aimeat 2.1.0 → 2.2.0

package/dist/src/generated/api-types.d.ts

@@ -2516,18 +2516,81 @@ export interface paths {
         };
         /**
          * One EXCHANGE offering's full detail — I/O schema, call recipe, usage stats (public) (TARGET-045)
-         * @description Everything a human or agent needs to judge fit and integrate: the offering, the capability's `input_schema`/`output_schema`, a `call_recipe` (the contract IS the access — you call `POST /v1/ext/{ext}/{action}` as yourself, no separate API key), and usage `stats` (reputation). Public. Returns `{ offering, capability, call_recipe, stats }`.
+         * @description Everything a human or agent needs to judge fit and integrate: the offering, the capability's `input_schema`/`output_schema`, a `call_recipe` (the contract IS the access — you call `POST /v1/ext/{ext}/{action}` as yourself, no separate API key), and usage `stats` (reputation). Public. Returns `{ offering, capability, call_recipe, stats, pacing, odps }`. `pacing.toll_morsels` is the morsel BURN each call costs the consumer to bound consumption rate — not a price: nobody is credited it, and calling your own capability is free. `pacing.source` is `capability` when the provider declared it (`tollMorsels` on the tool/action/offer) and `node` when the node default applies. `odps` points at the same listing rendered as an Open Data Product Specification v4.1 document.
          */
         get: operations["exchangeOfferingDetail"];
         put?: never;
         post?: never;
-        /** Delist one of your EXCHANGE offerings (TARGET-045) */
+        /**
+         * Delist one of your EXCHANGE offerings (TARGET-045)
+         * @description Delists a hand-authored listing. A PROJECTED listing (`auto: true`, TARGET-050) exists because its SOURCE says so — the app-tool manifest's `exchange` flag, the extension action's `commercial.exchange`, or the agent offer's `exchange` — so delisting it here would simply come back on the next reconcile: this returns 409 `SOURCE_MANAGED` and names the source to turn off instead. Pass `?force=1` to delist anyway (until the next reconcile). Delisting never affects a CONTRACT.
+         */
         delete: operations["exchangeDelistOffering"];
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
+    "/v1/exchange/offerings/{id}/odps": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One EXCHANGE offering as an Open Data Product Specification v4.1 document (public) (TARGET-045)
+         * @description The listing rendered in the Linux Foundation's **Open Data Product Specification** (ODPS) v4.1 — the interoperable descriptor an outside catalogue or a negotiating agent can read without knowing anything about AIMEAT. Derived on read from the offering (never stored in ODPS form), so it cannot drift from the listing it describes. Carries `product.details`, `dataAccess` (the metered REST call plus the MCP surface), `pricingPlans` (base price + every bundle/subscription plan), `license` (AIMEAT usage terms as ODPS rights + restrictions), `dataHolder`, `paymentGateways`, and — when the provider committed to them — `SLA` and `dataQuality`. AIMEAT-specific truth (metered coordinate, pinned interface + I/O schema, call recipe, provenance, projection source, OBSERVED usage) travels under `product.x-aimeat`, which keeps the document valid against the official ODPS schema. Returns `{ odps_version, odps }` in the AIMEAT envelope; `?format=yaml` serves the raw YAML instead.
+         */
+        get: operations["exchangeOfferingOdps"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/offerings/{id}/odps.yaml": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One EXCHANGE offering as an ODPS v4.1 YAML document (public) (TARGET-045)
+         * @description Same document as `GET /v1/exchange/offerings/{id}/odps`, served raw as `text/yaml` — the format the Open Data Product Specification leads with, so the URL can be handed straight to an ODPS-aware tool.
+         */
+        get: operations["exchangeOfferingOdpsYaml"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/reconcile": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reconcile your EXCHANGE listings against their sources (TARGET-050)
+         * @description The EXCHANGE listing is a PROJECTION of its source: an app-tool manifest entry with `exchange: true`, an extension action with `commercial.exchange: true`, or an agent offer with `exchange: true` (and visibility `public`). Writing any of those projects it automatically — this is the explicit handle. `dry_run` reports what WOULD change and writes nothing (not even an interface snapshot). `migrate` adopts hand-authored listings into the model: it flips the flag ON in their source and keeps their `offeringId`, so existing entitlements referencing `offering:{id}` keep resolving; a listing whose source is gone is reported as an orphan and left untouched. Scope a run with `app_id`/`ext`/`agent`. Idempotent. A CONTRACT is never touched — entitlements keep the interface version and the price they were signed at. Returns `{ owner, dryRun, changes[], created, updated, adopted, delisted, unchanged, skipped }` (+ `orphans`, `flagged` when migrating); each change carries `action`, `offeringId`, `kind`, `label`, `unit`, `currency` and, for a skip, the `reason` (SCHEMA_REQUIRED, NOT_PRICED, TOOL_UNBOUND, NOT_PUBLIC, INVALID_TOOL_MANIFEST, INVALID_OFFERS_DOC).
+         */
+        post: operations["exchangeReconcileOfferings"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/exchange/offerings/{id}/consumers": {
         parameters: {
             query?: never;
@@ -3322,6 +3385,8 @@ export interface paths {
         /**
          * Download file
          * @description Returns raw bytes by default (supports Range headers for partial downloads). With `mode=handle`, returns a JSON handle (resource_uri + presigned, TTL-limited download_url + metadata) instead of bytes — used by MCP clients so binary content never enters the model context. With `mode=inline`, returns small (<= 32 KB) text files inline as JSON; larger or non-text files are rejected with 413.
+         *
+         *     Scope: this route reads the CALLER's own namespace only — files are keyed by (owner, key), so a file owned by anyone else is absent here and answers 404. To read a file someone else owns (an owner's upload for one of their agents, a DM or task attachment, a group/workspace share) use `GET /v1/pub/{gaii}/{key}`, which runs the consent/visibility guard.
          */
         get: operations["downloadFile"];
         put?: never;
@@ -4514,6 +4579,50 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/commerce/payout": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Which payout rails can pay you, and what each needs (owner) (TARGET-042)
+         * @description The seller's settlement rails reported apart, because they are different things: **Stripe** moves real currency (EUR/USD) to a connected account through a provider that holds the funds, while **x402** settles a stablecoin on-chain straight to an address you control, non-custodially, with the node holding no key. Returns `{ x402: { enabled, network, testnet, configured, address, currencies, assets, note }, stripe: { configured, provider, currencies, note } }`. `currencies` and `assets` are READ FROM THE NODE'S NETWORK REGISTRY, so they list only what this node can really settle: `assets` carries `{ currency, symbol, address, decimals }` per settleable currency (USD → USDC, EUR → EURC on the Base networks). ONE payout address receives every asset. A money sale over x402 with no address fails with SELLER_NO_X402_ADDRESS — this is the read that tells you before it happens.
+         */
+        get: operations["commercePayoutStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/commerce/payout/x402": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set your stablecoin (x402) payout address (owner) (TARGET-042)
+         * @description Stores the EVM account address a stablecoin sale settles to. ONE address receives every settlement asset the node's network carries (USDC for a USD price, EURC for a EUR one), so there is no per-currency setting. MERGED into your payment-settings record: your Stripe credentials in the same record are untouched (and the reverse holds — setting Stripe no longer clears this). 400 INVALID_ADDRESS unless the value is `0x` + 40 hex characters. Responds `{ configured, address, network, currencies, enabled, checked }`, where `currencies` is what this node can actually settle to that address.
+         */
+        put: operations["commercePayoutX402Set"];
+        post?: never;
+        /**
+         * Remove your stablecoin (x402) payout address (owner) (TARGET-042)
+         * @description Clears only the payout address. Card and invoice settlement through your Stripe credentials is unaffected; stablecoin sales (USDC and EURC alike) fail until an address is set again.
+         */
+        delete: operations["commercePayoutX402Clear"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/commerce/checkout-sessions": {
         parameters: {
             query?: never;
@@ -6103,7 +6212,16 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        get?: never;
+        /**
+         * Read the app's unpublished draft (staging) content
+         * @description Returns the current draft slot for `{owner}/{filename}` — the base64 content plus its size,
+         *     mime type and manifest. Owner-only; the caller is resolved from the token, so a draft is
+         *     never readable by anyone else. This is the read side of the draft slot: an editing client
+         *     that reloads must be able to load the working copy BACK, otherwise it can only re-fetch the
+         *     LIVE bytes and would silently overwrite the draft on its next save. The `?preview=` URL is
+         *     not usable for this — on an app-origin node it redirects to the isolated (CORS-less) origin.
+         */
+        get: operations["getAppDraft"];
         /**
          * Save the app's unpublished draft (staging)
          * @description Upserts the single draft slot for `{owner}/{filename}` — the staging copy of the NEXT version.
@@ -6150,6 +6268,37 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/apps/{owner}/{filename}/frame-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a frame grant letting ONE origin embed this app
+         * @description Returns a `frame_url` usable as an `iframe` src. An app origin refuses framing by default
+         *     (`frame-ancestors 'self' <apex>`); a frame grant widens that by exactly the ONE origin named
+         *     in the token, and only for responses carrying it.
+         *
+         *     The grant is issued to the CALLING page's `Origin` header — never to an origin supplied in the
+         *     body, which would let a page request permission on someone else's behalf. Owner-only: a grant
+         *     to frame an app you do not own is a clickjacking primitive. A malformed, expired or
+         *     wrong-app grant simply leaves the strict policy in place, so framing fails closed.
+         *
+         *     Deliberately one origin per grant rather than a list of allowed origins on the app: a list
+         *     grows with how many apps the owner has, and past roughly seventy it overruns a typical reverse
+         *     proxy's header buffer and every app origin starts answering 502.
+         */
+        post: operations["mintAppFrameToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/apps/{owner}/{filename}/publish-draft": {
         parameters: {
             query?: never;
@@ -11172,14 +11321,23 @@ export interface paths {
         };
         /**
          * Download public file
-         * @description Download a file by owner GAII and key. Public files need no auth.
-         *     Non-public files apply the same consent/visibility rules as memory:
-         *     the caller must hold a matching consent grant or (for `visibility:'group'`)
-         *     be a member of the file's sharing group; `organism.{id}` grants resolve for
-         *     active organism members. Every read is written to the consent audit log.
-         *     An authenticated caller without access gets 403; anonymous/unauthenticated
-         *     callers get 404 (file existence is hidden on public URLs).
+         * @description Download a file by owner GAII and key. This is the ONE door for reading a file the caller
+         *     does not own — `GET /v1/storage/{key}` is namespaced to the caller and cannot reach it.
+         *     Public files need no auth. Non-public files apply the same consent/visibility rules as
+         *     memory: `visibility:'owner'` admits every agent and app of the SAME owner (this is how a
+         *     document an owner uploads reaches that owner's own agent — upload with `visibility: owner`,
+         *     then the agent reads it with its own token), `members` any authenticated node user,
+         *     `group`/`workspace` their members, and a private file only with a matching consent grant;
+         *     `organism.{id}` grants resolve for active organism members. Denied reads are written to the
+         *     consent audit log. An authenticated caller without access gets 403; anonymous/
+         *     unauthenticated callers get 404 (file existence is hidden on public URLs).
          *     Supports wildcard keys with path separators.
+         *
+         *     With `mode=handle` the response is a presigned, TTL-limited `download_url` plus metadata
+         *     instead of the bytes, so an agent or liaison can hand the URL to a fetch or a document
+         *     parser without pulling binary through a tool result. The access decision is identical. A
+         *     handle for someone else's file expires sooner (15 min) than one for your own (1 h), so it
+         *     cannot long outlive a revoked grant.
          */
         get: operations["getPublicFile"];
         put?: never;
@@ -17595,6 +17753,12 @@ export interface components {
             flagCount: number;
             /** @description GAII of the entry owner (included in public reads via /v1/memory/{gaii}/{key}) */
             owner_gaii?: string;
+            /**
+             * @description Owner-scope listings only. Other same-owner identities holding this SAME key. Memory is
+             *     keyed by the writer, and an owner-scope read resolves GHII-first, so those copies are
+             *     absent from the response — this names them instead of letting the collision be invisible.
+             */
+            also_under?: string[];
             /** @description Data Decision Context — structured metadata for agent decision-making */
             _ddc?: {
                 flagCount?: number;
@@ -18971,6 +19135,31 @@ export interface components {
          * @enum {string}
          */
         TaskStatus: "draft" | "queued" | "revision_requested" | "active" | "paused" | "done" | "failed" | "stalled";
+        /** @description One file handed to the agent WITH the task. Only a REFERENCE is stored, never the bytes. On create, `ref` (and optionally `name`) is supplied; the server verifies the file exists and that the CREATOR can read it, then fills `mime` and `size` from the stored file. On read, the entry is authorized again as the READING principal and carries `access` plus a presigned `download_url` when granted — so a revoked grant stops handing out URLs on the next read. */
+        AgentTaskFileRef: {
+            /**
+             * @description "<ownerGaii>/<storage key>" (a bare key means the caller's own storage).
+             * @example alice@aimeat-fi-001-genesis/invoices/2026-07.pdf
+             */
+            ref: string;
+            name?: string;
+            readonly mime?: string;
+            readonly size?: number;
+            /** @enum {string} */
+            readonly access?: "granted" | "denied" | "missing";
+            /** @description Why a non-granted read was refused (e.g. consent_denied, not_found). */
+            readonly reason?: string;
+            /** @description Presigned, TTL-limited GET. Present only when access is granted. */
+            readonly download_url?: string;
+            readonly expires_in_seconds?: number;
+        };
+        /** @description What the agent needs in order to do the task — knowledge, memory, and files. */
+        AgentTaskResources: {
+            knowledge_packages?: string[];
+            memory_keys?: string[];
+            memory_prefixes?: string[];
+            files?: components["schemas"]["AgentTaskFileRef"][];
+        };
         AgentTask: {
             /** Format: uuid */
             id: string;
@@ -18988,6 +19177,7 @@ export interface components {
             createdAt: string;
             /** Format: date-time */
             updatedAt: string;
+            resources?: components["schemas"]["AgentTaskResources"];
             /** @description Memory key (agent namespace) where the task's deliverable was published, if any. */
             deliverableKey?: string;
             rating?: components["schemas"]["AgentTaskRating"];
@@ -24154,7 +24344,18 @@ export interface operations {
                     plans?: Record<string, never>[];
                     title?: string;
                     description?: string;
-                    provenance?: Record<string, never>;
+                    /** @description Provider attestation, validated (400 INVALID_PROVENANCE): { source, legalBasis, consentStatus, retention, transformations, snapshotHash (SHA-256), lineage[{source,transform,at}] }. The node stamps odpsVersion. */
+                    provenance?: {
+                        source?: string;
+                        legalBasis?: string;
+                        consentStatus?: string;
+                        retention?: string;
+                        transformations?: string;
+                        snapshotHash?: string;
+                        lineage?: Record<string, never>[];
+                    };
+                    /** @description ODPS v4.1 fields the node cannot derive, validated (400 INVALID_ODPS): productType, valueProposition, categories, standards, useCases, contentSample, logoURL, sla[{dimension,objective,unit}], dataQuality[{dimension,objective,unit}], dataHolder{legalName,…}, license{geographicalArea,applicableLaws,exclusive,…}. Surfaced at GET /v1/exchange/offerings/{id}/odps.yaml. */
+                    odps?: Record<string, never>;
                     tags?: string[];
                     usage_terms: {
                         derivatives?: boolean;
@@ -24189,7 +24390,10 @@ export interface operations {
     };
     exchangeDelistOffering: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Delist a source-managed listing anyway (it returns on the next reconcile). */
+                force?: "1";
+            };
             header?: never;
             path: {
                 id: string;
@@ -24200,6 +24404,79 @@ export interface operations {
         responses: {
             200: components["responses"]["AimeatSuccess"];
             404: components["responses"]["AimeatError"];
+            409: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeOfferingOdps: {
+        parameters: {
+            query?: {
+                /** @description Serve the raw ODPS YAML document instead of the JSON envelope. */
+                format?: "yaml";
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeOfferingOdpsYaml: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The ODPS v4.1 document. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/yaml": string;
+                };
+            };
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeReconcileOfferings: {
+        parameters: {
+            query?: {
+                dry_run?: "1";
+                migrate?: "1";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Report only; write nothing. */
+                    dry_run?: boolean;
+                    /** @description Adopt hand-authored listings (flag their source, keep the offeringId). */
+                    migrate?: boolean;
+                    /** @description Reconcile only this app's tool manifest. */
+                    app_id?: string;
+                    /** @description Reconcile only this extension's actions. */
+                    ext?: string;
+                    /** @description Reconcile only this agent's offers. */
+                    agent?: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
         };
     };
     exchangeOfferingConsumers: {
@@ -26965,6 +27242,53 @@ export interface operations {
             200: components["responses"]["AimeatSuccess"];
         };
     };
+    commercePayoutStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
+    commercePayoutX402Set: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description EVM account address: 0x followed by 40 hex characters. */
+                    address: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
+    commercePayoutX402Clear: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
     listCheckoutSessions: {
         parameters: {
             query?: {
@@ -29653,6 +29977,48 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    getAppDraft: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The draft content */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            filename?: string;
+                            /** @description base64-encoded draft HTML */
+                            content?: string;
+                            mime_type?: string;
+                            size?: number;
+                            /** Format: date-time */
+                            updated_at?: string;
+                            manifest?: Record<string, never>;
+                        };
+                    };
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description No draft exists for this app */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     saveAppDraft: {
         parameters: {
             query?: never;
@@ -29789,6 +30155,62 @@ export interface operations {
             };
         };
     };
+    mintAppFrameToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Frame grant minted */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            /** @description Use as an iframe src */
+                            frame_url?: string;
+                            /** @description The app's own origin */
+                            app_origin_url?: string;
+                            /** @description The one origin this grant names */
+                            granted_to?: string;
+                            expires_in_seconds?: number;
+                            note?: string;
+                        };
+                    };
+                };
+            };
+            /** @description The request carried no usable Origin header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description No such app owned by the caller */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description App origins are disabled on this node */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     publishAppDraft: {
         parameters: {
             query?: never;
@@ -36772,12 +37194,27 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description YAML manifest defining the extension metadata, actions, and limits */
-                    manifest: string;
+                    /**
+                     * @description Presigned mode: omit `manifest`/`scripts` and receive an `upload_url`; PUT a ZIP
+                     *     (manifest.yaml at root, scripts in scripts/) to it. Lets the mint and the upload
+                     *     happen in one command so the upload token is never transcribed.
+                     * @enum {string}
+                     */
+                    mode?: "presigned";
+                    /** @description YAML manifest defining the extension metadata, actions, and limits (required unless mode=presigned) */
+                    manifest?: string;
                     /** @description Key-value map of script filenames to JavaScript source code */
-                    scripts: {
+                    scripts?: {
                         [key: string]: string;
                     };
+                    /**
+                     * @description Presigned only. Upsert an already-installed extension instead of 409. Activation
+                     *     status, lifecycle stamps and the ext:{name} memory are preserved. Carried in the
+                     *     upload token meta.
+                     */
+                    update?: boolean;
+                    /** @description Presigned only. Activate immediately after install/update. */
+                    activate?: boolean;
                 };
             };
         };
@@ -38646,10 +39083,13 @@ export interface operations {
     };
     getPublicFile: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Omit for raw bytes; `handle` returns a presigned download_url + metadata. */
+                mode?: "handle";
+            };
             header?: never;
             path: {
-                /** @description URL-encoded agent GAII */
+                /** @description URL-encoded owner GHII / agent GAII that owns the file */
                 gaii: string;
                 /** @description File key (may contain path separators) */
                 key: string;
@@ -38658,12 +39098,30 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description File content with appropriate Content-Type */
+            /** @description File bytes, or a JSON handle when `mode=handle` */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/octet-stream": string;
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            ref?: string;
+                            owner_gaii?: string;
+                            key?: string;
+                            /** @enum {string} */
+                            mode?: "handle";
+                            mime_type?: string;
+                            size?: number;
+                            visibility?: string;
+                            download_url?: string;
+                            /** @enum {string} */
+                            download_method?: "GET";
+                            expires_in_seconds?: number;
+                        };
+                    };
+                };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
@@ -41345,6 +41803,7 @@ export interface operations {
                         /** @default false */
                         done?: boolean;
                     }[];
+                    resources?: components["schemas"]["AgentTaskResources"];
                 };
             };
         };