v1.yaml`, `list_my_kits`, `get_my_kit`, `list_my_orders`, `get_my_order`), read only. Like `my_bookings`, it is meant for a signed-in `client`, and the tenant answers for the token's customer only. `business_bookings`: grants reading the business's own bookings, those waiting for its answer and those coming up, read only. `payouts`: grants reading the state of the business's own payout account (tool-provider-v1 `PayoutAccount`: its state, what is missing, and what it earned that waits to be paid out), read only, never a bank or card detail or any other amount (v1-draft.43). Only a subject of type `professional`, `host` or `staff` may be granted either (v1-draft.38).
          * @enum {string}
          */
         Capability: "search" | "availability" | "quotes" | "my_bookings" | "policies" | "handoff" | "flows" | "business_setup" | "booking_proposals" | "my_orders" | "business_bookings" | "payouts";
@@ -1691,6 +1748,15 @@ interface components {
                 value: string;
             }[];
             deep_link?: string;
+            /** @description v1-draft.42, the object's photo as its screen shows it; the anchor card's `image` */
+            image?: components["schemas"]["CardImage"];
+            /** @description v1-draft.42, the object's state in the tenant's words with its tone; the anchor card's `status` */
+            status?: {
+                /** @description in Unicode code points */
+                label: string;
+                /** @enum {string} */
+                tone: "neutral" | "info" | "success" | "warning" | "danger";
+            };
         };
         /** @description v1-draft.37, one thing the person may do (`action`: a hand-off to the tenant's own screen, `open_action`) or ask (`explain`: answered from the manifest's template, filled from the anchor's facts). Eligibility comes only from here. An ineligible intent carries `reason`, a code; the words a person reads come from the templates. */
         AnchorIntent: {
@@ -1928,6 +1994,69 @@ interface components {
                 cancelled: boolean;
             }[];
         };
+        /** @description v1-draft.42, a `quote` card's facts: the lines the tenant's checkout will show, in its order, from its quote read (tool-provider `Quote`), byte for byte. The model never adds them up, and neither does a client: `total`, `due_now` and `due_later` are drawn only as given, and a client that cannot draw a line draws the card's `fallback` rather than a total without its lines. A `discount` line's `amount` is what comes off, never negative. */
+        QuoteFacts: {
+            /** @description the tenant's quote, carried by the checkout hand-off */
+            quote_id: string;
+            lines: {
+                /** @description the checkout's own words: "Service", "Booking fee" */
+                label: string;
+                amount: components["schemas"]["Money"];
+                /** @enum {string} */
+                kind?: "price" | "option" | "fee" | "tax" | "deposit" | "discount";
+            }[];
+            total: components["schemas"]["Money"];
+            due_now?: components["schemas"]["Money"];
+            due_later?: components["schemas"]["Money"];
+            /** @enum {string} */
+            fee_paid_by?: "customer" | "professional";
+            /**
+             * Format: date-time
+             * @description when the quoted price stops holding (`Quote.expires_at`)
+             */
+            valid_until?: string;
+            /** @description the zone the times are stated in */
+            zone?: string;
+            appointment?: {
+                /** Format: date-time */
+                start: string;
+                /** Format: date-time */
+                end: string;
+            };
+            /** @description what cancelling costs, as the quote read states it */
+            cancellation?: {
+                /** Format: date-time */
+                free_until?: string;
+                fee_after?: components["schemas"]["Money"];
+            };
+        };
+        /** @description v1-draft.42, a `time_slots` card's facts: what the open times are for, drawn above them. `zone` is the zone the slots are stated in, named once on the card. Selecting a slot prepares the tenant's checkout; it never books. */
+        TimeSlotsFacts: {
+            zone?: string;
+            service?: {
+                id?: string;
+                name: string;
+                duration_minutes?: number;
+            };
+            /** @enum {string} */
+            place?: "at_professional" | "at_customer" | "other";
+            /**
+             * Format: date
+             * @description the tool searched up to this day and found no open time: only then does a client say "No openings until …". A card with no slots and no `none_until` says the times could not be checked.
+             */
+            none_until?: string;
+        };
+        /** @description v1-draft.42, a `policy` card's facts, from the tenant's `get_policy` (tool-provider `Policy`): the version that answered, so an answer about a past transaction can name the terms in force, and the page to read in full. */
+        PolicyFacts: {
+            version: string;
+            /**
+             * Format: date-time
+             * @description the version's date (`Policy.updated_at`)
+             */
+            effective_at?: string;
+            /** Format: uri */
+            url?: string;
+        };
         /** @description v1-draft.37, the anchor as the person and the app see it (`Session.anchor`, `session.ready.anchor`): its identity and state, and the verified `anchor` card the app swaps in for the provisional one it drew from its screen. If a fact the app showed differs, the verified card wins and the app redraws. The same card is the conversation's first timeline item. No `facts`: the card's display strings are what is shown. */
         SessionAnchorView: {
             type: components["schemas"]["AnchorType"];
@@ -1954,6 +2083,15 @@ interface components {
                 value: string;
             }[];
             deep_link?: string;
+            /** @description v1-draft.42, the object's photo, the same one the app's own screen shows (the professional's or space's hero, the booking's professional), so the verified card keeps the photo the provisional one drew. The gateway copies it from `SessionAnchor.display.image`; the model never writes an anchor card */
+            image?: components["schemas"]["CardImage"];
+            /** @description v1-draft.42, the object's state in the tenant's words with its colour family (`Card.status_tone`), so the verified card keeps the pill the provisional one drew; copied from `SessionAnchor.display.status`, never a state the gateway worked out */
+            status?: {
+                /** @description in Unicode code points */
+                label: string;
+                /** @enum {string} */
+                tone: "neutral" | "info" | "success" | "warning" | "danger";
+            };
         };
         /** @description v1-draft.37, an `open_action` card's body: a hand-off to the tenant's own flow for an eligible `action` intent. The app opens `route` with `params`; **opening a screen is never doing the action**. The app reports what happened with `action.result`, echoing `action_id`, and the gateway re-reads the anchor before the agent states the outcome. `action_id` is minted by the gateway, one per hand-off across its retries: the tenant's write keys on it, so a double tap or a network retry is one action. `terms_digest` is the hash of the terms the person was shown; the tenant's write refuses changed terms. A build without the `open_action` capability gets `fallback_link` (the object's screen) as a plain link instead. */
         OpenAction: {
@@ -1973,7 +2111,7 @@ interface components {
             /** @description the object's screen; passes the deep-link rule */
             fallback_link: string;
         };
-        /** @description v1-draft.37, optional on `createSession`: what the person's app build supports, and the starter chips it showed, as its backend relays them. `shown_intents` are the intent ids of the chips on screen when the chat opened: with the `intent` a tap sends on `input.text`, they tell which chips a person saw and which they tapped. Only the ids are kept. Capabilities: `anchor_card`: it draws an `anchor` card. `intents`: it draws chips from anchor intent ids and sends `intent` on `input.text`. `open_action`: it draws an `open_action` card and opens its route. `action_result`: it sends `action.result` after a hand-off. Open: an unknown value is ignored, never refused. The gateway leaves out what the build lacks: no `open_action` means the action's `fallback_link` as a plain `links` card, no `intents` means the chips come as text, and a build with none still gets the anchored greeting and answers. */
+        /** @description v1-draft.37, optional on `createSession`: what the person's app build supports, and the starter chips it showed, as its backend relays them. `shown_intents` are the intent ids of the chips on screen when the chat opened: with the `intent` a tap sends on `input.text`, they tell which chips a person saw and which they tapped. Only the ids are kept. Capabilities: `anchor_card`: it draws an `anchor` card. `intents`: it draws chips from anchor intent ids and sends `intent` on `input.text`. `open_action`: it draws an `open_action` card and opens its route. `action_result`: it sends `action.result` after a hand-off. `card_layouts` (v1-draft.42): it draws `CardGroup.layout` `strip`, `compare` and `map`. Open: an unknown value is ignored, never refused. The gateway leaves out what the build lacks: no `open_action` means the action's `fallback_link` as a plain `links` card, no `intents` means the chips come as text, and a build with none still gets the anchored greeting and answers. */
         SessionClient: {
             /**
              * @example [
@@ -2137,11 +2275,44 @@ interface components {
             width?: number;
             height?: number;
         };
-        /** @description v1-draft.20: the cards one turn draws together carry the same `id`. `layout` is a hint: `carousel` draws them in one horizontal row, `list` one under another. A client that does not know `group`, or a `layout` value, draws a list, as before. */
+        /**
+         * @description v1-draft.20: the cards one turn draws together carry the same `id`. `layout` is a hint: `carousel` draws them in one horizontal row, `list` one under another. A client that does not know `group`, or a `layout` value, draws a list, as before.
+         *     v1-draft.42 adds `strip` (the same as `carousel`, named for what it is: photos to browse by eye), `compare` (two cards of one kind side by side) and `map` (the cards' `area_point`s on the host's map, with the list under it), sent only to a client reporting `card_layouts`; any other gets `carousel` for `strip` and `list` for the others. `intent` says why the turn drew the group: `decide` (alternatives weighed on price, time or terms: a list) or `browse` (looks, spaces: a strip). Every card of a group repeats the same group fields; a client reads them from the first. `title` and `summary` draw a group as one titled card (a business's Today); `see_all` continues the same search on the tenant's own list; `constraints` are the search's applied choices, as chips; `partial` names what was not checked when one source failed, so a failed search is never shown as no results.
+         */
         CardGroup: {
             id: string;
             /** @enum {string} */
-            layout: "list" | "carousel";
+            layout: "list" | "carousel" | "strip" | "compare" | "map";
+            /** @enum {string} */
+            intent?: "decide" | "browse";
+            /** @description in Unicode code points */
+            title?: string;
+            /** @description in Unicode code points */
+            summary?: string;
+            /** @description the tenant's own list with the same search; the link passes the deep-link rule, or `see_all` is dropped */
+            see_all?: {
+                /** @description in Unicode code points */
+                label: string;
+                deep_link: string;
+                /** @description how many the search found, when the tenant knows */
+                total?: number;
+            };
+            constraints?: {
+                key: string;
+                label: string;
+                value: string;
+                editable?: boolean;
+            }[];
+            partial?: {
+                unchecked: string[];
+            };
+        };
+        /** @description v1-draft.42, what the kit draws, as a message row with at most one button, when the card's kind or version is beyond it, the card fails its validator, or its renderer throws. Never a field dump. */
+        CardFallback: {
+            /** @description in Unicode code points; plain text, masked like the card's own text */
+            text: string;
+            /** @description one of the tenant's own destinations, held to the same rules as a `links` card's links */
+            link?: components["schemas"]["CardLink"];
         };
         /** @description v1-draft.20, one link of a `links` card: one of the tenant's own destinations from its connector manifest (admin-v1 `Connector.help_links`), never a link the model wrote. */
         CardLink: {
@@ -2149,8 +2320,11 @@ interface components {
             label: string;
             /** @description an https page of the tenant's, or a deep link that passes the deep-link rule (`next_step`) */
             url: string;
-            /** @enum {string} */
-            purpose: "help" | "support" | "policy" | "contact" | "feedback";
+            /**
+             * @description what the page is for; `open` (v1-draft.42) is the object's own screen in the tenant's app, the link of a card's `fallback`. A client that does not know a purpose leaves that link out
+             * @enum {string}
+             */
+            purpose: "help" | "support" | "policy" | "contact" | "feedback" | "open";
         };
         /** @description v1-draft.20, on a `links` card: the tenant's scope policy, at the version in force, that kept the agent from answering, and why. v1-draft.37: `policy_id` and `version` are required for the scope reasons and may be absent for `help`, which no scope policy decides. */
         ScopeProvenance: {
@@ -2237,6 +2411,46 @@ interface components {
             /** @description policy excerpt, handoff text, or what a `next_step` is for */
             body?: string;
             badges?: string[];
+            /** @description v1-draft.42, the version of its kind's shape, one the build reads; absent means 1. A later draft that changes what a kind's fields mean raises it, and sends it only to a build that reports that version; any other build gets the earlier shape or the card's `fallback`. */
+            kind_version?: number;
+            fallback?: components["schemas"]["CardFallback"];
+            /**
+             * Format: date-time
+             * @description v1-draft.42, when the tenant read what the card shows: the source revision of every fact on it. A card in the transcript is a snapshot as of then, never rewritten; a client says how old it is ("Checked 2 h ago") rather than presenting it as current.
+             */
+            as_of?: string;
+            /**
+             * @description v1-draft.42. `complete`: every field the kind's projection allows is present. `partial`: some could not be read, and an absent field means "not known", never zero or "nothing". `unavailable`: the read failed; the card carries only its identity (`id`, `kind`, `ref`) and `title`, no `facts`, and a client names the object and says its details could not load. The same meanings as `SessionAnchor.completeness`. Absent: `complete`, as before.
+             * @enum {string}
+             */
+            completeness?: "complete" | "partial" | "unavailable";
+            /**
+             * @description v1-draft.42, the colour family of `status`, chosen by the tenant with its state word, so a client never works one out from the word. A client always draws the word with it, never the colour alone.
+             * @enum {string}
+             */
+            status_tone?: "neutral" | "info" | "success" | "warning" | "danger";
+            /** @description v1-draft.42, a placement the tenant was paid for; a client labels it, always */
+            sponsored?: boolean;
+            /** @description v1-draft.42, whether the person can take the card's main action now (renting a space, booking a class). Not eligible: `reason` says why, a code the tenant's copy words ("To rent a space, switch to Professional mode in Profile"), and `route` is where to fix it. A client shows the reason in place of the action, never a disabled button without one. Eligibility is the tenant's: the gateway never computes it. */
+            eligibility?: {
+                eligible: boolean;
+                /**
+                 * @example wrong_mode
+                 * @example not_verified
+                 * @example tour_first
+                 * @example dates_taken
+                 */
+                reason?: string;
+                /** @description a route the connector manifest declares (admin-v1 `Connector.actions.routes`), such as `profile_mode_switch` */
+                route?: string;
+            };
+            /** @description v1-draft.42, a `professional` or `workspace` card's area as one point, for a map preview (`group.layout: map`): the centre of the area, never the street. The gateway rounds both to two decimal places (about a kilometre) whatever the tenant sent. */
+            area_point?: {
+                lat: number;
+                lng: number;
+            };
+            /** @description v1-draft.42, the card's facts typed per kind, the same shapes an anchor carries for the same object (`BookingFacts`, `ProfessionalFacts`, `WorkspaceFacts`, `ServiceFacts`), plus `QuoteFacts`, `TimeSlotsFacts` and `PolicyFacts`; none on any other kind. Bound to the tool result the card's `source` names: every value is the tenant's, byte for byte, and a client draws them by the contract's rules only (money from `Money`, times in the `zone` given). It never adds amounts up. Absent means "can't be worked out", never zero. A service the tenant prices once, whatever the place, carries that price in `Card.price` and its places in `facts.offered_at`; `facts.prices` is only for a tenant with a price per place. */
+            facts?: Record<string, unknown>;
             actions: components["schemas"]["CardAction"][];
             source: {
                 tool: string;
@@ -2323,7 +2537,7 @@ interface components {
             snippet?: string;
             /** Format: date-time */
             updated_at?: string;
-        } & (unknown & unknown & unknown & unknown & unknown & unknown & unknown);
+        } & (unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown & unknown);
         /** @enum {string} */
         ValueUnit: "count" | "ppm" | "micros_usd" | "ms";
         MetricRef: {
@@ -2576,10 +2790,10 @@ interface components {
             business_scope_id?: components["schemas"]["BusinessScopeId"];
             title: string;
             /**
-             * @description `intent`: the last search intent (service and place); `date`: the day it started
+             * @description what the title came from, in this order (v1-draft.45): `anchor`, the anchored object's title; `object`, the professional or space it engaged with most; `task`, a registered task; `intent`, the last search's service and place; `starter`, the label of the tenant's starter that opened it; `context`, the side of the app it belongs to. `date` (the day it started) is no longer sent
              * @enum {string}
              */
-            title_source: "intent" | "date";
+            title_source: "anchor" | "object" | "task" | "intent" | "starter" | "context" | "date";
             /** Format: date-time */
             started_at: string;
             /** Format: date-time */
@@ -2591,9 +2805,11 @@ interface components {
              * @enum {string}
              */
             state: "open" | "ended";
-            /** @description v1-draft.37, what an anchored conversation is about: the anchor's type and its title as the person saw it (`SessionAnchor.title`), never message text. History groups conversations by it. */
+            /** @description v1-draft.37, what an anchored conversation is about: the anchor's type and its title as the person saw it (`SessionAnchor.title`), never message text. History groups conversations by it. v1-draft.44: and the object's `id` (`SessionAnchor.id`, the tenant's tool id, never a name), so a past conversation about an object is continued under that object's own key and two objects with the same title stay apart. */
             anchor?: {
                 kind: components["schemas"]["AnchorType"];
+                /** @description v1-draft.44, the anchored object's id as the tenant's tools name it (`SessionAnchor.id`) */
+                id?: string;
                 title: string;
             };
             /** @description v1-draft.37, a preview of the conversation's last message, at most 120 code points, cut at a word with an ellipsis, made from the message as the timeline stores it: after digit masking and redaction, never from a withheld sentence. Never a refused message (`refusal: true`), and absent under the tenant's `transcript_retention` `none`. */
@@ -2673,14 +2889,16 @@ interface components {
             /** Format: date-time */
             at: string;
         };
-        /** @description v1-draft.27: one thing the person asked the agent to remember ("remember that I prefer mornings"), in the words the agent said back to the person, never inferred. Never a health fact or a never-store detail; a fact about someone else ("my daughter prefers short hair") is the person's own note (v1-draft.39). */
+        /** @description v1-draft.27: one thing the person asked the agent to remember ("remember that I prefer mornings"), in the words the agent said back to the person, never inferred. Never a health fact or a never-store detail; a fact about someone else ("my daughter prefers short hair") is the person's own note (v1-draft.39). `revision` (v1-draft.48) goes up with each correction; a correction names the one the app showed. */
         MemoryPreference: {
             id: string;
             text: string;
             source: components["schemas"]["MemorySource"];
+            revision: number;
         };
-        /** @description v1-draft.27: the last open search intent, as the search resolved it (a catalogue service's name, a place's name), never the person's words; kept 7 days from `at`. */
+        /** @description v1-draft.27: the last open search intent, as the search resolved it (a catalogue service's name, a place's name), never the person's words; kept 7 days from `at`. Its `id` (v1-draft.48) is what `deleteMemorySearch` forgets. */
         LastSearch: {
+            id: string;
             service?: string;
             area?: string;
             /** Format: date-time */
@@ -2690,12 +2908,103 @@ interface components {
         SubjectMemoryChoice: {
             /** @description `false`: "don't remember me", on both sides of the app */
             remembered: boolean;
+            /** @description v1-draft.48, optional: the types the person turned off; turning a type off deletes what it holds. `remembered: false` turns every type off. */
+            off_types?: components["schemas"]["MemoryOffType"][];
         };
         SubjectMemory: {
             remembered: boolean;
             notice_acknowledged?: components["schemas"]["MemoryNoticeVersion"];
             preferences: components["schemas"]["MemoryPreference"][];
             last_search?: components["schemas"]["LastSearch"];
+            /** @description v1-draft.48, the newest 50 deletions the person asked for, each listed until `backups_clear_by` */
+            deletions?: components["schemas"]["MemoryDeletion"][];
+            /** @description v1-draft.48, the kept items of any type, newest first (`updated_at`), up to 60 a page */
+            items?: components["schemas"]["MemoryItem"][];
+            /** @description v1-draft.48, opaque; the next page of `items` (`getSubjectMemory` `cursor`); null on the last */
+            next_cursor?: string | null;
+            /** @description v1-draft.48, how many deletions are listed in all; `deletions` shows the newest 50 */
+            deletions_total?: number;
+            /** @description v1-draft.48, the types the person turned off */
+            off_types?: components["schemas"]["MemoryOffType"][];
+        };
+        /**
+         * @description v1-draft.48: `told`, what the person asked the agent to remember, in the words the agent said back (a fact about someone else is the person's own note); `search`, the last open search; `episode`, where a conversation left off, written by the agent; `learned`, a pattern noticed from what the person searched and booked across at least 3 conversations on at least 2 days, never health; `business_fact`, a fact the business's system holds about the person, kept as evidence; `setup`, a business owner's setup progress (Business mode); `profile`, a preference shared from the person's own Vinaverse profile under a grant. A client draws a type it does not know as a plain item.
+         * @enum {string}
+         */
+        MemoryItemType: "told" | "search" | "episode" | "learned" | "business_fact" | "setup" | "profile";
+        /**
+         * @description v1-draft.48, a type the person may turn off on its own
+         * @enum {string}
+         */
+        MemoryOffType: "learned" | "episode" | "search";
+        /** @description v1-draft.48: a memory item's id; the prefix names the family (`mpf` told and learned, `msr` search, `mep` episode and setup, `mbf` business fact, `mgr` profile) */
+        MemoryItemId: string;
+        /** @description v1-draft.48: one remembered thing, whatever its type. The app draws its label from `type` and `source` in its own language. Never a health fact or a never-store detail. */
+        MemoryItem: {
+            id: components["schemas"]["MemoryItemId"];
+            type: components["schemas"]["MemoryItemType"];
+            /** @description what the agent knows, in plain words */
+            text: string;
+            source: {
+                /** @enum {string} */
+                kind: "conversation" | "search" | "booking" | "pattern" | "profile";
+                /** @description the conversation it came from; null when there is none (a pattern, a profile) */
+                conversation_id: components["schemas"]["ConversationId"] | null;
+                /** Format: date-time */
+                at: string;
+            };
+            /** @description how a `learned` item was learned; null for every other type */
+            why: {
+                conversations: number;
+                /** Format: date-time */
+                first_at: string;
+                /** Format: date-time */
+                last_at: string;
+            } | null;
+            /** @description whether the person may correct the words (`told`, `learned`) */
+            editable: boolean;
+            /** @description a correction sends the revision the screen showed */
+            revision: number;
+            /**
+             * @description `customer`, the person's own; `business`, an owner's setup memory (Business mode only)
+             * @enum {string}
+             */
+            side: "customer" | "business";
+            /** Format: date-time */
+            kept_at: string;
+            /** Format: date-time */
+            updated_at: string;
+            /**
+             * Format: date-time
+             * @description when it goes by itself (a search, 7 days after it); otherwise null
+             */
+            expires_at: string | null;
+        };
+        /** @description v1-draft.48, the person's corrected words for one editable item, and the revision they saw; at most 200 characters, as a `told` item. */
+        MemoryItemCorrection: {
+            text: string;
+            revision: number;
+        };
+        /** @description v1-draft.48, a remembered item a reply's sentences mention, as `MemoryItem` names it */
+        MemoryUsed: {
+            id: components["schemas"]["MemoryItemId"];
+            type: components["schemas"]["MemoryItemType"];
+            text: string;
+        };
+        /** @description v1-draft.48, the person's corrected words for one kept preference, and the revision they saw. */
+        MemoryPreferenceCorrection: {
+            text: string;
+            revision: number;
+        };
+        /** @description v1-draft.48: one deletion the person asked for: removed at `requested_at` from everything Vinaverse serves, and gone from every backup by `backups_clear_by` (backups are never edited; the deletion is re-applied after any restore). Listed until `backups_clear_by`. A status never says "completed" alone while backups still hold it, and holds no text of what was deleted. The conversation where the item was said is not part of the deletion: it is kept until it expires (the tenant's `transcript_retention`, at most 30 days) or is deleted (`deleteConversation`). One deletion per forgotten item, named by the item's type (a preference forgotten through `deleteMemoryPreference` is `told`); a type turned off lists one per item it held. `all` is "don't remember me". A deletion never names the item it deleted: it has no item id, and never will. */
+        MemoryDeletion: {
+            id: string;
+            /** @enum {string} */
+            kind: "told" | "search" | "episode" | "learned" | "business_fact" | "setup" | "all";
+            /** Format: date-time */
+            requested_at: string;
+            /** Format: date-time */
+            backups_clear_by: string;
         };
         /** @description A time slot the person picked on a `time_slots` card (v1-draft.17, `docs/realtime-protocol.md` §6): the slot's `id`, and the `call_id` of the tool call the card came from (the card's `source.call_id`), so the runtime checks the pick against the evidence it holds for that call. Both are copied from the card; never built by the app. */
         SlotSelection: {
@@ -2964,6 +3273,8 @@ interface components {
             text: string;
             /** @description optional; spans of `text` with their source card or tool call */
             citations?: components["schemas"]["Citation"][];
+            /** @description v1-draft.48, optional: the remembered items the reply's sentences mention, and only those, so the app or the kit shows "Remembered: …" under the reply with Edit and Forget. Absent when none. */
+            memory_used?: components["schemas"]["MemoryUsed"][];
         } | {
             /** @constant */
             type: "handoff.created";
@@ -3471,8 +3782,10 @@ interface components {
          *     it in Studio. Every field is optional: a field absent is the kit's own default (the `standard` preset), so an
          *     app built before a field existed keeps working, except a field the gateway enforces (`edit`, `regenerate`,
          *     `versions`, `fork`, `pins` stored on the server, `summary`), which resolves off when absent. That is about the
-         *     resolved value; in a setting's `overrides` an absent field is the preset's value. A client ignores a field it
-         *     does not know.
+         *     resolved value; in a setting's `overrides` an absent field is the preset's value, except `cards.kinds` and
+         *     `handoff.routes`: absent, they keep the list an earlier save stored, and on a first save they are every kind
+         *     or route available then (admin-v1 `ChatExperienceView.available`), so no save that leaves them out ever
+         *     widens them. A client ignores a field it does not know.
          *
          *     **Resolved, not raw.** Inside a conversation the value is resolved: the tenant's preset with its changes
          *     (admin-v1 `ChatExperienceSetting`), narrowed by what this server serves (a feature it does not serve yet
@@ -3881,14 +4194,21 @@ interface components {
                 /** @description under consequential claims; default true */
                 line?: boolean;
             };
-            /** @description memory in the chat (spec J); off whenever the person or the tenant turned memory off */
+            /** @description memory in the chat (spec J); off whenever the person or the tenant turned memory off. `sheet` and `learned` (vinaverse-v1 v1-draft.48, admin-v1 v1-draft.33, VIN-223): the memory sheet ("What the agent remembers"), where the person sees, corrects and forgets what is kept, and its learned section. `page` is the same surface as `sheet` and is deprecated: it stays one draft as an alias, then goes. Migration: a setting that has `page` and no `sheet` resolves `sheet` to `page`'s value, so an old explicit `page: false` is `sheet: false`; the resolved value carries both, equal. Hiding any of these never deletes what is kept. */
             memory?: {
-                /** @description default true */
+                /** @description the "Remembered" chips under a reply that used memory; default true */
                 chips?: boolean;
-                /** @description "What the agent remembers"; default false */
+                /**
+                 * @deprecated
+                 * @description deprecated alias of `sheet` (v1-draft.48), kept one draft: set without `sheet`, it is `sheet`'s value; resolved, it equals `sheet`
+                 */
                 page?: boolean;
                 /** @description a conversation kept out of memory; default true */
                 per_conversation_off?: boolean;
+                /** @description the memory sheet, to see, correct and forget items; replaces `page`, and takes `page`'s value when a setting has only `page`; default true */
+                sheet?: boolean;
+                /** @description the sheet's learned section; default true */
+                learned?: boolean;
             };
             handoff?: {
                 /** @description absent in a setting: every route the tenant has when it is saved (stored as that list) */
@@ -4170,6 +4490,8 @@ interface components {
         /** @description v1-draft.24, optional: the business the caller acts for; when given, the conversation must be bound to it, else `404`. With `experience_mode: business` and no `business_scope_id`, a conversation bound to a business does not match. */
         BindingBusinessScope: components["schemas"]["BusinessScopeId"];
         SubjectIdPath: components["schemas"]["SubjectId"];
+        /** @description v1-draft.48, a `MemoryItem.id` */
+        MemoryItemIdPath: components["schemas"]["MemoryItemId"];
         IdempotencyKey: string;
         /** @description Accepted, not required (declared in v1-draft.22). Scoped to the tenant and environment: the same key and request within 24 hours answers the first success again (`Idempotent-Replayed: true`); the same key with another request is `409 idempotency_conflict`. */
         OptionalIdempotencyKey: string;
@@ -4930,6 +5252,11 @@ interface operations {
                         sessions_revoked: number;
                         /** Format: date-time */
                         deadline: string;
+                        /**
+                         * Format: date-time
+                         * @description v1-draft.48, optional: `completed` means the live copies are gone; backups are never edited, and no backup holds the erased data after this date (at most 35 days after the request).
+                         */
+                        backups_clear_by?: string;
                     };
                 };
             };
@@ -4955,6 +5282,8 @@ interface operations {
                 experience_mode?: components["schemas"]["ExperienceMode"];
                 /** @description the business the person acts for; only with `experience_mode=business` */
                 business_scope_id?: components["schemas"]["BusinessScopeId"];
+                /** @description v1-draft.48, optional; the `next_cursor` of the page before */
+                cursor?: string;
             };
             header?: never;
             path: {
@@ -5064,6 +5393,124 @@ interface operations {
             503: components["responses"]["Problem"];
         };
     };
+    correctMemoryPreference: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                subject_id: components["parameters"]["SubjectIdPath"];
+                preference_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MemoryPreferenceCorrection"];
+            };
+        };
+        responses: {
+            /** @description The preference as now kept, with its new `revision`. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MemoryPreference"];
+                };
+            };
+            400: components["responses"]["Problem"];
+            401: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            404: components["responses"]["Problem"];
+            409: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
+    deleteMemorySearch: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                subject_id: components["parameters"]["SubjectIdPath"];
+                search_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Forgotten. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            404: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
+    forgetMemoryItem: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                subject_id: components["parameters"]["SubjectIdPath"];
+                /** @description v1-draft.48, a `MemoryItem.id` */
+                memory_item_id: components["parameters"]["MemoryItemIdPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Forgotten. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            404: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
+    correctMemoryItem: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                subject_id: components["parameters"]["SubjectIdPath"];
+                /** @description v1-draft.48, a `MemoryItem.id` */
+                memory_item_id: components["parameters"]["MemoryItemIdPath"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MemoryItemCorrection"];
+            };
+        };
+        responses: {
+            /** @description The item as now kept, a `told` item with its new `revision`. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MemoryItem"];
+                };
+            };
+            400: components["responses"]["Problem"];
+            401: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            404: components["responses"]["Problem"];
+            409: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
     sendEvents: {
         parameters: {
             query?: never;