From 0ea327baece12653d35bc11c52482c077b676a93 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Thu, 8 Oct 2026 15:44:34 +0800
Subject: [PATCH 1/3] Generate the public client types from the schema (#549)

make openapi now projects the public schema onto
packages/agents-client/src/generated/public-api.ts: each schema's
TypeScript type, each enum's values and each object's field names, with
required lists and per-union field maps. make check-openapi rejects a
stale copy. The emitter takes a parsed schema dict and accepts the
Swagger 2.0 forms of the Core document (x-nullable, allOf, any ref
prefix), so the /core/v1 projection can reuse it.

The client aliases the generated types and validates responses with the
generated field sets and enums instead of hand-written copies. Where the
schema and the validators disagreed, the schema wins: snapshot events
carry no session_id, Item events require output_index, terminal Turn
events require usage, list envelopes are complete, input_image is
accepted in user messages, and older-Core allowances are gone. The
client no longer re-checks limits Core enforces.

Core now sends turn_id null on Environment events, null cwd, output,
exit_code and duration_ms on command_execution Items, and param null on
the stream interruption error, as the pinned schema requires.
---
 apps/web/e2e/data/agents.mjs                  |   26 +-
 apps/web/e2e/data/routes.mjs                  |    8 +-
 .../dashboard/runtime-history.test.ts         |    2 +-
 .../features/dashboard/runtime-trends.test.ts |    2 +-
 .../features/metrics/agent-metrics.test.ts    |    3 +-
 .../sessions/SessionTurnsTable.test.tsx       |    2 +-
 .../features/sessions/session-history.test.ts |    2 +-
 .../src/features/sessions/session-log.test.ts |    2 +-
 .../features/sessions/session-queries.test.ts |    2 +-
 .../sessions/trace/TraceView.test.tsx         |    3 +-
 .../sessions/trace/trace-model.test.ts        |    1 +
 .../web/src/lib/collection-pagination.test.ts |   51 +-
 contracts/agents-api/index.md                 |    2 +-
 contracts/agents-api/sessions-events.md       |    6 +-
 contracts/agents-api/v1/events.go             |   19 +-
 contracts/agents-api/v1/events_test.go        |    5 +-
 contracts/agents-api/v1/items_test.go         |    4 +
 contracts/agents-api/v1/subagent_items.go     |   13 +-
 contracts/agents-api/zh/index.md              |    4 +-
 contracts/agents-api/zh/sessions-events.md    |    8 +-
 example/parsar/src/lib/session-timing.ts      |    2 +-
 example/parsar/tests/fixture.mjs              |   18 +-
 packages/agents-client/README.md              |    5 +-
 .../agents-client/src/admin-client.test.ts    |    2 +-
 packages/agents-client/src/admin-client.ts    |    4 +-
 packages/agents-client/src/client.test.ts     |  123 +-
 packages/agents-client/src/client.ts          |  683 ++----
 .../src/environment-template-projection.ts    |   44 +-
 .../src/environment-templates.test.ts         |    4 +-
 .../src/execution-configuration-projection.ts |    4 +-
 .../agents-client/src/generated/public-api.ts | 1970 +++++++++++++++++
 .../agents-client/src/history-projection.ts   |  259 +--
 .../src/history-recovery.test.ts              |   88 +-
 packages/agents-client/src/index.ts           |    2 +-
 .../agents-client/src/protocol-types.test.ts  |    4 +-
 .../agents-client/src/response-projection.ts  |   31 +-
 .../src/session-environment-projection.ts     |   13 +-
 .../agents-client/src/skill-projection.ts     |   48 +-
 packages/agents-client/src/skills.test.ts     |   10 +-
 .../src/source-files-list.test.ts             |   11 +-
 packages/agents-client/src/types.ts           |  482 ++--
 .../agents-client/src/usage-projection.ts     |   13 +-
 .../src/vault-credential-auth.ts              |   28 +-
 scripts/generate-public-api.py                |   76 +-
 scripts/generate-public-api.test.py           |   23 +
 .../core/internal/api/hosted_failure_test.go  |    7 +-
 services/core/internal/api/stream.go          |   13 +-
 .../environment_connections_test.go           |    2 +-
 48 files changed, 2744 insertions(+), 1390 deletions(-)
 create mode 100644 packages/agents-client/src/generated/public-api.ts

diff --git a/apps/web/e2e/data/agents.mjs b/apps/web/e2e/data/agents.mjs
index db6b40bff..26f23e8b4 100644
--- a/apps/web/e2e/data/agents.mjs
+++ b/apps/web/e2e/data/agents.mjs
@@ -10,10 +10,12 @@ const mcp = (label, url, allowed = null, credential = null) => ({
   ...(credential ? { x_agents_core: { credential_id: credential } } : {}),
 });
 const str = (description) => ({ type: "string", description });
+/** Core reports both reasoning members, null when unset. */
+const reasoning = (effort = null, summary = null) => ({ effort, summary });
 
 export const agentDefinitions = [
   {
-    name: "Incident responder", model: "gpt-5.1-codex", harness: "codex", reasoning: { effort: "high", summary: "auto" },
+    name: "Incident responder", model: "gpt-5.1-codex", harness: "codex", reasoning: reasoning("high", "auto"),
     instructions: "You are the on-call assistant for the web platform.\n\nWhen an alert arrives:\n1. Read the alert and the linked dashboard.\n2. Check recent deploys and error logs for the affected service.\n3. Propose the smallest safe mitigation and wait for approval before acting.\n4. Write a short incident note: impact, timeline, cause, next steps.",
     tools: [
       fn("lookup_deploys", "List deploys of a service in a time window.", { service: str("Service name"), since: str("ISO-8601 start") }),
@@ -23,7 +25,7 @@ export const agentDefinitions = [
     metadata: { team: "sre", tier: "production", runbook: "RB-0142" },
   },
   {
-    name: "Support triage", model: "claude-sonnet-5", harness: "claude_sdk", reasoning: {},
+    name: "Support triage", model: "claude-sonnet-5", harness: "claude_sdk", reasoning: reasoning(),
     instructions: "Classify each incoming support ticket by product area and severity.\nAsk one clarifying question when the report lacks steps to reproduce.\nNever promise dates. Link the matching help-center article when one exists.",
     tools: [
       fn("search_help_center", "Search published help-center articles.", { query: str("Search text") }),
@@ -32,13 +34,13 @@ export const agentDefinitions = [
     metadata: { team: "support", queue: "tier-1" },
   },
   {
-    name: "Code reviewer", model: "gpt-5.1-codex", harness: "codex", reasoning: { effort: "medium" },
+    name: "Code reviewer", model: "gpt-5.1-codex", harness: "codex", reasoning: reasoning("medium"),
     instructions: "Review pull requests for correctness first, then clarity.\nComment only on issues that matter; group nits into one comment.\nFlag missing tests for changed behaviour.",
     tools: [mcp("github", "https://mcp.example.com/github", ["get_pull_request", "list_files", "create_review"])],
     metadata: { team: "platform", repo_scope: "monorepo" },
   },
   {
-    name: "Data analyst", model: "MiniMax-M2", harness: "mcode", reasoning: {},
+    name: "Data analyst", model: "MiniMax-M2", harness: "mcode", reasoning: reasoning(),
     instructions: "Answer questions about product metrics using the warehouse.\nShow the SQL you ran and state the time range and filters explicitly.\nIf data is missing, say so instead of estimating.",
     tools: [
       fn("run_sql", "Run a read-only SQL query against the analytics warehouse.", { sql: str("SELECT statement") }),
@@ -47,37 +49,37 @@ export const agentDefinitions = [
     metadata: { team: "data", warehouse: "analytics" },
   },
   {
-    name: "Contract checker", model: "gpt-5.1-mini", harness: "codex", reasoning: {},
+    name: "Contract checker", model: "gpt-5.1-mini", harness: "codex", reasoning: reasoning(),
     instructions: "Compare a supplier contract against the standard template.\nList every deviation with the clause number, the template wording and the contract wording.\nMark liability, termination and data-protection deviations as high priority.",
     tools: [fn("fetch_template", "Fetch the current standard contract template.", { kind: str("Contract type") })],
     metadata: { team: "legal" },
   },
   {
-    name: "Release notes writer", model: "claude-sonnet-5", harness: "claude_sdk", reasoning: {},
+    name: "Release notes writer", model: "claude-sonnet-5", harness: "claude_sdk", reasoning: reasoning(),
     instructions: "Draft release notes from merged pull requests since the last tag.\nGroup by user-visible change; leave out refactors and CI changes.",
     tools: [mcp("github", "https://mcp.example.com/github", ["list_merged_pull_requests", "get_release"])],
     metadata: { team: "platform", channel: "stable" },
   },
   {
-    name: "Onboarding guide", model: "gpt-5.1-mini", harness: "codex", reasoning: {},
+    name: "Onboarding guide", model: "gpt-5.1-mini", harness: "codex", reasoning: reasoning(),
     instructions: "Help new employees find internal documentation and set up their accounts.\nKeep answers short and link the source page.",
     tools: [mcp("docs", "https://mcp.internal.example/docs", null)],
     metadata: { team: "people-ops" },
   },
   {
-    name: "Churn forecaster", model: "MiniMax-M2", harness: "mcode", reasoning: { effort: "high" },
+    name: "Churn forecaster", model: "MiniMax-M2", harness: "mcode", reasoning: reasoning("high"),
     instructions: "Estimate 90-day churn risk per account from usage and support signals.\nExplain the top three drivers for each high-risk account.",
     tools: [fn("run_sql", "Run a read-only SQL query against the analytics warehouse.", { sql: str("SELECT statement") })],
     metadata: { team: "data", model_version: "2026-09" },
   },
   {
-    name: "Log summarizer", model: "gpt-5.1-codex", harness: "codex", reasoning: {},
+    name: "Log summarizer", model: "gpt-5.1-codex", harness: "codex", reasoning: reasoning(),
     instructions: "Summarise error logs for the last hour: top error signatures, first seen, count, affected hosts.",
     tools: [mcp("observability", "https://mcp.internal.example/observability", ["query_logs"])],
     metadata: { team: "sre" },
   },
   {
-    name: "Staging smoke tester", model: "gpt-5.1-mini", harness: "codex", reasoning: {},
+    name: "Staging smoke tester", model: "gpt-5.1-mini", harness: "codex", reasoning: reasoning(),
     instructions: "Run the staging smoke checklist after each deploy and report failures with request IDs.",
     tools: [fn("http_check", "Call an endpoint and return status and latency.", { url: str("Absolute URL") })],
     metadata: { team: "qa", environment: "staging" },
@@ -91,13 +93,13 @@ export const agentDefinitions = [
  */
 export const providerAgentDefinitions = [
   {
-    id: "agent_11c4f2a8", name: "Spec drafter", model: "MiniMax-M2", reasoning: {},
+    id: "agent_11c4f2a8", name: "Spec drafter", model: "MiniMax-M2", reasoning: reasoning(),
     instructions: "Draft a product spec from the linked discussion: problem, users, scope, open questions.",
     tools: [], metadata: { team: "product" },
     x_agents_core: { model_provider: { protocol: "anthropic", base_url: "https://api.minimaxi.com/anthropic", api_key_configured: true, context_window: 204800, max_output_tokens: 65536 } },
   },
   {
-    id: "agent_12d7e3b9", name: "Research assistant", model: "kimi-k2", reasoning: {},
+    id: "agent_12d7e3b9", name: "Research assistant", model: "kimi-k2", reasoning: reasoning(),
     instructions: "Answer research questions with cited sources and a one-paragraph summary.",
     tools: [], metadata: { team: "research" },
     x_agents_core: { harness: "codex", model_provider: { protocol: "responses", base_url: "https://api.moonshot.cn/v1", api_key_configured: true } },
diff --git a/apps/web/e2e/data/routes.mjs b/apps/web/e2e/data/routes.mjs
index b0a7601ac..124a7966c 100644
--- a/apps/web/e2e/data/routes.mjs
+++ b/apps/web/e2e/data/routes.mjs
@@ -48,7 +48,7 @@ export function buildDemo(now = Math.floor(Date.now() / 1000), publicUrl = "http
       const turnOutput = Math.floor(200 + rand() * 4000);
       const turnId = uuid();
       const turn = {
-        id: turnId, agent_id: agent.id, session_id: id, object: "agent.session.turn",
+        id: turnId, agent_id: agent.id, subagent_id: null, session_id: id, object: "agent.session.turn",
         status: running ? "in_progress" : failed ? "failed" : rand() < 0.03 ? "cancelled" : "completed",
         created_at: cursor, started_at: cursor + Math.floor(rand() * 4), completed_at: running ? null : cursor + duration,
         error: failed ? { code: "internal_error", message: "The execution could not complete." } : null,
@@ -57,15 +57,15 @@ export function buildDemo(now = Math.floor(Date.now() / 1000), publicUrl = "http
       if (!running) { input += turnInput; output += turnOutput; cached += Math.floor(turnInput * 0.4); reasoning += Math.floor(turnOutput * 0.3); }
       sessionTurns.push(turn);
       const exchange = (agentConversations[agent.name] ?? [["Investigate", "Done"]])[t % (agentConversations[agent.name]?.length ?? 1)];
-      sessionItems.push({ id: uuid(), turn_id: turnId, type: "message", status: "completed", role: "user", content: [{ type: "input_text", text: exchange[0] }] });
+      sessionItems.push({ id: uuid(), turn_id: turnId, type: "message", status: "completed", role: "user", phase: null, content: [{ type: "input_text", text: exchange[0] }] });
       const calls = Math.floor(rand() * 6);
       for (let c = 0; c < calls; c += 1) {
         const kind = pick(["function", "function", "mcp", "command", "command", "web"]);
         const itemFailed = rand() < 0.06;
         if (kind === "function") sessionItems.push({ id: uuid(), turn_id: turnId, type: "function_call", status: itemFailed ? "failed" : "completed", call_id: uuid(), name: pick(["apply_patch", "read_file", "search_docs"]), arguments: {} });
         if (kind === "mcp") sessionItems.push({ id: uuid(), turn_id: turnId, type: "mcp_call", status: itemFailed ? "failed" : "completed", server_label: pick(["github", "linear"]), name: pick(["search_issues", "get_file"]), arguments: {}, output: null, error: null });
-        if (kind === "command") sessionItems.push({ id: uuid(), turn_id: turnId, type: "command_execution", status: "completed", command: "pytest -q", exit_code: itemFailed ? 1 : 0, duration_ms: 1200 });
-        if (kind === "web") sessionItems.push({ id: uuid(), turn_id: turnId, type: "web_search_call", status: "completed" });
+        if (kind === "command") sessionItems.push({ id: uuid(), turn_id: turnId, type: "command_execution", status: "completed", command: "pytest -q", cwd: "/workspace", output: itemFailed ? "1 failed, 41 passed" : "42 passed", exit_code: itemFailed ? 1 : 0, duration_ms: 1200 });
+        if (kind === "web") sessionItems.push({ id: uuid(), turn_id: turnId, type: "web_search_call", status: "completed", action: null });
       }
       if (!running && !failed) sessionItems.push({ id: uuid(), turn_id: turnId, type: "message", status: "completed", role: "assistant", phase: "final_answer", content: [{ type: "output_text", text: exchange[1] }] });
     }
diff --git a/apps/web/src/features/dashboard/runtime-history.test.ts b/apps/web/src/features/dashboard/runtime-history.test.ts
index 18c935421..a07c4397c 100644
--- a/apps/web/src/features/dashboard/runtime-history.test.ts
+++ b/apps/web/src/features/dashboard/runtime-history.test.ts
@@ -24,7 +24,7 @@ const session = {
     model: "fixture/model",
     instructions: null,
     multi_agent: { enabled: false, max_concurrent_subagents: null },
-    reasoning: {},
+    reasoning: { effort: null, summary: null },
     service_tier: "auto",
     text: { format: { type: "text" }, verbosity: "medium" },
     tools: [],
diff --git a/apps/web/src/features/dashboard/runtime-trends.test.ts b/apps/web/src/features/dashboard/runtime-trends.test.ts
index 5ec812f9f..643703797 100644
--- a/apps/web/src/features/dashboard/runtime-trends.test.ts
+++ b/apps/web/src/features/dashboard/runtime-trends.test.ts
@@ -38,7 +38,7 @@ function snapshot(at: number, options: {
       model: "fixture/model",
       instructions: null,
       multi_agent: { enabled: false, max_concurrent_subagents: null },
-      reasoning: {},
+      reasoning: { effort: null, summary: null },
       service_tier: "auto",
       text: { format: { type: "text" }, verbosity: "medium" },
       tools: [],
diff --git a/apps/web/src/features/metrics/agent-metrics.test.ts b/apps/web/src/features/metrics/agent-metrics.test.ts
index e9d18775e..28ccf2705 100644
--- a/apps/web/src/features/metrics/agent-metrics.test.ts
+++ b/apps/web/src/features/metrics/agent-metrics.test.ts
@@ -40,6 +40,7 @@ function turn(id: string, sessionId: string, overrides: Partial<AgentTurn> = {})
   return {
     id,
     agent_id: "agent",
+    subagent_id: null,
     session_id: sessionId,
     object: "agent.session.turn",
     status: "completed",
@@ -144,7 +145,7 @@ describe("helpers", () => {
 });
 
 function page<T extends { id: string }>(data: T[], hasMore: boolean): ListPage<T> {
-  return { data, has_more: hasMore, last_id: data[data.length - 1]?.id ?? null };
+  return { object: "list", data, first_id: data[0]?.id ?? null, last_id: data[data.length - 1]?.id ?? null, has_more: hasMore };
 }
 
 describe("loadAgentMetricsActivity", () => {
diff --git a/apps/web/src/features/sessions/SessionTurnsTable.test.tsx b/apps/web/src/features/sessions/SessionTurnsTable.test.tsx
index 89ebbff95..fb1e51d2d 100644
--- a/apps/web/src/features/sessions/SessionTurnsTable.test.tsx
+++ b/apps/web/src/features/sessions/SessionTurnsTable.test.tsx
@@ -6,7 +6,7 @@ import type { AgentTurn, SessionItem } from "@oac/agents-client";
 import { SessionTurnsTable } from "./SessionTurnsTable";
 
 function turn(id: string, overrides: Partial<AgentTurn> = {}): AgentTurn {
-  return { id, agent_id: "agent", session_id: "session", object: "agent.session.turn", status: "completed", created_at: 1, started_at: 10, completed_at: 14, error: null, usage: null, ...overrides };
+  return { id, agent_id: "agent", subagent_id: null, session_id: "session", object: "agent.session.turn", status: "completed", created_at: 1, started_at: 10, completed_at: 14, error: null, usage: null, ...overrides };
 }
 
 const item = (id: string, turnId: string) => ({ id, turn_id: turnId, type: "message", status: "completed", role: "user", content: [] }) as SessionItem;
diff --git a/apps/web/src/features/sessions/session-history.test.ts b/apps/web/src/features/sessions/session-history.test.ts
index 1e9757a08..ae931653c 100644
--- a/apps/web/src/features/sessions/session-history.test.ts
+++ b/apps/web/src/features/sessions/session-history.test.ts
@@ -21,7 +21,7 @@ function item(id: string, status: SessionItem["status"], turn = "t1"): SessionIt
 }
 
 function turn(id: string, status: AgentTurn["status"], overrides: Partial<AgentTurn> = {}): AgentTurn {
-  return { id, agent_id: "agent", session_id: "session", object: "agent.session.turn", status, created_at: 1, started_at: null, completed_at: null, error: null, usage: null, ...overrides };
+  return { id, agent_id: "agent", subagent_id: null, session_id: "session", object: "agent.session.turn", status, created_at: 1, started_at: null, completed_at: null, error: null, usage: null, ...overrides };
 }
 
 function list<T extends { id: string }>(data: T[], hasMore = false): ListPage<T> {
diff --git a/apps/web/src/features/sessions/session-log.test.ts b/apps/web/src/features/sessions/session-log.test.ts
index bd2b6abbe..8f12ae19e 100644
--- a/apps/web/src/features/sessions/session-log.test.ts
+++ b/apps/web/src/features/sessions/session-log.test.ts
@@ -34,7 +34,7 @@ function session(id: string, overrides: Partial<AgentSession> & { agentId?: stri
       name: agentName,
       instructions: null,
       multi_agent: { enabled: false, max_concurrent_subagents: null },
-      reasoning: {},
+      reasoning: { effort: null, summary: null },
       service_tier: "auto",
       text: { format: { type: "text" }, verbosity: "medium" },
       tools: [],
diff --git a/apps/web/src/features/sessions/session-queries.test.ts b/apps/web/src/features/sessions/session-queries.test.ts
index a3cc575dc..cb08875e6 100644
--- a/apps/web/src/features/sessions/session-queries.test.ts
+++ b/apps/web/src/features/sessions/session-queries.test.ts
@@ -29,7 +29,7 @@ function item(id: string, status: SessionItem["status"]): SessionItem {
 }
 
 function turn(id: string, status: AgentTurn["status"]): AgentTurn {
-  return { id, agent_id: "agent", session_id: "session", object: "agent.session.turn", status, created_at: 1, started_at: null, completed_at: null, error: null, usage: null };
+  return { id, agent_id: "agent", subagent_id: null, session_id: "session", object: "agent.session.turn", status, created_at: 1, started_at: null, completed_at: null, error: null, usage: null };
 }
 
 function list<T extends { id: string }>(data: T[]): ListPage<T> {
diff --git a/apps/web/src/features/sessions/trace/TraceView.test.tsx b/apps/web/src/features/sessions/trace/TraceView.test.tsx
index e69e13eea..40059279d 100644
--- a/apps/web/src/features/sessions/trace/TraceView.test.tsx
+++ b/apps/web/src/features/sessions/trace/TraceView.test.tsx
@@ -14,7 +14,7 @@ const session: AgentSession = {
     name: "Fixture Agent",
     instructions: "Use durable evidence.",
     multi_agent: { enabled: false, max_concurrent_subagents: null },
-    reasoning: {},
+    reasoning: { effort: null, summary: null },
     service_tier: "auto",
     text: { format: { type: "text" }, verbosity: "medium" },
     tools: [{
@@ -39,6 +39,7 @@ function turn(id: string, overrides: Partial<AgentTurn> = {}): AgentTurn {
   return {
     id,
     agent_id: "agent-1",
+    subagent_id: null,
     session_id: session.id,
     object: "agent.session.turn",
     status: "completed",
diff --git a/apps/web/src/features/sessions/trace/trace-model.test.ts b/apps/web/src/features/sessions/trace/trace-model.test.ts
index 083b340d6..59c31556a 100644
--- a/apps/web/src/features/sessions/trace/trace-model.test.ts
+++ b/apps/web/src/features/sessions/trace/trace-model.test.ts
@@ -8,6 +8,7 @@ function turn(id: string, overrides: Partial<AgentTurn> = {}): AgentTurn {
   return {
     id,
     agent_id: "agent-1",
+    subagent_id: null,
     session_id: "session-1",
     object: "agent.session.turn",
     status: "completed",
diff --git a/apps/web/src/lib/collection-pagination.test.ts b/apps/web/src/lib/collection-pagination.test.ts
index 9d7d4b279..fabdaf89e 100644
--- a/apps/web/src/lib/collection-pagination.test.ts
+++ b/apps/web/src/lib/collection-pagination.test.ts
@@ -1,7 +1,12 @@
+import type { ListPage } from "@oac/agents-client";
 import { describe, expect, it } from "vitest";
 
 import { appendCollectionPage, listAllCollectionPages, listStableCollectionPages } from "./collection-pagination";
 
+function page<T extends { id: string }>(data: T[], hasMore: boolean, lastId: string | null = null): ListPage<T> {
+  return { object: "list", data, first_id: data[0]?.id ?? null, last_id: lastId, has_more: hasMore };
+}
+
 describe("top-level collection pagination", () => {
   it("loads every page in stable descending order and forwards cancellation", async () => {
     const controller = new AbortController();
@@ -9,8 +14,8 @@ describe("top-level collection pagination", () => {
     const result = await listAllCollectionPages(async (options) => {
       calls.push({ after: options.after, signal: options.signal });
       return options.after
-        ? { data: [{ id: "agent-1" }], has_more: false }
-        : { data: [{ id: "agent-3" }, { id: "agent-2" }], has_more: true, last_id: "agent-2" };
+        ? page([{ id: "agent-1" }], false)
+        : page([{ id: "agent-3" }, { id: "agent-2" }], true, "agent-2");
     }, controller.signal);
 
     expect(result.map((value) => value.id)).toEqual(["agent-3", "agent-2", "agent-1"]);
@@ -22,18 +27,14 @@ describe("top-level collection pagination", () => {
 
   it("fails closed for duplicate identities, empty continuation pages, and cyclic cursors", async () => {
     await expect(listAllCollectionPages(async (options) => options.after
-      ? { data: [{ id: "duplicate" }], has_more: false }
-      : { data: [{ id: "duplicate" }], has_more: true, last_id: "next" }))
+      ? page([{ id: "duplicate" }], false)
+      : page([{ id: "duplicate" }], true, "next")))
       .rejects.toThrow("duplicate or invalid collection identities");
 
-    await expect(listAllCollectionPages(async () => ({ data: [], has_more: true })))
+    await expect(listAllCollectionPages(async () => (page([], true))))
       .rejects.toThrow("invalid collection pagination cursor");
 
-    await expect(listAllCollectionPages(async (options) => ({
-      data: [{ id: options.after ? "second" : "first" }],
-      has_more: true,
-      last_id: "same-cursor",
-    }))).rejects.toThrow("invalid collection pagination cursor");
+    await expect(listAllCollectionPages(async (options) => page([{ id: options.after ? "second" : "first" }], true, "same-cursor"))).rejects.toThrow("invalid collection pagination cursor");
   });
 
   it("stops before another page read when cancellation is requested", async () => {
@@ -43,7 +44,7 @@ describe("top-level collection pagination", () => {
     await expect(listAllCollectionPages(async () => {
       calls += 1;
       controller.abort();
-      return { data: [{ id: "first" }], has_more: true, last_id: "first" };
+      return page([{ id: "first" }], true, "first");
     }, controller.signal)).rejects.toMatchObject({ name: "AbortError" });
 
     expect(calls).toBe(1);
@@ -53,11 +54,7 @@ describe("top-level collection pagination", () => {
     let completeCalls = 0;
     const complete = await listAllCollectionPages(async () => {
       completeCalls += 1;
-      return {
-        data: [{ id: `complete-${completeCalls}` }],
-        has_more: completeCalls < 100,
-        last_id: `complete-${completeCalls}`,
-      };
+      return page([{ id: `complete-${completeCalls}` }], completeCalls < 100, `complete-${completeCalls}`);
     });
 
     expect(complete).toHaveLength(100);
@@ -66,11 +63,7 @@ describe("top-level collection pagination", () => {
     let incompleteCalls = 0;
     await expect(listAllCollectionPages(async () => {
       incompleteCalls += 1;
-      return {
-        data: [{ id: `incomplete-${incompleteCalls}` }],
-        has_more: true,
-        last_id: `incomplete-${incompleteCalls}`,
-      };
+      return page([{ id: `incomplete-${incompleteCalls}` }], true, `incomplete-${incompleteCalls}`);
     })).rejects.toThrow("pagination exceeded the Web safety limit");
     expect(incompleteCalls).toBe(100);
   });
@@ -81,7 +74,7 @@ describe("top-level collection pagination", () => {
     const result = await listStableCollectionPages(async () => {
       reads += 1;
       if (reads === 1) revision += 1;
-      return { data: [{ id: `snapshot-${reads}` }], has_more: false };
+      return page([{ id: `snapshot-${reads}` }], false);
     }, () => revision);
 
     expect(result).toEqual([{ id: "snapshot-2" }]);
@@ -94,7 +87,7 @@ describe("top-level collection pagination", () => {
     const result = await listStableCollectionPages(async () => {
       reads += 1;
       revision += 1;
-      return { data: [{ id: `unstable-${reads}` }], has_more: false };
+      return page([{ id: `unstable-${reads}` }], false);
     }, () => revision);
 
     expect(result).toBeNull();
@@ -104,18 +97,18 @@ describe("top-level collection pagination", () => {
 
 describe("load-more collection pages", () => {
   it("appends a page and returns the next cursor until Core reports the end", () => {
-    const first = appendCollectionPage([], { data: [{ id: "skill_3" }, { id: "skill_2" }], has_more: true, last_id: "skill_2" });
+    const first = appendCollectionPage([], page([{ id: "skill_3" }, { id: "skill_2" }], true, "skill_2"));
     expect(first).toEqual({ values: [{ id: "skill_3" }, { id: "skill_2" }], nextAfter: "skill_2" });
-    const second = appendCollectionPage(first.values, { data: [{ id: "skill_1" }], has_more: false }, "skill_2");
+    const second = appendCollectionPage(first.values, page([{ id: "skill_1" }], false), "skill_2");
     expect(second).toEqual({ values: [{ id: "skill_3" }, { id: "skill_2" }, { id: "skill_1" }], nextAfter: null });
   });
 
   it("falls back to the last entry and rejects repeated identities or cursors that do not advance", () => {
-    expect(appendCollectionPage([], { data: [{ id: "a" }], has_more: true }).nextAfter).toBe("a");
-    expect(() => appendCollectionPage([{ id: "a" }], { data: [{ id: "a" }], has_more: false }))
+    expect(appendCollectionPage([], page([{ id: "a" }], true)).nextAfter).toBe("a");
+    expect(() => appendCollectionPage([{ id: "a" }], page([{ id: "a" }], false)))
       .toThrow("duplicate or invalid collection identities");
-    expect(() => appendCollectionPage([], { data: [], has_more: true })).toThrow("invalid collection pagination cursor");
-    expect(() => appendCollectionPage([{ id: "a" }], { data: [{ id: "b" }], has_more: true, last_id: "a" }, "a"))
+    expect(() => appendCollectionPage([], page([], true))).toThrow("invalid collection pagination cursor");
+    expect(() => appendCollectionPage([{ id: "a" }], page([{ id: "b" }], true, "a"), "a"))
       .toThrow("invalid collection pagination cursor");
   });
 });
diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index d0d27dc8d..286d27a27 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -14,7 +14,7 @@ Core targets the complete OpenAI Agents API as pinned below ([public API rule](h
 | [openapi.yaml](./openapi.yaml) | The official public contract with Core's `x_agents_core` extension on Agent and Session request/response objects |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go names, field representations, encoding order and stored projections; it does not define official field membership, enums or constraints |
 
-Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The internal `/core/v1` and `/api/v1` documents come from handler annotations. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
+Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
 
 The public contract is the official API plus Core extensions. Standard fields are generated into `v1/official.gen.go`; `go-bindings.json` lists types consumed by Core and overrides only the Go representation or field order that existing storage or custom JSON encoding requires. Unspecified fields follow the official schema; shared shapes use one Go type. Selected discriminated unions also generate JSON serializers to retain required nullable fields for each variant. Other union serializers, Core's local limits, execution admission and state transitions remain implementation code. Contract tests verify that the public schema preserves the official definitions, extensions remain in `x_agents_core`, and all documents match registered routes. Official-client and raw HTTP tests verify behavior. Schema generation does not qualify an unimplemented feature; the gaps below still apply. Upstream upgrades update the OpenAPI and SDK pins together after comparison and compatibility tests.
 
diff --git a/contracts/agents-api/sessions-events.md b/contracts/agents-api/sessions-events.md
index de744cf36..ebee44625 100644
--- a/contracts/agents-api/sessions-events.md
+++ b/contracts/agents-api/sessions-events.md
@@ -99,7 +99,7 @@ A retry with the same `Idempotency-Key` and `stream: true` returns 201 with only
 
 ### Event rules
 
-- Session events carry `event_id`, `type` and the `session` snapshot at that transition. Turn events carry `session_id` and `turn_id`. There is no Turn `waiting` event.
+- Session events carry `event_id`, `type` and the `session` snapshot at that transition. Turn events carry `session_id` and `turn_id`; Environment events carry `session_id` and a null `turn_id`. There is no Turn `waiting` event.
 - A new Turn publishes `agent.session.turn.created`, the user `item.added`, `agent.session.in_progress`, then `agent.session.turn.in_progress`, all from one transaction. When a batch holds several messages, the later messages follow the Session activity.
 - Terminal Turn events (`completed`, `failed`, `cancelled`) carry top-level `usage` copied from the Turn snapshot at that moment, null when unknown. Other events omit it.
 - `item.added` and `item.done` always carry `output_index`, null for input Items. Function results emit `item.added` only; `item.done` is for agent output.
@@ -123,7 +123,7 @@ Turn and Item lists take `after`, `limit` and `order` ([list rules](./wire-seman
 | `mcp_call` | Server and tool identity, arguments, structured result or error |
 | `function_call`, `function_call_output` | A linked call and its result. The result always carries `output` and `error`, null when the submission omitted them; stored results keep the submitted field presence. Native file changes appear as an `apply_patch` function call with the changes as arguments and no invented result |
 | `web_search_call` | The supported action fields (`search`, `open_page`, `find_in_page`, `other`) |
-| `reasoning`, `agent_message` and the Subagent coordination calls | See [Subagents](./subagents.md). `agent_message` has no status; reasoning status can be absent or null |
+| `reasoning`, `agent_message` and the Subagent coordination calls | See [Subagents](./subagents.md). `agent_message` has no status; reasoning status can be null |
 
 A failed tool does not fail its Turn. Tool output is readable by the Session's Project and can contain the tool's own diagnostic text.
 
@@ -150,5 +150,3 @@ When an Environment fails to initialize, whether an `openai_hosted` sandbox or a
 Session reads and lists return the same Session, and input that was waiting for the Environment settles as failed in the same snapshot. The GET stream and the creation stream end after `agent.session.failed`. New input returns 409 ([input errors](#input-errors)); the Session can be deleted.
 
 The [Environment initialization contract](./environments.md#initialization-state-and-failure) defines the fixed failure reasons.
-
-Core's own `stream_interrupted` error event carries `type`, `code` and `message` without `param`; `error` events shaped like the official ones carry `param: null`.
diff --git a/contracts/agents-api/v1/events.go b/contracts/agents-api/v1/events.go
index dc2441bc5..c48a42d93 100644
--- a/contracts/agents-api/v1/events.go
+++ b/contracts/agents-api/v1/events.go
@@ -1,6 +1,9 @@
 package v1
 
-import "encoding/json"
+import (
+	"encoding/json"
+	"strings"
+)
 
 // TerminalTurnEvent reports whether an event type settles a Turn.
 func TerminalTurnEvent(eventType string) bool {
@@ -17,8 +20,8 @@ func itemEvent(eventType string) bool {
 }
 
 // MarshalJSON keeps the nullable top-level usage on terminal Turn events only,
-// a nullable output_index on every Item event (EVT-09) and a nullable error
-// param on error events.
+// a nullable output_index on every Item event (EVT-09), a nullable error param
+// on error events and a nullable turn_id on Environment events.
 func (e SessionEvent) MarshalJSON() ([]byte, error) {
 	type wire SessionEvent
 	switch {
@@ -39,6 +42,16 @@ func (e SessionEvent) MarshalJSON() ([]byte, error) {
 			wire
 			OutputIndex *int32 `json:"output_index"`
 		}{wire(e), e.OutputIndex})
+	case strings.HasPrefix(e.Type, "agent.session.environment."):
+		e.Usage = nil
+		var turn *string
+		if e.TurnID != "" {
+			turn = &e.TurnID
+		}
+		return json.Marshal(struct {
+			wire
+			TurnID *string `json:"turn_id"`
+		}{wire(e), turn})
 	}
 	e.Usage = nil
 	return json.Marshal(wire(e))
diff --git a/contracts/agents-api/v1/events_test.go b/contracts/agents-api/v1/events_test.go
index 05ac64fdb..75374d166 100644
--- a/contracts/agents-api/v1/events_test.go
+++ b/contracts/agents-api/v1/events_test.go
@@ -44,7 +44,8 @@ func TestSessionEventUsageOnlyOnTerminalTurnEvents(t *testing.T) {
 }
 
 // Error events carry the pinned SessionError, whose param is present and null
-// when unset; Environment state errors keep their observed three fields (HI-01/02).
+// when unset; Environment state errors keep their observed three fields (HI-01/02)
+// and Environment events carry a null turn_id.
 func TestSessionErrorEventCarriesNullableParam(t *testing.T) {
 	failure := &StreamError{Type: "environment_error", Code: "sandbox_error", Message: "Failed to provision environment"}
 	param := "input"
@@ -58,7 +59,7 @@ func TestSessionErrorEventCarriesNullableParam(t *testing.T) {
 			`{"type":"error","event_id":"event","session_id":"session","error":{"code":"invalid","type":"invalid_request_error","message":"m","param":"input"}}`},
 		{SessionEvent{Type: "agent.session.environment.failed", EventID: "event", Environment: &SessionEnvironmentState{ID: "environment", Type: "openai_hosted", Status: "failed",
 			Error: &StreamError{Type: "environment_error", Code: "environment_connection_failed", Message: "The environment failed to connect."}}},
-			`{"type":"agent.session.environment.failed","event_id":"event","environment":{"id":"environment","type":"openai_hosted","status":"failed","error":{"code":"environment_connection_failed","type":"environment_error","message":"The environment failed to connect."}}}`},
+			`{"type":"agent.session.environment.failed","event_id":"event","environment":{"id":"environment","type":"openai_hosted","status":"failed","error":{"code":"environment_connection_failed","type":"environment_error","message":"The environment failed to connect."}},"turn_id":null}`},
 	} {
 		raw, err := json.Marshal(test.event)
 		if err != nil || string(raw) != test.want {
diff --git a/contracts/agents-api/v1/items_test.go b/contracts/agents-api/v1/items_test.go
index a507c1319..8eecdb970 100644
--- a/contracts/agents-api/v1/items_test.go
+++ b/contracts/agents-api/v1/items_test.go
@@ -72,6 +72,10 @@ func TestItemWireFieldsAreExplicitlyNull(t *testing.T) {
 	for _, key := range []string{"phase", "error", "output", "content"} {
 		expectField(t, call, key, "")
 	}
+	command := fields(t, Item{ID: "cmd", TurnID: "turn", Type: "command_execution", Status: "in_progress", Command: "ls"})
+	for _, key := range []string{"cwd", "output", "exit_code", "duration_ms"} {
+		expectField(t, command, key, "null")
+	}
 	reasoning := fields(t, Item{ID: "rs", TurnID: "turn", Type: "reasoning"})
 	expectField(t, reasoning, "status", "null")
 	expectField(t, reasoning, "summary", "[]")
diff --git a/contracts/agents-api/v1/subagent_items.go b/contracts/agents-api/v1/subagent_items.go
index 0c21e078b..ce5c6f967 100644
--- a/contracts/agents-api/v1/subagent_items.go
+++ b/contracts/agents-api/v1/subagent_items.go
@@ -7,8 +7,9 @@ import (
 
 // MarshalJSON renders the wire shape, which is also the stored encoding.
 // Messages always carry content and a nullable phase, function results a
-// nullable output and error, and web search a nullable action. Coordination
-// and reasoning variants keep their required fields and nulls.
+// nullable output and error, commands a nullable cwd, output, exit code and
+// duration, and web search a nullable action. Coordination and reasoning
+// variants keep their required fields and nulls.
 func (i Item) MarshalJSON() ([]byte, error) {
 	type wire Item
 	switch i.Type {
@@ -26,6 +27,14 @@ func (i Item) MarshalJSON() ([]byte, error) {
 			Phase   *string       `json:"phase"`
 			Content []ItemContent `json:"content"`
 		}{wire(i), phase, content})
+	case "command_execution":
+		return json.Marshal(struct {
+			wire
+			Cwd        *string `json:"cwd"`
+			Output     any     `json:"output"`
+			ExitCode   *int64  `json:"exit_code"`
+			DurationMS *int64  `json:"duration_ms"`
+		}{wire(i), i.Cwd, i.Output, i.ExitCode, i.DurationMS})
 	case "web_search_call":
 		return json.Marshal(struct {
 			wire
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index fda6127ab..3897fefdc 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "Agents API 覆盖台账"
 source: contracts/agents-api/index.md
-source_hash: c155876a94aeda51fb97ec292629505142cfb6f76785dfaf2a783acab87226ae
+source_hash: c3180e51ce893b3752370abbdf3a58255ebe11fdfd7ec1e1620ad85f7ce1b30d
 ---
 
 Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。本台账记录 Core 对各项资源实现了哪些内容、哪些契约保存其详细信息，并列出相对于 OpenAI 服务的所有已知差异和所有未解决缺口。[API namespaces and credentials](../../../docs/zh/api/index.md) 说明谁调用哪些 API；[Agents API guide](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
@@ -16,7 +16,7 @@ Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[publi
 | [openapi.yaml](../openapi.yaml) | 官方公共契约，并在 Agent 和 Session 请求及响应对象上加入 Core 的 `x_agents_core` 扩展 |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go 名称、字段表示、编码顺序和存储投影；不定义官方字段集合、枚举或约束 |
 
-运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
+运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
 
 公共契约是官方 API 加上 Core 扩展。标准字段生成到 `v1/official.gen.go`；`go-bindings.json` 只列出 Core 使用的类型，仅在已有存储或自定义 JSON 编码需要时覆盖 Go 表示或字段顺序。未覆盖的字段遵循官方 schema，相同结构复用同一个 Go 类型。部分带判别字段的联合类型也从 schema 生成 JSON 序列化代码，保留每个分支必需的可空字段。其他联合类型序列化、Core 的本地限制、执行准入和状态转换仍由实现代码负责。契约测试验证公共 schema 保留官方定义、扩展位于 `x_agents_core` 中，且所有文档与注册路由一致。官方客户端和原始 HTTP 测试验证行为。生成 schema 不代表某个尚未实现的功能已经得到验证；下方缺口仍然适用。升级上游时，在比对和兼容性测试后一起更新 OpenAPI 和 SDK 固定版本。
 
diff --git a/contracts/agents-api/zh/sessions-events.md b/contracts/agents-api/zh/sessions-events.md
index 99688def4..846dc92a0 100644
--- a/contracts/agents-api/zh/sessions-events.md
+++ b/contracts/agents-api/zh/sessions-events.md
@@ -1,7 +1,7 @@
 ---
 title: "会话、事件和历史"
 source: contracts/agents-api/sessions-events.md
-source_hash: 93ace7d112cbc671039624ec9c999addce715bb08036a50246442a9e14549021
+source_hash: f37a947b5ae72b98b0da76da02fb13bb02ef6c346d3bf4b7830848c1196a2675
 ---
 
 本契约涵盖会话（Session）内部发生的事情：发送输入、实时事件流，以及读取轮次（Turn）、条目（Item）和使用量的持久化历史。会话资源本身（创建配置、重试标识、更新、列出和删除）见 [Core 线协议行为](wire-semantics.md)。消息和函数结果内容见[消息内容](message-content.md)。[Agents API 指南](../../../docs/zh/api/public-agent-api.md)展示了使用 SDK 和 HTTP 的调用方式。
@@ -101,7 +101,7 @@ Turn 失败后会话仍可使用：新输入会启动一个新 Turn。后来预
 
 ### 事件规则 {#event-rules}
 
-- 会话事件携带 `event_id`、`type`，以及该次状态转换时的 `session` 快照。Turn 事件携带 `session_id` 和 `turn_id`。不存在 Turn `waiting` 事件。
+- 会话事件携带 `event_id`、`type`，以及该次状态转换时的 `session` 快照。Turn 事件携带 `session_id` 和 `turn_id`；环境（Environment）事件携带 `session_id` 和值为 null 的 `turn_id`。不存在 Turn `waiting` 事件。
 - 新 Turn 会在一个事务中依次发布 `agent.session.turn.created`、用户条目的 `item.added`、`agent.session.in_progress`，然后发布 `agent.session.turn.in_progress`。当一个批次包含多条消息时，后续消息对应的条目事件会排在会话活动之后。
 - Turn 终止事件（`completed`、`failed`、`cancelled`）携带顶层的 `usage`，其值复制自当时的 Turn 快照；未知时为 null。其他事件省略此字段。
 - `item.added` 和 `item.done` 始终携带 `output_index`；输入 Item 的该值为 null。函数结果只发出 `item.added`；`item.done` 用于代理输出。
@@ -125,7 +125,7 @@ Turn 和 Item 列表接受 `after`、`limit` 和 `order`（[列表规则](wire-s
 | `mcp_call` | 服务器和工具标识、参数、结构化结果或错误 |
 | `function_call`、`function_call_output` | 关联的调用及其结果。结果始终携带 `output` 和 `error`；提交时省略这些字段则值为 null。存储的结果会保留提交时字段是否存在的信息。原生文件更改显示为 `apply_patch` 函数调用，更改内容作为参数，不会生成虚构结果 |
 | `web_search_call` | 支持的操作字段（`search`、`open_page`、`find_in_page`、`other`） |
-| `reasoning`、`agent_message` 和 Subagent 协调调用 | 见 [Subagents](subagents.md)。`agent_message` 没有状态；reasoning 状态可以缺失或为 null |
+| `reasoning`、`agent_message` 和 Subagent 协调调用 | 见 [Subagents](subagents.md)。`agent_message` 没有状态；reasoning 状态可以为 null |
 
 工具失败不会导致其 Turn 失败。会话的 Project 可以读取工具输出，其中可能包含该工具自己的诊断文本。
 
@@ -152,5 +152,3 @@ Turn 和会话的 `usage` 使用固定的 `TokenUsage` 字段：输入、缓存
 会话读取和列表操作会返回同一个会话，正在等待 Environment 的输入也会在同一快照中结算为失败。GET 流和创建流会在 `agent.session.failed` 之后结束。新输入会返回 409（[输入错误](#input-errors)）；该会话可以被删除。
 
 [Environment 初始化契约](environments.md#initialization-state-and-failure)定义了固定的失败原因。
-
-Core 自身的 `stream_interrupted` 错误事件携带 `type`、`code` 和 `message`，但不携带 `param`；与官方错误事件结构相同的 `error` 事件会携带 `param: null`。
diff --git a/example/parsar/src/lib/session-timing.ts b/example/parsar/src/lib/session-timing.ts
index 0a1fb4a8d..e5489396d 100644
--- a/example/parsar/src/lib/session-timing.ts
+++ b/example/parsar/src/lib/session-timing.ts
@@ -45,7 +45,7 @@ export function requestReturned(id: string, operation: string) {
   if (value?.operation === operation)
     write(id, { ...value, responseMs: timingNow() - value.startedAt });
 }
-export function firstTextArrived(id: string, turnId?: string) {
+export function firstTextArrived(id: string, turnId?: string | null) {
   const value = read(id);
   if (
     value &&
diff --git a/example/parsar/tests/fixture.mjs b/example/parsar/tests/fixture.mjs
index b483ee29e..1a0db861a 100644
--- a/example/parsar/tests/fixture.mjs
+++ b/example/parsar/tests/fixture.mjs
@@ -21,8 +21,13 @@ const message = (turn, role, text) => ({
 });
 
 const streams = new Map();
+// Snapshot events carry the Session itself instead of its ID.
 const emit = (session, event) => {
-  const data = { event_id: randomUUID(), session_id: session.id, ...event };
+  const data = {
+    event_id: randomUUID(),
+    ...("session" in event ? {} : { session_id: session.id }),
+    ...event,
+  };
   for (const stream of streams.get(session.id) || [])
     stream.write(`data: ${JSON.stringify(data)}\n\n`);
 };
@@ -224,7 +229,7 @@ createServer(async (req, res) => {
     const saved = {
       id: randomUUID(),
       name: null,
-      reasoning: {},
+      reasoning: { effort: null, summary: null },
       service_tier: "auto",
       ...body.agent,
       multi_agent: { enabled: false, max_concurrent_subagents: null },
@@ -374,20 +379,19 @@ createServer(async (req, res) => {
       .push(message(turn, "user", event.input[0].content[0].text));
     if (event.input[0].content[0].text === "Stream reply") {
       const item = { ...message(turn, "assistant", ""), status: "in_progress" };
-      const base = { turn_id: turn.id, item_id: item.id, output_index: 0 };
+      const base = { turn_id: turn.id, output_index: 0 };
+      const text = { ...base, item_id: item.id, content_index: 0 };
       setTimeout(() => {
         emit(session, { ...base, type: "agent.session.turn.item.added", item });
         emit(session, {
-          ...base,
-          content_index: 0,
+          ...text,
           type: "agent.session.turn.output_text.delta",
           delta: "流式第一段",
         });
       }, 250);
       setTimeout(() => {
         emit(session, {
-          ...base,
-          content_index: 0,
+          ...text,
           type: "agent.session.turn.output_text.delta",
           delta: "，第二段完成。",
         });
diff --git a/packages/agents-client/README.md b/packages/agents-client/README.md
index 456f75318..c93f98670 100644
--- a/packages/agents-client/README.md
+++ b/packages/agents-client/README.md
@@ -20,10 +20,11 @@ Every constructor also takes `baseUrl` and `fetch`. A token may be a string or a
 
 Behavior shared by the clients:
 
+- **Generated types.** `make openapi` generates `src/generated/public-api.ts` from the [public schema](../../contracts/agents-api/openapi.yaml): each schema's type, each enum's values and each object's field names. `types.ts` builds on the types and the validators read the value and field lists; `make check-openapi` rejects a stale copy, so change the schema and regenerate instead of editing the file.
 - **Strict responses.** Session, history, event, Environment and Core API responses are checked against their pinned shapes before they are returned. A malformed one throws `AgentCoreError` with status 502 and a code such as `invalid_session_resource` or `invalid_admin_response` (`CoreMetricsClient`: status 0, `invalid_response`) instead of passing on a guessed value. Agent responses are typed but not checked at run time.
-- **Errors.** A non-2xx response throws `AgentCoreError` with `status`, `code`, `param`, `errorType` and, from the Core API, the optional `details` of the [Core error envelope](../../contracts/agents-api/core-errors.md). Invalid caller input throws `TypeError` before any request.
+- **Errors.** A non-2xx response throws `AgentCoreError` with `status`, `code`, `param`, `errorType` and, from the Core API, the optional `details` of the [Core error envelope](../../contracts/agents-api/core-errors.md). Input the client cannot send, such as a malformed resource ID, throws `TypeError` before any request; Core enforces size, count and range limits.
 - **No retries or timeouts.** No client retries a request. Pass `signal` to cancel one.
-- **Idempotency.** `createSession` takes an idempotency key and generates one when omitted; pass your own to retry a creation safely. `sendMessage`, `submitEvents`, `cancelTurn` and `submitFunctionResult` require a key of at most 128 bytes. `createIdempotencyKey()` makes one.
+- **Idempotency.** `createSession` takes an idempotency key and generates one when omitted; pass your own to retry a creation safely. `sendMessage`, `submitEvents`, `cancelTurn` and `submitFunctionResult` require one. `createIdempotencyKey()` makes one.
 - **Streams.** `streamEvents` and `createSessionStream` decode the live event stream with `createSSEDecoder` and validate each event. Recover missed events with ordinary reads; the decoder does not resume with `Last-Event-ID`.
 
 ### Saved Agent and deployment defaults
diff --git a/packages/agents-client/src/admin-client.test.ts b/packages/agents-client/src/admin-client.test.ts
index 8884b4328..94613c92e 100644
--- a/packages/agents-client/src/admin-client.test.ts
+++ b/packages/agents-client/src/admin-client.test.ts
@@ -211,7 +211,7 @@ describe("AdminClient response contracts", () => {
   });
 
   it("reuses Session identity and state validation", async () => {
-    const agent = { id: "a", model: "model", name: null, instructions: null, multi_agent: { enabled: false, max_concurrent_subagents: null }, reasoning: {}, service_tier: "auto", text: { format: { type: "text" }, verbosity: "medium" }, tools: [] };
+    const agent = { id: "a", model: "model", name: null, instructions: null, multi_agent: { enabled: false, max_concurrent_subagents: null }, reasoning: { effort: null, summary: null }, service_tier: "auto", text: { format: { type: "text" }, verbosity: "medium" }, tools: [] };
     const session = { id: sessionId, object: "agent.session", agent, environment: { type: "none" }, status: "idle", error: null, metadata: {}, required_actions: [], vault_ids: [], usage: null, created_at: 1, last_active_at: 1 };
     expect(await clientWith(session).client.retrieveSession(projectId, sessionId)).toEqual(session);
     await expect(clientWith(session).client.retrieveSession(projectId, resourceId)).rejects.toBeInstanceOf(AgentCoreError);
diff --git a/packages/agents-client/src/admin-client.ts b/packages/agents-client/src/admin-client.ts
index fcf1be088..7d208fc0c 100644
--- a/packages/agents-client/src/admin-client.ts
+++ b/packages/agents-client/src/admin-client.ts
@@ -7,7 +7,7 @@ import {
   projectVaultCredential, projectVaultCredentialList, projectSourceFile, projectSourceFileDeleted,
 } from "./client";
 import { projectExecutionConfiguration } from "./execution-configuration-projection";
-import { projectAgentTurn, projectSessionItem, projectHistoryPage, validateHistoryPageOptions } from "./history-projection";
+import { projectAgentTurn, projectSessionItem, projectHistoryPage } from "./history-projection";
 import { projectRuntimeHistory } from "./runtime-history-projection";
 import { canonicalUuid, isNonnegativeInteger, isRecord } from "./response-projection";
 import { CoreRequester } from "./core-request";
@@ -204,7 +204,6 @@ export class AdminClient {
     return projectAdminSessionArchive(await this.#json(`${scope(projectId)}/sessions/${segment(sessionId)}/archive`, options), sessionId);
   }
   async listTurns(projectId: string, sessionId: string, options?: PageOptions) {
-    validateHistoryPageOptions(options);
     const value = await this.#json(pageQuery(`${scope(projectId)}/sessions/${segment(sessionId)}/turns`, options), options);
     return projectHistoryPage(value, options, (entry) => projectAgentTurn(entry, sessionId, invalidAdminResponse), invalidAdminResponse);
   }
@@ -212,7 +211,6 @@ export class AdminClient {
     return projectAgentTurn(await this.#json(`${scope(projectId)}/sessions/${segment(sessionId)}/turns/${segment(turnId)}`, options), sessionId, invalidAdminResponse, turnId);
   }
   async listItems(projectId: string, sessionId: string, options?: PageOptions) {
-    validateHistoryPageOptions(options);
     const value = await this.#json(pageQuery(`${scope(projectId)}/sessions/${segment(sessionId)}/items`, options), options);
     return projectHistoryPage(value, options, (entry) => projectSessionItem(entry, invalidAdminResponse), invalidAdminResponse);
   }
diff --git a/packages/agents-client/src/client.test.ts b/packages/agents-client/src/client.test.ts
index 125cd53ec..99c737350 100644
--- a/packages/agents-client/src/client.test.ts
+++ b/packages/agents-client/src/client.test.ts
@@ -52,7 +52,7 @@ function agentSnapshot(): Record<string, unknown> {
     name: null,
     instructions: null,
     multi_agent: { enabled: false, max_concurrent_subagents: null },
-    reasoning: {},
+    reasoning: { effort: null, summary: null },
     service_tier: "auto",
     text: { format: { type: "text" }, verbosity: "medium" },
     tools: [],
@@ -80,6 +80,7 @@ function turnResource(overrides: Record<string, unknown> = {}): Record<string, u
   return {
     id: "turn_1",
     agent_id: "agent",
+    subagent_id: null,
     session_id: "session",
     object: "agent.session.turn",
     status: "queued",
@@ -99,6 +100,7 @@ function messageItem(overrides: Record<string, unknown> = {}): Record<string, un
     type: "message",
     status: "in_progress",
     role: "assistant",
+    phase: null,
     content: [{ type: "output_text", text: "" }],
     ...overrides,
   };
@@ -163,7 +165,7 @@ describe("OpenAIAgentsClient", () => {
     const client = new OpenAIAgentsClient({
       baseUrl: "https://core.example/v1/",
       token: () => "tenant-key",
-      fetch: recordingFetch(jsonResponse({ data: [], has_more: false }), calls),
+      fetch: recordingFetch(jsonResponse({ object: "list", data: [], first_id: null, last_id: null, has_more: false }), calls),
     });
 
     await client.listSessions({ after: "sess/one", limit: 10, order: "asc", agentId: "agent one" });
@@ -299,7 +301,7 @@ describe("OpenAIAgentsClient", () => {
     const body = new ReadableStream<Uint8Array>({
       start(controller) {
         controller.enqueue(new TextEncoder().encode(
-          'event: error\ndata: {"type":"error","event_id":"evt_error","session_id":"session","error":{"code":"stream_interrupted","type":"server_error","message":"safe"}}\n\n',
+          'event: error\ndata: {"type":"error","event_id":"evt_error","session_id":"session","error":{"code":"stream_interrupted","type":"server_error","message":"safe","param":null}}\n\n',
         ));
       },
       cancel() {
@@ -325,7 +327,7 @@ describe("OpenAIAgentsClient", () => {
     const failed = { ...sessionResource(), environment, status: "failed", error: reason, last_active_at: 25 };
     const frames = [
       {
-        type: "agent.session.environment.failed", event_id: "evt_environment", session_id: "session",
+        type: "agent.session.environment.failed", event_id: "evt_environment", session_id: "session", turn_id: null,
         environment: {
           id: "environment", type: "openai_hosted", status: "failed",
           error: { type: "environment_error", code: "environment_connection_failed", message: "The environment failed to connect." },
@@ -370,7 +372,6 @@ describe("OpenAIAgentsClient", () => {
     const created = JSON.stringify({
       type: "agent.session.created",
       event_id: "evt_created",
-      session_id: "session/created",
       session,
     });
     const later = JSON.stringify({
@@ -444,7 +445,7 @@ describe("OpenAIAgentsClient", () => {
       { type: "agent.session.created", event_id: "created", session: admitted },
       { type: "agent.session.turn.created", event_id: "turn", session_id: "session", turn_id: "turn_1", turn: turnResource() },
       {
-        type: "agent.session.turn.item.added", event_id: "input", session_id: "session", turn_id: "turn_1",
+        type: "agent.session.turn.item.added", event_id: "input", session_id: "session", turn_id: "turn_1", output_index: null,
         item: messageItem({ status: "completed", role: "user", content: [{ type: "input_text", text: "First" }] }),
       },
       { type: "agent.session.in_progress", event_id: "progress", session: admitted },
@@ -864,7 +865,6 @@ describe("OpenAIAgentsClient", () => {
     const created = {
       type: "agent.session.created",
       event_id: "evt_created",
-      session_id: "session",
       session: sessionResource(),
     };
     const client = new OpenAIAgentsClient({
@@ -887,7 +887,7 @@ describe("OpenAIAgentsClient", () => {
     const onEvent = vi.fn();
     const client = new OpenAIAgentsClient({
       fetch: recordingFetch(streamResponse([
-        'event: error\ndata: {"type":"error","event_id":"evt_error","session_id":"session","error":{"code":"stream_interrupted","type":"server_error","message":"private"}}\n\n',
+        'event: error\ndata: {"type":"error","event_id":"evt_error","session_id":"session","error":{"code":"stream_interrupted","type":"server_error","message":"private","param":null}}\n\n',
       ]), []),
     });
 
@@ -1021,7 +1021,7 @@ describe("OpenAIAgentsClient", () => {
 
   it("projects the dadf64a7 known SSE payload families with exact cross references", async () => {
     const events = [
-      { type: "agent.session.idle", event_id: "session", session_id: "session", session: sessionResource() },
+      { type: "agent.session.idle", event_id: "session", session: sessionResource() },
       {
         type: "agent.session.turn.created",
         event_id: "turn",
@@ -1034,7 +1034,6 @@ describe("OpenAIAgentsClient", () => {
         event_id: "item",
         session_id: "session",
         turn_id: "turn_1",
-        item_id: "item_1",
         output_index: 0,
         item: messageItem(),
       },
@@ -1049,6 +1048,7 @@ describe("OpenAIAgentsClient", () => {
           turn_id: "turn_1",
           type: "web_search_call",
           status: "in_progress",
+          action: null,
         },
       },
       {
@@ -1094,6 +1094,7 @@ describe("OpenAIAgentsClient", () => {
         type: "agent.session.environment.connected",
         event_id: "environment",
         session_id: "session",
+        turn_id: null,
         environment: { id: "environment", type: "self_hosted", status: "connected", error: null },
       },
     ];
@@ -1106,10 +1107,10 @@ describe("OpenAIAgentsClient", () => {
 
     expect(onEvent).toHaveBeenCalledTimes(events.length);
     expect(onEvent.mock.calls.map((call) => call[0]?.type)).toEqual(events.map((event) => event.type));
-    expect(onEvent.mock.calls[2]?.[0]).toMatchObject({ item_id: "item_1", item: { id: "item_1", turn_id: "turn_1" } });
+    expect(onEvent.mock.calls[2]?.[0]).toMatchObject({ output_index: 0, item: { id: "item_1", turn_id: "turn_1" } });
   });
 
-  it("projects explicit wire nulls and accepts older Cores that omit them", async () => {
+  it("projects explicit wire nulls", async () => {
     const user = {
       id: "user_1", turn_id: "turn_1", type: "message", status: "completed", role: "user",
       phase: null, content: [{ type: "input_text", text: "question" }],
@@ -1119,12 +1120,10 @@ describe("OpenAIAgentsClient", () => {
       call_id: "call_1", output: null, error: null,
     };
     const session = { ...sessionResource(), agent: { ...agentSnapshot(), reasoning: { effort: null, summary: null } } };
-    const { phase: _omitted, ...legacyUser } = user;
     const events = [
-      { type: "agent.session.idle", event_id: "idle", session_id: "session", session },
+      { type: "agent.session.idle", event_id: "idle", session },
       { type: "agent.session.turn.item.added", event_id: "user", session_id: "session", turn_id: "turn_1", output_index: null, item: user },
       { type: "agent.session.turn.item.added", event_id: "result", session_id: "session", turn_id: "turn_1", output_index: null, item: result },
-      { type: "agent.session.turn.item.added", event_id: "legacy", session_id: "session", turn_id: "turn_1", item: { ...legacyUser, id: "user_2" } },
       {
         type: "agent.session.turn.item.added", event_id: "answer", session_id: "session", turn_id: "turn_1",
         output_index: 0, item: messageItem({ content: [], phase: "final_answer" }),
@@ -1143,9 +1142,7 @@ describe("OpenAIAgentsClient", () => {
     expect(projected[1]).toMatchObject({ output_index: null, item: { role: "user", phase: null } });
     expect(projected[2]).toMatchObject({ output_index: null, item: { output: null, error: null } });
     expect(Object.prototype.hasOwnProperty.call(projected[2]?.item, "output")).toBe(true);
-    expect(Object.prototype.hasOwnProperty.call(projected[3], "output_index")).toBe(false);
-    expect(Object.prototype.hasOwnProperty.call(projected[3]?.item, "phase")).toBe(false);
-    expect(projected[4]).toMatchObject({ output_index: 0, item: { status: "in_progress", content: [], phase: "final_answer" } });
+    expect(projected[3]).toMatchObject({ output_index: 0, item: { status: "in_progress", content: [], phase: "final_answer" } });
 
     for (const invalid of [{ ...events[1], output_index: "0" }, { ...events[1], output_index: -1 }, { ...events[1], item: { ...user, phase: "draft" } }]) {
       const rejected = new OpenAIAgentsClient({
@@ -1206,18 +1203,6 @@ describe("OpenAIAgentsClient", () => {
     expect(projected.usage).toEqual(usage);
   });
 
-  it("accepts a terminal Turn event without top-level usage", async () => {
-    const onEvent = vi.fn();
-    const client = new OpenAIAgentsClient({
-      fetch: recordingFetch(streamResponse([`data: ${JSON.stringify(terminalTurnEvent("completed"))}\n\n`]), []),
-    });
-
-    await client.streamEvents("session", { onEvent });
-
-    expect(onEvent).toHaveBeenCalledTimes(1);
-    expect(Object.prototype.hasOwnProperty.call(onEvent.mock.calls[0]?.[0], "usage")).toBe(false);
-  });
-
   it.each([
     ["a non-terminal Turn event", {
       type: "agent.session.turn.in_progress", event_id: "event", session_id: "session", turn_id: "turn_1",
@@ -1385,7 +1370,7 @@ describe("OpenAIAgentsClient", () => {
             last_active_at: 1,
           });
         }
-        return jsonResponse({ data: [], has_more: false });
+        return jsonResponse({ object: "list", data: [], first_id: null, last_id: null, has_more: false });
       }) as typeof fetch,
     });
 
@@ -1943,7 +1928,7 @@ describe("OpenAIAgentsClient", () => {
     const client = new OpenAIAgentsClient({ fetch: recordingFetch(jsonResponse({}), calls) });
 
     await expect(client.retrieveSourceFile("notes.txt")).rejects.toThrow("Invalid Source File ID");
-    await expect(client.uploadSourceFile({ file: new Blob(["x"]), filename: "" })).rejects.toThrow("valid filename");
+    await expect(client.uploadSourceFile({ file: new Blob(["x"]), filename: "" })).rejects.toThrow("nonempty filename");
     await expect(client.listEnvironmentFiles("environment", { path: "relative" }))
       .rejects.toThrow("absolute directory without parent traversal");
     await expect(client.listEnvironmentFiles("environment", { path: "/executor/../secret" }))
@@ -1953,11 +1938,6 @@ describe("OpenAIAgentsClient", () => {
       data: "YR==",
       path: "/workspace/file.txt",
     })).rejects.toThrow("strict standard Base64");
-    await expect(client.createEnvironmentFile("environment", {
-      type: "inline",
-      data: btoa("a".repeat(5 * 1024 * 1024 + 1)),
-      path: "/workspace/file.txt",
-    })).rejects.toThrow("at most 5 MiB");
     await expect(client.createEnvironmentFile("environment", {
       type: "file_id",
       file_id: "file-16e1f26e-8cf6-4272-9c31-d470b08d31af",
@@ -2040,7 +2020,7 @@ describe("OpenAIAgentsClient", () => {
     const controller = new AbortController();
     const client = new OpenAIAgentsClient({
       baseUrl: "https://core.example.test/v1/",
-      fetch: recordingFetch(jsonResponse({ data: [], has_more: false }), calls),
+      fetch: recordingFetch(jsonResponse({ object: "list", data: [], first_id: null, last_id: null, has_more: false }), calls),
     });
 
     await client.listTurns("session/one", {
@@ -2115,7 +2095,7 @@ describe("OpenAIAgentsClient", () => {
     const client = new OpenAIAgentsClient({ fetch: recordingFetch(new Response(null, { status: 202 }), calls) });
     const message: SessionInputEvent = {
       type: "agent.session.input.message",
-      input: [{ role: "user", content: [{ type: "input_text", text: "hello" }] }],
+      input: [{ role: "user", content: [{ type: "input_text", text: "hello" }, { type: "input_image", image_url: "https://example.test/a.png" }] }],
     };
     const cancel: SessionInputEvent = { type: "agent.session.input.cancel" };
 
@@ -2173,22 +2153,12 @@ describe("OpenAIAgentsClient", () => {
   it.each([
     { label: "non-array", events: {} },
     { label: "sparse", events: Array(1) },
-    { label: "65 events", events: Array.from({ length: 65 }, () => ({ type: "agent.session.input.cancel" })) },
     { label: "unknown variant", events: [{ type: "agent.session.input.future" }] },
     { label: "extra event field", events: [{ type: "agent.session.input.cancel", input: null }] },
-    { label: "empty message input", events: [{ type: "agent.session.input.message", input: [] }] },
     { label: "non-user message", events: [{
       type: "agent.session.input.message",
       input: [{ role: "assistant", content: [{ type: "input_text", text: "hello" }] }],
     }] },
-    { label: "empty text message", events: [{
-      type: "agent.session.input.message",
-      input: [{ role: "user", content: [{ type: "input_text", text: "" }] }],
-    }] },
-    { label: "all-empty text parts", events: [{
-      type: "agent.session.input.message",
-      input: [{ role: "user", content: [{ type: "input_text", text: "" }, { type: "input_text", text: "" }] }],
-    }] },
     { label: "sparse message content", events: [{
       type: "agent.session.input.message",
       input: [{ role: "user", content: Array(1) }],
@@ -2197,16 +2167,6 @@ describe("OpenAIAgentsClient", () => {
       type: "agent.session.input.message",
       input: [{ role: "user", content: [{ type: "input_text", text: "hello" }], name: "extra" }],
     }] },
-    { label: "message image", events: [{
-      type: "agent.session.input.message",
-      input: [{ role: "user", content: [{ type: "input_image", image_url: "https://example.test/a.png" }] }],
-    }] },
-    { label: "empty call id", events: [{
-      type: "agent.session.input.tool_result", call_id: "", turn_id: "turn", success: true,
-    }] },
-    { label: "empty turn id", events: [{
-      type: "agent.session.input.tool_result", call_id: "call", turn_id: "", success: true,
-    }] },
     { label: "non-boolean success", events: [{
       type: "agent.session.input.tool_result", call_id: "call", turn_id: "turn", success: "true",
     }] },
@@ -2232,33 +2192,6 @@ describe("OpenAIAgentsClient", () => {
     expect(calls).toHaveLength(0);
   });
 
-  it("enforces only Core's 1 MiB HTTP wire limit and leaves canonical internal sizing to Core", async () => {
-    const calls: FetchCall[] = [];
-    const client = new OpenAIAgentsClient({ fetch: recordingFetch(new Response(null, { status: 202 }), calls) });
-    const makeEvent = (text: string): SessionInputEvent => ({
-      type: "agent.session.input.message",
-      input: [{ role: "user", content: [{ type: "input_text", text }] }],
-    });
-    const emptyWireBytes = new TextEncoder().encode(JSON.stringify({ events: [makeEvent("")] })).length;
-    const exact = makeEvent("x".repeat(1024 * 1024 - emptyWireBytes));
-
-    await client.submitEvents("session", [exact], "exact-boundary");
-
-    expect(new TextEncoder().encode(String(calls[0]?.init?.body))).toHaveLength(1024 * 1024);
-    expect(() => client.submitEvents("session", [makeEvent(`${"x".repeat(1024 * 1024 - emptyWireBytes)}x`)], "over"))
-      .toThrow("Session input event request exceeds 1 MiB.");
-
-    const canonicalDifference = makeEvent("<>&/\u2028".repeat(80_000));
-    expect(new TextEncoder().encode(JSON.stringify({ events: [canonicalDifference] })).length).toBeGreaterThan(512 * 1024);
-    await client.submitEvents("session", [canonicalDifference], "core-canonicalizes");
-
-    const unicodeOversize = makeEvent("🙂".repeat(262_150));
-    expect(JSON.stringify({ events: [unicodeOversize] }).length).toBeLessThan(1024 * 1024);
-    expect(() => client.submitEvents("session", [unicodeOversize], "utf8-over"))
-      .toThrow("Session input event request exceeds 1 MiB.");
-    expect(calls).toHaveLength(2);
-  });
-
   it("sends whitespace-only message text verbatim, as Core admits it", async () => {
     const calls: FetchCall[] = [];
     const client = new OpenAIAgentsClient({ fetch: recordingFetch(new Response(null, { status: 202 }), calls) });
@@ -2334,24 +2267,6 @@ describe("OpenAIAgentsClient", () => {
       .toEqual([key, key]);
   });
 
-  it.each([
-    undefined,
-    "",
-    " \u0085 ",
-    "x".repeat(129),
-    "🙂".repeat(33),
-  ])("rejects invalid event-write idempotency key %j before fetch", (key) => {
-    const calls: FetchCall[] = [];
-    const client = new OpenAIAgentsClient({ fetch: recordingFetch(new Response(null, { status: 202 }), calls) });
-
-    expect(() => client.submitEvents(
-      "session",
-      [{ type: "agent.session.input.cancel" }],
-      key as unknown as string,
-    )).toThrow("Idempotency key must be non-blank and at most 128 UTF-8 bytes.");
-    expect(calls).toHaveLength(0);
-  });
-
   it("surfaces function result conflicts and target errors with their official fields", async () => {
     const input = { callId: "call", turnId: "turn", success: true, output: "value" };
     for (const [status, type, code, message] of [
diff --git a/packages/agents-client/src/client.ts b/packages/agents-client/src/client.ts
index 3a61a8c7d..aac1fd365 100644
--- a/packages/agents-client/src/client.ts
+++ b/packages/agents-client/src/client.ts
@@ -1,8 +1,30 @@
 import { coreHarnessKinds } from "./harness-catalog";
 import { projectEnvironmentInstallation } from "./installation-projection";
-import { exactFields, onlyFields, isRecord, hasOwn, canonicalUuid, isNonnegativeInteger, sameResourceId } from "./response-projection";
+import {
+  exactFields, onlyFields, schemaFields, variantFields, isOneOf, isRecord, hasOwn, canonicalUuid, isNonnegativeInteger, sameResourceId,
+  type FieldNames,
+} from "./response-projection";
+import {
+  agentsCoreFields, createVaultCredentialAuthParamStaticBearerFields, createVaultCredentialParamsFields,
+  deletedEnvironmentTemplateResourceFields, environmentParamNoneFields, environmentParamSelfHostedFields,
+  environmentParamSelfHostedRequired, deletedVaultCredentialResourceFields, deletedVaultResourceFields,
+  deleteFileResponseFields, environmentFileListResourceFields, environmentFileResourceFields, environmentResourceNoneFields,
+  environmentResourceSelfHostedFields, environmentStatusResourceValues, hostedEnvironmentFileParamFileIdFields,
+  hostedEnvironmentFileParamInlineFields, inputContentParamFields, inputMessageParamFields, inputMessageParamRequired,
+  listFilesResponseFields, multiAgentConfigResourceFields, openAIFileFields, publicEnvironmentResourceFields,
+  reasoningEffortResourceValues, reasoningResourceFields, rotateVaultCredentialAuthParamStaticBearerFields,
+  rotateVaultCredentialParamsFields, reasoningSummaryResourceValues, savedAgentCoreFields,
+  serviceTierResourceValues, sessionAgentResourceFields, sessionAgentResourceRequired, sessionCoreFields,
+  sessionEnvironmentErrorResourceFields, sessionEnvironmentStateResourceFields, sessionErrorResourceFields,
+  sessionEventAgentSessionCreatedFields, sessionEventErrorFields, sessionEventFields,
+  sessionInputParamAgentSessionInputCancelFields, sessionInputParamAgentSessionInputMessageFields,
+  sessionInputParamAgentSessionInputToolResultFields, sessionInputParamAgentSessionInputToolResultRequired,
+  sessionRequiredActionResourceFields, sessionResourceFields, sessionResourceRequired, sessionStatusResourceValues,
+  textFormatResourceFields, textResourceFields, vaultCredentialResourceFields, vaultListResourceFields, vaultResourceFields,
+  verbosityResourceValues,
+} from "./generated/public-api";
 import { projectTokenUsage } from "./usage-projection";
-import { projectAgentTurn, projectSessionItem, projectItemContent, projectHistoryPage, validateHistoryPageOptions } from "./history-projection";
+import { projectAgentTurn, projectSessionItem, projectItemContent, projectHistoryPage } from "./history-projection";
 import { projectOpenAIHostedSessionEnvironment } from "./session-environment-projection";
 import { safeProvider } from "./execution-configuration-projection";
 import { createSSEDecoder } from "./sse";
@@ -67,7 +89,6 @@ import type {
   SessionEvent,
   SessionListOptions,
   SessionInputEvent,
-  SessionMessageInputEvent,
   SessionToolResultInputEvent,
   SessionItem,
   SourceFile,
@@ -99,7 +120,6 @@ import type {
   VaultDeleted,
   VaultList,
   VaultListOptions,
-  EnvironmentResourceStatus,
 } from "./types";
 
 export interface OpenAIAgentsClientOptions {
@@ -190,16 +210,6 @@ export function createIdempotencyKey(): string {
   return `web-${Date.now()}-${Math.random().toString(16).slice(2)}`;
 }
 
-function requireIdempotencyKey(value: unknown): asserts value is string {
-  if (
-    typeof value !== "string" ||
-    goWhitespaceOnlyPattern.test(value) ||
-    new TextEncoder().encode(value).length > 128
-  ) {
-    throw new TypeError("Idempotency key must be non-blank and at most 128 UTF-8 bytes.");
-  }
-}
-
 function addPageOptions(params: URLSearchParams, options?: PageOptions): void {
   if (options?.after) params.set("after", options.after);
   if (options?.limit !== undefined) params.set("limit", String(options.limit));
@@ -207,21 +217,10 @@ function addPageOptions(params: URLSearchParams, options?: PageOptions): void {
 }
 
 export function addVaultPageOptions(params: URLSearchParams, options?: VaultListOptions): void {
-  if (options?.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100)) {
-    throw new TypeError("Vault list limit must be an integer from 1 through 100.");
-  }
-  if (options?.order !== undefined && options.order !== "asc" && options.order !== "desc") {
-    throw new TypeError("Vault list order must be asc or desc.");
-  }
   addPageOptions(params, options);
-  if (options?.status === undefined) return;
-  const statuses = Array.isArray(options.status) ? options.status : [options.status];
-  if (statuses.length === 0 || statuses.some((status) => status !== "active" && status !== "archived")) {
-    throw new TypeError("Vault status must be active, archived, or a non-empty array of those values.");
-  }
-  if (Array.isArray(options.status)) {
-    statuses.forEach((status) => params.append("status[]", status));
-  } else {
+  if (Array.isArray(options?.status)) {
+    options.status.forEach((status) => params.append("status[]", status));
+  } else if (options?.status !== undefined) {
     params.set("status", options.status);
   }
 }
@@ -231,78 +230,13 @@ function withQuery(path: string, params: URLSearchParams): string {
   return query ? `${path}?${query}` : path;
 }
 
-const environmentResourceFields = new Set(["id", "object", "type", "status", "files", "plugins", "skills"]);
-const environmentFileFields = new Set(["environment_id", "object", "path", "size_bytes"]);
-const environmentFileListFields = new Set(["object", "data", "next", "has_more"]);
-const sourceFileFields = new Set([
-  "id", "object", "bytes", "created_at", "filename", "purpose", "status", "expires_at", "status_details",
-]);
-const sourceFileDeletedFields = new Set(["id", "object", "deleted"]);
 const canonicalUuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const sourceFileIdPattern = /^file-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// Bounds the download buffer a Content-Length header can make the client allocate.
 const maxSourceFileBytes = 512 * 1024 * 1024;
-const maxEnvironmentFileBytes = 50 * 1024 * 1024;
-// Core applies the official 5 MiB decoded bound to inline data; file_id copies keep 50 MiB.
-const maxInlineEnvironmentFileBytes = 5 * 1024 * 1024;
-const sourceFileListFields = new Set(["object", "data", "has_more", "first_id", "last_id"]);
-// Core's Files list bound; it defaults to its maximum.
+// Core's default Files page size, which binds a page listed without a limit.
 const maxSourceFileListLimit = 10000;
-const environmentTemplateDeletedFields = new Set(["id", "object", "deleted"]);
-const vaultFields = new Set(["id", "object", "created_at", "name", "metadata"]);
-const vaultListFields = new Set(["object", "data", "has_more", "first_id", "last_id"]);
-const vaultDeletedFields = new Set(["id", "object", "deleted"]);
-const vaultCredentialFields = new Set(["id", "vault_id", "name", "object", "auth", "created_at", "updated_at"]);
-const vaultCredentialDeletedFields = new Set(["id", "object", "deleted"]);
-const sessionFields = new Set([
-  "id", "object", "agent", "environment", "status", "error", "metadata",
-  "required_actions", "vault_ids", "usage", "created_at", "last_active_at",
-]);
-const agentSnapshotFields = new Set([
-  "id", "model", "name", "instructions", "multi_agent", "reasoning",
-  "service_tier", "text", "tools",
-]);
-const agentSnapshotAcceptedFields = new Set([...agentSnapshotFields, "x_agents_core"]);
-const sessionAgentCoreFields = new Set(["harness", "harness_config"]);
-const savedAgentCoreFields = new Set(["harness", "model_provider", "harness_config"]);
-const multiAgentFields = new Set(["enabled", "max_concurrent_subagents"]);
-const reasoningFields = new Set(["effort", "summary"]);
-const textFields = new Set(["format", "verbosity"]);
-const sessionStatuses = new Set(["idle", "in_progress", "requires_action", "failed"]);
-const serviceTiers = new Set(["auto", "default", "flex", "priority", "fast"]);
-const reasoningEfforts = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max"]);
-const reasoningSummaries = new Set(["concise", "detailed", "auto"]);
-const sessionMessageEventFields = new Set(["type", "input"]);
-const sessionCancelEventFields = new Set(["type"]);
-const sessionToolResultEventFields = new Set(["type", "call_id", "turn_id", "success", "output", "error"]);
-const inputMessageFields = new Set(["type", "role", "content"]);
-const inputTextFields = new Set(["type", "text"]);
-const inputImageFields = new Set(["type", "image_url"]);
-const maxSessionInputEvents = 64;
-const maxSessionInputRequestBytes = 1024 * 1024;
-const goWhitespaceOnlyPattern = /^[\u0009-\u000d\u0020\u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]*$/u;
-const streamErrorFields = new Set(["code", "type", "message"]);
-// Error events carry the pinned SessionError, whose param is null when unset.
-const sessionErrorFields = new Set([...streamErrorFields, "param"]);
-const environmentStateFields = new Set(["id", "type", "status", "error"]);
-const snapshotEventFields = new Set(["type", "event_id", "session_id", "session"]);
-const turnEventFields = new Set(["type", "event_id", "session_id", "turn_id", "turn"]);
-// Terminal Turn events also carry top-level usage mirroring the Turn snapshot.
-const terminalTurnEventFields = new Set([...turnEventFields, "usage"]);
-const terminalTurnEventTypes = new Set([
-  "agent.session.turn.completed", "agent.session.turn.failed", "agent.session.turn.cancelled",
-]);
-const itemEventFields = new Set(["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "item"]);
-const contentPartEventFields = new Set([
-  "type", "event_id", "session_id", "turn_id", "item_id", "output_index", "content_index", "part",
-]);
-const outputTextEventBaseFields = [
-  "type", "event_id", "session_id", "turn_id", "item_id", "output_index", "content_index",
-] as const;
-const commandDeltaEventFields = new Set([
-  "type", "event_id", "session_id", "turn_id", "item_id", "output_index", "delta",
-]);
-const environmentEventFields = new Set(["type", "event_id", "session_id", "environment"]);
-const errorEventFields = new Set(["type", "event_id", "session_id", "error"]);
+// An unknown event never carries a field whose meaning a projected event defines.
 const unsafeUnknownEventFields = new Set([
   "session", "turn", "turn_id", "item", "item_id", "output_index", "content_index", "part", "delta", "text", "error", "environment",
 ]);
@@ -319,86 +253,45 @@ const runtimeObservationReasons = new Set([
 ]);
 const runtimeProviderTypePattern = /^[a-z][a-z0-9_]{0,31}$/;
 const runtimeLifecycleStates = new Set(["active", "sleeping", "transitioning", "pending", "stopped"]);
-function utf8Length(value: string): number {
-  return new TextEncoder().encode(value).length;
+function invalidSessionInputBatch(): never {
+  throw new TypeError("Invalid Session input event batch.");
 }
 
-function invalidSessionInputBatch(message = "Invalid Session input event batch."): never {
-  throw new TypeError(message);
+function canonicalInputContent(part: unknown): FunctionResultContent {
+  if (!isRecord(part)) return invalidSessionInputBatch();
+  const fields = variantFields(inputContentParamFields, part.type);
+  if (!fields || !exactFields(part, fields)) return invalidSessionInputBatch();
+  if (part.type === "input_text" && typeof part.text === "string") return { type: "input_text", text: part.text };
+  if (part.type === "input_image" && typeof part.image_url === "string") return { type: "input_image", image_url: part.image_url };
+  return invalidSessionInputBatch();
 }
 
 function canonicalInputMessage(value: unknown): InputMessage {
   if (
-    !isRecord(value) || !onlyFields(value, inputMessageFields) ||
-    !hasOwn(value, "role") || !hasOwn(value, "content") ||
-    value.role !== "user" || !Array.isArray(value.content) || value.content.length === 0 ||
-    (hasOwn(value, "type") && value.type !== "message")
+    !isRecord(value) || !schemaFields(value, inputMessageParamFields, inputMessageParamRequired) ||
+    value.role !== "user" || !Array.isArray(value.content) || (hasOwn(value, "type") && value.type !== "message")
   ) {
     return invalidSessionInputBatch();
   }
-  let text = "";
-  const content = Array.from(value.content, (part) => {
-    if (
-      !isRecord(part) || !exactFields(part, inputTextFields) ||
-      part.type !== "input_text" || typeof part.text !== "string"
-    ) {
-      return invalidSessionInputBatch();
-    }
-    text += part.text;
-    return { type: "input_text" as const, text: part.text };
-  });
-  // Core admits whitespace-only text verbatim; only all-empty text rejects.
-  if (text === "") return invalidSessionInputBatch();
-  return hasOwn(value, "type")
-    ? { type: "message", role: "user", content }
-    : { role: "user", content };
-}
-
-function canonicalFunctionOutput(value: unknown): string | FunctionResultContent[] | null {
-  if (value === null || typeof value === "string") return value;
-  if (!Array.isArray(value)) return invalidSessionInputBatch();
-  return Array.from(value, (part) => {
-    if (!isRecord(part)) return invalidSessionInputBatch();
-    if (part.type === "input_text") {
-      if (!exactFields(part, inputTextFields) || typeof part.text !== "string") {
-        return invalidSessionInputBatch();
-      }
-      return { type: "input_text" as const, text: part.text };
-    }
-    if (part.type === "input_image") {
-      if (!exactFields(part, inputImageFields) || typeof part.image_url !== "string") {
-        return invalidSessionInputBatch();
-      }
-      return { type: "input_image" as const, image_url: part.image_url };
-    }
-    return invalidSessionInputBatch();
-  });
+  const content = Array.from(value.content, canonicalInputContent);
+  return hasOwn(value, "type") ? { type: "message", role: "user", content } : { role: "user", content };
 }
 
 function canonicalSessionInputEvent(value: unknown): SessionInputEvent {
-  if (!isRecord(value) || !hasOwn(value, "type") || typeof value.type !== "string") {
-    return invalidSessionInputBatch();
-  }
+  if (!isRecord(value)) return invalidSessionInputBatch();
   switch (value.type) {
-    case "agent.session.input.message": {
-      if (!exactFields(value, sessionMessageEventFields) || !Array.isArray(value.input) || value.input.length === 0) {
+    case "agent.session.input.message":
+      if (!exactFields(value, sessionInputParamAgentSessionInputMessageFields) || !Array.isArray(value.input)) {
         return invalidSessionInputBatch();
       }
-      return {
-        type: "agent.session.input.message",
-        input: Array.from(value.input, canonicalInputMessage),
-      } satisfies SessionMessageInputEvent;
-    }
+      return { type: "agent.session.input.message", input: Array.from(value.input, canonicalInputMessage) };
     case "agent.session.input.cancel":
-      if (!exactFields(value, sessionCancelEventFields)) return invalidSessionInputBatch();
+      if (!exactFields(value, sessionInputParamAgentSessionInputCancelFields)) return invalidSessionInputBatch();
       return { type: "agent.session.input.cancel" };
     case "agent.session.input.tool_result": {
       if (
-        !onlyFields(value, sessionToolResultEventFields) ||
-        !hasOwn(value, "call_id") || !hasOwn(value, "turn_id") || !hasOwn(value, "success") ||
-        typeof value.call_id !== "string" || value.call_id.length === 0 ||
-        typeof value.turn_id !== "string" || value.turn_id.length === 0 ||
-        typeof value.success !== "boolean" ||
+        !schemaFields(value, sessionInputParamAgentSessionInputToolResultFields, sessionInputParamAgentSessionInputToolResultRequired) ||
+        typeof value.call_id !== "string" || typeof value.turn_id !== "string" || typeof value.success !== "boolean" ||
         (hasOwn(value, "error") && value.error !== null && typeof value.error !== "string")
       ) {
         return invalidSessionInputBatch();
@@ -409,7 +302,11 @@ function canonicalSessionInputEvent(value: unknown): SessionInputEvent {
         turn_id: value.turn_id,
         success: value.success,
       };
-      if (hasOwn(value, "output")) event.output = canonicalFunctionOutput(value.output);
+      if (hasOwn(value, "output")) {
+        const output = value.output;
+        if (output !== null && typeof output !== "string" && !Array.isArray(output)) return invalidSessionInputBatch();
+        event.output = Array.isArray(output) ? Array.from(output, canonicalInputContent) : output;
+      }
       if (hasOwn(value, "error")) event.error = value.error as string | null;
       return event;
     }
@@ -419,22 +316,12 @@ function canonicalSessionInputEvent(value: unknown): SessionInputEvent {
 }
 
 function encodeSessionInputBatch(events: readonly SessionInputEvent[]): string {
-  if (!Array.isArray(events) || events.length > maxSessionInputEvents) {
-    return invalidSessionInputBatch("Session input event batch must contain at most 64 events.");
-  }
-  const body = JSON.stringify({ events: Array.from(events, canonicalSessionInputEvent) });
-  // Core's HTTP handler bounds the complete wire request at 1 MiB. Its separate
-  // 512 KiB internal limit is measured after Go decodes, reshapes and canonically
-  // re-encodes individual payloads, so approximating it from browser JSON would
-  // reject valid wire requests (notably around Go's HTML and U+2028 escaping).
-  if (utf8Length(body) > maxSessionInputRequestBytes) {
-    return invalidSessionInputBatch("Session input event request exceeds 1 MiB.");
-  }
-  return body;
+  if (!Array.isArray(events)) return invalidSessionInputBatch();
+  return JSON.stringify({ events: Array.from(events, canonicalSessionInputEvent) });
 }
 
 function isTrimmedName(value: unknown): value is string {
-  return typeof value === "string" && value === value.trim() && utf8Length(value) >= 1 && utf8Length(value) <= 256;
+  return typeof value === "string" && value !== "" && value === value.trim();
 }
 
 function validMetadata(value: unknown): value is Record<string, string> {
@@ -457,7 +344,7 @@ function invalidVaultResponse(code: string, message: string): never {
 }
 
 export function projectVault(value: unknown, expectedId?: string): Vault {
-  if (!isRecord(value) || !exactFields(value, vaultFields)) {
+  if (!isRecord(value) || !exactFields(value, vaultResourceFields)) {
     return invalidVaultResponse("invalid_vault_resource", "OpenAgentCore returned an invalid Vault resource.");
   }
   if (
@@ -484,7 +371,7 @@ export function projectVaultCredential(
   expectedVaultId: string,
   expectedCredentialId?: string,
 ): VaultCredential {
-  if (!isRecord(value) || !exactFields(value, vaultCredentialFields) || !isRecord(value.auth)) {
+  if (!isRecord(value) || !exactFields(value, vaultCredentialResourceFields) || !isRecord(value.auth)) {
     return invalidVaultResponse("invalid_vault_credential", "OpenAgentCore returned invalid Credential metadata.");
   }
   if (
@@ -526,14 +413,11 @@ function projectVaultPage<T extends { id: string; created_at: number }>(
   code: string,
   message: string,
 ): { object: "list"; data: T[]; has_more: boolean; first_id: string | null; last_id: string | null } {
-  if (!isRecord(value) || !exactFields(value, vaultListFields) || value.object !== "list" || !Array.isArray(value.data) || typeof value.has_more !== "boolean") {
+  if (!isRecord(value) || !exactFields(value, vaultListResourceFields) || value.object !== "list" || !Array.isArray(value.data) || typeof value.has_more !== "boolean") {
     return invalidVaultResponse(code, message);
   }
-  const limit = options?.limit ?? 20;
   const order = options?.order ?? "desc";
-  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100 || (order !== "asc" && order !== "desc") || value.data.length > limit) {
-    return invalidVaultResponse(code, message);
-  }
+  if (value.data.length > (options?.limit ?? 20)) return invalidVaultResponse(code, message);
   const data = value.data.map(project);
   const ids = new Set(data.map((entry) => entry.id));
   const firstId = data[0]?.id ?? null;
@@ -569,7 +453,7 @@ function projectDeletedResource<T extends VaultDeleted | VaultCredentialDeleted>
   value: unknown,
   expectedId: string,
   object: T["object"],
-  fields: Set<string>,
+  fields: FieldNames,
   code: string,
 ): T {
   if (!isRecord(value) || !exactFields(value, fields) || !sameUuid(value.id, expectedId) || value.object !== object || value.deleted !== true) {
@@ -608,7 +492,7 @@ type AgentConfiguration<Core> = Omit<AgentSnapshot, "x_agents_core"> & { x_agent
 /** A Session's effective Agent preserves its explicit native selections. */
 function projectSessionAgentCore(value: unknown): AgentsCoreSelection | null | undefined {
   if (value === undefined || value === null) return value;
-  if (!isRecord(value) || !onlyFields(value, sessionAgentCoreFields) ||
+  if (!isRecord(value) || !onlyFields(value, agentsCoreFields) ||
     (hasOwn(value, "harness") && !isHarnessKind(value.harness)) ||
     (hasOwn(value, "harness_config") && !isRecord(value.harness_config))) {
     return invalidSessionResource();
@@ -652,10 +536,9 @@ function projectAgentConfiguration<Core>(
   value: unknown,
   projectCore: (value: unknown) => Core | null | undefined,
 ): AgentConfiguration<Core> {
-  if (
-    !isRecord(value) || !onlyFields(value, agentSnapshotAcceptedFields) ||
-    [...agentSnapshotFields].some((field) => !hasOwn(value, field))
-  ) return invalidSessionResource();
+  if (!isRecord(value) || !schemaFields(value, sessionAgentResourceFields, sessionAgentResourceRequired)) {
+    return invalidSessionResource();
+  }
   const agentsCore = projectCore(value.x_agents_core);
   const multiAgent = value.multi_agent;
   const reasoning = value.reasoning;
@@ -665,26 +548,23 @@ function projectAgentConfiguration<Core>(
     typeof value.model !== "string" || value.model.trim() === "" ||
     !(value.name === null || typeof value.name === "string") ||
     !(value.instructions === null || typeof value.instructions === "string") ||
-    !isRecord(multiAgent) || !exactFields(multiAgent, multiAgentFields) ||
+    !isRecord(multiAgent) || !exactFields(multiAgent, multiAgentConfigResourceFields) ||
     typeof multiAgent.enabled !== "boolean" ||
     !(multiAgent.max_concurrent_subagents === null ||
       (Number.isSafeInteger(multiAgent.max_concurrent_subagents) && Number(multiAgent.max_concurrent_subagents) > 0)) ||
-    !isRecord(reasoning) || !onlyFields(reasoning, reasoningFields) ||
-    !(reasoning.effort === undefined || reasoning.effort === null || reasoningEfforts.has(String(reasoning.effort))) ||
-    !(reasoning.summary === undefined || reasoning.summary === null || reasoningSummaries.has(String(reasoning.summary))) ||
-    !serviceTiers.has(String(value.service_tier)) ||
-    !isRecord(text) || !exactFields(text, textFields) ||
-    (text.verbosity !== "low" && text.verbosity !== "medium" && text.verbosity !== "high") ||
+    !isRecord(reasoning) || !exactFields(reasoning, reasoningResourceFields) ||
+    !(reasoning.effort === null || isOneOf(reasoningEffortResourceValues, reasoning.effort)) ||
+    !(reasoning.summary === null || isOneOf(reasoningSummaryResourceValues, reasoning.summary)) ||
+    !isOneOf(serviceTierResourceValues, value.service_tier) ||
+    !isRecord(text) || !exactFields(text, textResourceFields) || !isOneOf(verbosityResourceValues, text.verbosity) ||
     !isRecord(text.format) || !Array.isArray(value.tools)
   ) return invalidSessionResource();
 
   const format = text.format;
-  if (
-    (format.type === "text" && !exactFields(format, new Set(["type"]))) ||
-    (format.type === "json_schema" &&
-      (!exactFields(format, new Set(["type", "schema"])) || !isRecord(format.schema))) ||
-    (format.type !== "text" && format.type !== "json_schema")
-  ) return invalidSessionResource();
+  const formatFields = variantFields(textFormatResourceFields, format.type);
+  if (!formatFields || !exactFields(format, formatFields) || (format.type === "json_schema" && !isRecord(format.schema))) {
+    return invalidSessionResource();
+  }
 
   return {
     id: value.id,
@@ -696,8 +576,8 @@ function projectAgentConfiguration<Core>(
       enabled: multiAgent.enabled,
       max_concurrent_subagents: multiAgent.max_concurrent_subagents as number | null,
     },
-    reasoning: { ...reasoning } as AgentSession["agent"]["reasoning"],
-    service_tier: value.service_tier as AgentSession["agent"]["service_tier"],
+    reasoning: { effort: reasoning.effort, summary: reasoning.summary },
+    service_tier: value.service_tier,
     text: {
       format: format.type === "text"
         ? { type: "text" }
@@ -713,12 +593,12 @@ function projectSessionEnvironment(value: unknown): AgentSession["environment"]
     return invalidSessionResource();
   }
   if (value.type === "none") {
-    if (!exactFields(value, new Set(["type"]))) return invalidSessionResource();
+    if (!exactFields(value, environmentResourceNoneFields)) return invalidSessionResource();
     return { type: "none" };
   }
   if (value.type === "self_hosted") {
     if (
-      !exactFields(value, new Set(["type", "id", "remote_url", "workspace_directory", "capability_directories"])) ||
+      !exactFields(value, environmentResourceSelfHostedFields) ||
       typeof value.id !== "string" || value.id.trim() === "" ||
       typeof value.remote_url !== "string" || value.remote_url.trim() === "" ||
       typeof value.workspace_directory !== "string" || value.workspace_directory.trim() === "" ||
@@ -756,15 +636,14 @@ function normalizeCreationEnvironment(value: AgentEnvironmentInput): ExpectedCre
     throw new TypeError("Session creation requires a supported Environment.");
   }
   if (value.type === "none") {
-    if (!exactFields(value, new Set(["type"]))) {
+    if (!exactFields(value, environmentParamNoneFields)) {
       throw new TypeError("The none Environment accepts no additional fields.");
     }
     return { type: "none" };
   }
   if (value.type === "self_hosted") {
     if (
-      !onlyFields(value, new Set(["type", "workspace_directory", "capability_directories"])) ||
-      !hasOwn(value, "workspace_directory") ||
+      !schemaFields(value, environmentParamSelfHostedFields, environmentParamSelfHostedRequired) ||
       typeof value.workspace_directory !== "string" || value.workspace_directory.trim() === "" ||
       !(value.capability_directories === undefined || value.capability_directories === null ||
         (Array.isArray(value.capability_directories) &&
@@ -781,6 +660,7 @@ function normalizeCreationEnvironment(value: AgentEnvironmentInput): ExpectedCre
     };
   }
   if (value.type === "openai_hosted") {
+    // The client supports only the network mode and Template reference of the schema's hosted fields.
     if (
       !onlyFields(value, new Set(["type", "network", "environment_template_id"])) ||
       !(value.network === undefined || value.network === null || (
@@ -871,10 +751,10 @@ function matchesImmutableSession(
 function projectRequiredActions(value: unknown): AgentSession["required_actions"] {
   if (!Array.isArray(value)) return invalidSessionResource();
   return value.map((entry) => {
-    if (!isRecord(entry) || typeof entry.type !== "string") return invalidSessionResource();
+    const fields = isRecord(entry) ? variantFields(sessionRequiredActionResourceFields, entry.type) : undefined;
+    if (!isRecord(entry) || !fields || !exactFields(entry, fields)) return invalidSessionResource();
     if (entry.type === "function_call") {
       if (
-        !exactFields(entry, new Set(["type", "call_id", "turn_id", "name", "arguments"])) ||
         typeof entry.call_id !== "string" || entry.call_id === "" ||
         typeof entry.turn_id !== "string" || entry.turn_id === "" ||
         typeof entry.name !== "string" || entry.name === ""
@@ -887,14 +767,8 @@ function projectRequiredActions(value: unknown): AgentSession["required_actions"
         arguments: entry.arguments,
       };
     }
-    if (entry.type === "environment_connection") {
-      if (
-        !exactFields(entry, new Set(["type", "environment_id"])) ||
-        typeof entry.environment_id !== "string" || entry.environment_id === ""
-      ) return invalidSessionResource();
-      return { type: "environment_connection" as const, environment_id: entry.environment_id };
-    }
-    return invalidSessionResource();
+    if (typeof entry.environment_id !== "string" || entry.environment_id === "") return invalidSessionResource();
+    return { type: "environment_connection" as const, environment_id: entry.environment_id };
   });
 }
 
@@ -905,18 +779,21 @@ export function projectAgentSession(
   expectedEnvironment?: ExpectedCreationEnvironment,
   expectedImmutable?: ImmutableSessionProjection,
 ): AgentSession {
-  if (!isRecord(value) || !exactFields(Object.fromEntries(Object.entries(value).filter(([key]) => key !== "x_agents_core")), sessionFields)) return invalidSessionResource();
+  if (!isRecord(value) || !schemaFields(value, sessionResourceFields, sessionResourceRequired)) return invalidSessionResource();
   let installation;
-  if (value.x_agents_core !== undefined) {
-    if (!isRecord(value.x_agents_core) || !exactFields(value.x_agents_core, new Set(["installation"]))) return invalidSessionResource();
-    installation = projectEnvironmentInstallation(value.x_agents_core.installation);
-    if (!installation) return invalidSessionResource();
+  const core = value.x_agents_core;
+  if (core !== undefined && core !== null) {
+    if (!isRecord(core) || !onlyFields(core, sessionCoreFields)) return invalidSessionResource();
+    if (hasOwn(core, "installation")) {
+      installation = projectEnvironmentInstallation(core.installation);
+      if (!installation) return invalidSessionResource();
+    }
   }
   if (
     typeof value.id !== "string" || value.id.trim() === "" ||
     (expectedSessionId !== undefined && !sameResourceId(value.id, expectedSessionId)) ||
     value.object !== "agent.session" ||
-    !sessionStatuses.has(String(value.status)) ||
+    !isOneOf(sessionStatusResourceValues, value.status) ||
     !(value.error === null || typeof value.error === "string") ||
     !validMetadata(value.metadata) ||
     !isNonnegativeInteger(value.created_at) ||
@@ -1121,18 +998,15 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
 
 function projectStreamError(value: unknown): StreamError {
   if (
-    !isRecord(value) || !onlyFields(value, sessionErrorFields) ||
-    typeof value.code !== "string" || value.code === "" ||
-    typeof value.type !== "string" || value.type === "" ||
-    typeof value.message !== "string" ||
-    !(value.param === undefined || value.param === null || typeof value.param === "string")
+    !isRecord(value) || !exactFields(value, sessionErrorResourceFields) ||
+    !(value.code === null || nonemptyString(value.code)) || !nonemptyString(value.type) ||
+    typeof value.message !== "string" || !(value.param === null || typeof value.param === "string")
   ) return invalidStreamEvent();
-  return {
-    code: value.code,
-    type: value.type,
-    message: value.message,
-    ...(value.param === undefined ? {} : { param: value.param as string | null }),
-  };
+  return { code: value.code, type: value.type, message: value.message, param: value.param };
+}
+
+function nonemptyString(value: unknown): value is string {
+  return typeof value === "string" && value !== "";
 }
 
 function requiredEventString(event: Record<string, unknown>, field: string, allowEmpty = false): string {
@@ -1141,15 +1015,13 @@ function requiredEventString(event: Record<string, unknown>, field: string, allo
   return value;
 }
 
-function optionalEventIndex(event: Record<string, unknown>, field: string, required = false): number | undefined {
+function eventIndex(event: Record<string, unknown>, field: string): number {
   const value = event[field];
-  if (value === undefined && !required) return undefined;
   if (!isNonnegativeInteger(value)) return invalidStreamEvent();
   return value;
 }
 
-function eventSessionId(event: Record<string, unknown>, expectedSessionId: string, required: boolean): string | undefined {
-  if (event.session_id === undefined && !required) return undefined;
+function eventSessionId(event: Record<string, unknown>, expectedSessionId: string): string {
   if (typeof event.session_id !== "string" || !sameResourceId(event.session_id, expectedSessionId)) {
     return invalidStreamEvent("OpenAgentCore returned an event for a different Session.");
   }
@@ -1157,17 +1029,18 @@ function eventSessionId(event: Record<string, unknown>, expectedSessionId: strin
 }
 
 function projectEnvironmentState(value: unknown, status: string): AgentSessionEnvironmentEvent["environment"] {
+  const error = isRecord(value) ? value.error : undefined;
   if (
-    !isRecord(value) || !onlyFields(value, environmentStateFields) ||
-    typeof value.id !== "string" || value.id === "" ||
-    typeof value.type !== "string" || value.type === "" || value.status !== status ||
-    !(value.error === undefined || value.error === null || isRecord(value.error))
+    !isRecord(value) || !exactFields(value, sessionEnvironmentStateResourceFields) ||
+    !nonemptyString(value.id) || !nonemptyString(value.type) || value.status !== status ||
+    !(error === null || (isRecord(error) && exactFields(error, sessionEnvironmentErrorResourceFields) &&
+      nonemptyString(error.code) && nonemptyString(error.type) && typeof error.message === "string"))
   ) return invalidStreamEvent();
   return {
     id: value.id,
     type: value.type,
     status: value.status as AgentSessionEnvironmentEvent["environment"]["status"],
-    error: value.error === undefined || value.error === null ? null : projectStreamError(value.error),
+    error: error === null ? null : { code: error.code as string, type: error.type as string, message: error.message as string },
   };
 }
 
@@ -1206,165 +1079,107 @@ function projectCreatedSessionEvent(
   expectedEnvironment: ExpectedCreationEnvironment,
 ): { event: SessionEvent; session: AgentSession } {
   const value = event as unknown as Record<string, unknown>;
-  if (event.type !== "agent.session.created" || !onlyFields(value, snapshotEventFields) || event.session === undefined) {
+  if (event.type !== "agent.session.created" || !exactFields(value, sessionEventAgentSessionCreatedFields)) {
     return invalidStreamEvent("OpenAgentCore did not begin Session creation with a created Session snapshot.");
   }
-  const session = projectAgentSession(event.session, expectedVaultIds, undefined, expectedEnvironment);
-  const sessionId = eventSessionId(value, session.id, false);
-  return {
-    event: {
-      type: "agent.session.created",
-      event_id: event.event_id,
-      ...(sessionId === undefined ? {} : { session_id: sessionId }),
-      session,
-    },
-    session,
-  };
+  const session = projectAgentSession(value.session, expectedVaultIds, undefined, expectedEnvironment);
+  return { event: { type: "agent.session.created", event_id: event.event_id, session }, session };
 }
 
+// Subagent and reasoning summary events are not projected yet; they pass through as unknown events.
+const unprojectedEventPattern = /^agent\.session\.(subagent\.|turn\.reasoning_summary_)/;
+
+const sessionStatusesByEvent: Readonly<Record<string, AgentSession["status"]>> = {
+  "agent.session.in_progress": "in_progress",
+  "agent.session.requires_action": "requires_action",
+  "agent.session.idle": "idle",
+  "agent.session.failed": "failed",
+};
+
+const turnStatusByEvent: Readonly<Record<string, AgentTurn["status"]>> = {
+  "agent.session.turn.created": "queued",
+  "agent.session.turn.in_progress": "in_progress",
+  "agent.session.turn.completed": "completed",
+  "agent.session.turn.failed": "failed",
+  "agent.session.turn.cancelled": "cancelled",
+};
+
 function projectStreamEventSession(
   event: SessionEvent,
   expectedSessionId: string,
   immutable?: ImmutableSessionProjection,
 ): SessionEvent {
   const value = event as unknown as Record<string, unknown>;
+  const fields = variantFields(sessionEventFields, event.type);
   const base = { type: event.type, event_id: event.event_id };
-  const sessionStatusesByEvent: Record<string, AgentSession["status"]> = {
-    "agent.session.in_progress": "in_progress",
-    "agent.session.requires_action": "requires_action",
-    "agent.session.idle": "idle",
-    "agent.session.failed": "failed",
-  };
+  if (!fields || unprojectedEventPattern.test(event.type)) return projectUnknownStreamEvent(value, expectedSessionId);
+  if (!exactFields(value, fields)) return invalidStreamEvent();
+
   if (event.type === "agent.session.created" || hasOwn(sessionStatusesByEvent, event.type)) {
-    if (!onlyFields(value, snapshotEventFields) || event.session === undefined) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, false);
-    const session = projectAgentSession(event.session, undefined, expectedSessionId, undefined, immutable);
+    const session = projectAgentSession(value.session, undefined, expectedSessionId, undefined, immutable);
     if (event.type !== "agent.session.created" && session.status !== sessionStatusesByEvent[event.type]) {
       return invalidStreamEvent();
     }
-    return { ...base, ...(sessionId === undefined ? {} : { session_id: sessionId }), session } as SessionEvent;
+    return { ...base, session } as SessionEvent;
   }
 
-  const turnStatusByEvent: Record<string, AgentTurn["status"]> = {
-    "agent.session.turn.created": "queued",
-    "agent.session.turn.in_progress": "in_progress",
-    "agent.session.turn.waiting": "waiting",
-    "agent.session.turn.completed": "completed",
-    "agent.session.turn.failed": "failed",
-    "agent.session.turn.cancelled": "cancelled",
-  };
-  if (hasOwn(turnStatusByEvent, event.type)) {
-    // Older Core releases omit terminal usage; no other Turn event may carry it.
-    const withUsage = terminalTurnEventTypes.has(event.type) && hasOwn(value, "usage");
-    if (!exactFields(value, withUsage ? terminalTurnEventFields : turnEventFields) || event.turn === undefined) {
-      return invalidStreamEvent();
-    }
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    const turnId = requiredEventString(value, "turn_id");
-    const turn = projectAgentTurn(event.turn, expectedSessionId, invalidStreamEvent);
-    const usage = withUsage ? { usage: projectTokenUsage(value.usage, invalidStreamEvent) } : {};
+  // Core puts Environment events outside any Turn, so their turn_id is null.
+  if (event.type.startsWith("agent.session.environment.")) {
+    const environment = projectEnvironmentState(value.environment, event.type.slice("agent.session.environment.".length));
     if (
-      !sameResourceId(turn.id, turnId) ||
-      // Core no longer streams child Turns. Earlier releases did, and native child
-      // history could first appear there as a completed created snapshot.
-      (!(event.type === "agent.session.turn.created" && turn.subagent_id != null) && turn.status !== turnStatusByEvent[event.type]) ||
-      (immutable !== undefined && turn.subagent_id == null && !sameResourceId(turn.agent_id, immutable.agent.id))
+      value.turn_id !== null ||
+      (immutable !== undefined &&
+        (immutable.environment.type === "none" ||
+          immutable.environment.type !== environment.type ||
+          !("id" in immutable.environment) ||
+          typeof immutable.environment.id !== "string" ||
+          !sameResourceId(immutable.environment.id, environment.id)))
     ) return invalidStreamEvent();
-    return { ...base, session_id: sessionId, turn_id: turnId, turn, ...usage } as SessionEvent;
-  }
-
-  if (event.type === "agent.session.turn.item.added" || event.type === "agent.session.turn.item.done") {
-    if (!onlyFields(value, itemEventFields) || event.item === undefined) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    const turnId = requiredEventString(value, "turn_id");
-    const item = projectSessionItem(event.item, invalidStreamEvent);
-    if (!sameResourceId(item.turn_id, turnId)) return invalidStreamEvent();
-    const itemId = value.item_id === undefined ? undefined : requiredEventString(value, "item_id");
-    if (itemId !== undefined && !sameResourceId(item.id, itemId)) return invalidStreamEvent();
-    // Input Items carry a null output index; older Cores omit it.
-    const outputIndex = value.output_index === null ? null : optionalEventIndex(value, "output_index");
-    return {
-      ...base,
-      session_id: sessionId,
-      turn_id: turnId,
-      ...(itemId === undefined ? {} : { item_id: itemId }),
-      ...(outputIndex === undefined ? {} : { output_index: outputIndex }),
-      item,
-    } as SessionEvent;
-  }
-
-  if (event.type === "agent.session.turn.content_part.added" || event.type === "agent.session.turn.content_part.done") {
-    if (!exactFields(value, contentPartEventFields)) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    const turnId = requiredEventString(value, "turn_id");
-    const itemId = requiredEventString(value, "item_id");
-    const outputIndex = optionalEventIndex(value, "output_index", true)!;
-    const contentIndex = optionalEventIndex(value, "content_index", true)!;
-    const part = projectItemContent(value.part, invalidStreamEvent);
-    return { ...base, session_id: sessionId, turn_id: turnId, item_id: itemId, output_index: outputIndex, content_index: contentIndex, part } as SessionEvent;
-  }
-
-  if (event.type === "agent.session.turn.output_text.delta" || event.type === "agent.session.turn.output_text.done") {
-    const field = event.type.endsWith(".delta") ? "delta" : "text";
-    if (!exactFields(value, new Set([...outputTextEventBaseFields, field]))) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    const turnId = requiredEventString(value, "turn_id");
-    const itemId = requiredEventString(value, "item_id");
-    const outputIndex = optionalEventIndex(value, "output_index", true)!;
-    const contentIndex = optionalEventIndex(value, "content_index", true)!;
-    const text = requiredEventString(value, field, true);
-    return {
-      ...base,
-      session_id: sessionId,
-      turn_id: turnId,
-      item_id: itemId,
-      output_index: outputIndex,
-      content_index: contentIndex,
-      [field]: text,
-    } as SessionEvent;
-  }
-
-  if (event.type === "agent.output.command_execution_output.delta") {
-    if (!exactFields(value, commandDeltaEventFields)) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    return {
-      ...base,
-      session_id: sessionId,
-      turn_id: requiredEventString(value, "turn_id"),
-      item_id: requiredEventString(value, "item_id"),
-      output_index: optionalEventIndex(value, "output_index", true)!,
-      delta: requiredEventString(value, "delta", true),
-    } as SessionEvent;
+    return { ...base, session_id: eventSessionId(value, expectedSessionId), turn_id: null, environment } as SessionEvent;
   }
 
   // A Session failure, such as a hosted Environment that failed to provision.
   // Core's stream_interrupted error never reaches this projection.
-  if (event.type === "error") {
-    if (!exactFields(value, errorEventFields)) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    return { ...base, session_id: sessionId, error: projectStreamError(value.error) } as SessionEvent;
-  }
+  const sessionId = eventSessionId(value, expectedSessionId);
+  if (event.type === "error") return { ...base, session_id: sessionId, error: projectStreamError(value.error) } as SessionEvent;
 
-  if (event.type.startsWith("agent.session.environment.")) {
-    const status = event.type.slice("agent.session.environment.".length);
-    if (!new Set(["pending", "ready", "connected", "disconnected", "failed"]).has(status)) {
-      return projectUnknownStreamEvent(value, expectedSessionId);
-    }
-    if (!exactFields(value, environmentEventFields)) return invalidStreamEvent();
-    const sessionId = eventSessionId(value, expectedSessionId, true)!;
-    const environment = projectEnvironmentState(value.environment, status);
+  // Every other projected event belongs to a Turn. The schema allows a null turn_id here,
+  // but Core always names the Turn and the client binds it to the Turn or Item it carries.
+  const turnId = requiredEventString(value, "turn_id");
+  if (hasOwn(turnStatusByEvent, event.type)) {
+    const turn = projectAgentTurn(value.turn, expectedSessionId, invalidStreamEvent);
     if (
-      immutable !== undefined &&
-      (immutable.environment.type === "none" ||
-        immutable.environment.type !== environment.type ||
-        !("id" in immutable.environment) ||
-        typeof immutable.environment.id !== "string" ||
-        !sameResourceId(immutable.environment.id, environment.id))
+      !sameResourceId(turn.id, turnId) || turn.status !== turnStatusByEvent[event.type] ||
+      (immutable !== undefined && !sameResourceId(turn.agent_id, immutable.agent.id))
     ) return invalidStreamEvent();
-    return { ...base, session_id: sessionId, environment } as SessionEvent;
+    const usage = hasOwn(value, "usage") ? { usage: projectTokenUsage(value.usage, invalidStreamEvent) } : {};
+    return { ...base, session_id: sessionId, turn_id: turnId, turn, ...usage } as SessionEvent;
   }
 
-  return projectUnknownStreamEvent(value, expectedSessionId);
+  if (event.type.startsWith("agent.session.turn.item.")) {
+    const item = projectSessionItem(value.item, invalidStreamEvent);
+    if (!sameResourceId(item.turn_id, turnId)) return invalidStreamEvent();
+    const outputIndex = value.output_index === null ? null : eventIndex(value, "output_index");
+    return { ...base, session_id: sessionId, turn_id: turnId, output_index: outputIndex, item } as SessionEvent;
+  }
+
+  const projectedFields: Record<string, unknown> = {
+    ...base,
+    session_id: sessionId,
+    turn_id: turnId,
+    item_id: requiredEventString(value, "item_id"),
+    output_index: eventIndex(value, "output_index"),
+  };
+  if (hasOwn(value, "content_index")) projectedFields.content_index = eventIndex(value, "content_index");
+  if (hasOwn(value, "part")) {
+    const part = projectItemContent(value.part, invalidStreamEvent);
+    if (part.type !== "output_text") return invalidStreamEvent();
+    projectedFields.part = part;
+  }
+  for (const field of ["delta", "text"] as const) {
+    if (hasOwn(value, field)) projectedFields[field] = requiredEventString(value, field, true);
+  }
+  return projectedFields as unknown as SessionEvent;
 }
 
 function projectUnknownStreamEvent(
@@ -1375,8 +1190,7 @@ function projectUnknownStreamEvent(
     type: value.type,
     event_id: value.event_id,
   };
-  const sessionId = eventSessionId(value, expectedSessionId, false);
-  if (sessionId !== undefined) projected.session_id = sessionId;
+  if (value.session_id !== undefined) projected.session_id = eventSessionId(value, expectedSessionId);
   for (const [field, fieldValue] of Object.entries(value)) {
     if (
       field === "type" || field === "event_id" || field === "session_id" ||
@@ -1412,7 +1226,7 @@ async function consumeEventStream(
     sawEvent = true;
     if (event.type === "error") {
       const raw = event as unknown as Record<string, unknown>;
-      if (!exactFields(raw, errorEventFields) || event.error === undefined) return invalidStreamEvent();
+      if (!exactFields(raw, sessionEventErrorFields)) return invalidStreamEvent();
       const sessionId = requiredEventString(raw, "session_id");
       const expectedSessionId = options.expectedSessionId?.();
       if (expectedSessionId !== undefined && !sameResourceId(sessionId, expectedSessionId)) {
@@ -1462,10 +1276,6 @@ async function consumeEventStream(
   }
 }
 
-function isEnvironmentResourceStatus(value: unknown): value is EnvironmentResourceStatus {
-  return value === "pending" || value === "connected" || value === "disconnected" || value === "expired" || value === "failed";
-}
-
 function isExpectedEnvironmentId(value: unknown, expectedId: string): value is string {
   if (typeof value !== "string") return false;
   const canonicalExpectedId = expectedId.toLowerCase();
@@ -1478,14 +1288,12 @@ function projectEnvironmentResource(value: unknown, expectedId: string): AgentEn
     throw new AgentCoreError("OpenAgentCore returned an invalid Environment resource.", 502, "invalid_environment_resource");
   }
   const resource = value as Record<string, unknown>;
-  const fields = Object.keys(resource);
   if (
-    fields.length !== environmentResourceFields.size ||
-    fields.some((field) => !environmentResourceFields.has(field)) ||
+    !exactFields(resource, publicEnvironmentResourceFields) ||
     !isExpectedEnvironmentId(resource.id, expectedId) ||
     resource.object !== "agent.environment" ||
     (resource.type !== "self_hosted" && resource.type !== "openai_hosted") ||
-    !isEnvironmentResourceStatus(resource.status) ||
+    !isOneOf(environmentStatusResourceValues, resource.status) ||
     !Array.isArray(resource.files) ||
     !Array.isArray(resource.plugins) ||
     !Array.isArray(resource.skills) ||
@@ -1572,24 +1380,18 @@ function validSourceFileId(value: unknown): value is string {
 export function projectSourceFile(value: unknown, expectedId?: string): SourceFile {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return invalidSourceFile();
   const file = value as Record<string, unknown>;
-  const fields = Object.keys(file);
-  const filenameBytes = typeof file.filename === "string"
-    ? new TextEncoder().encode(file.filename).length
-    : 0;
+  // The pinned File schema types expires_at and status_details as optional integer and string; Core sends null.
   if (
-    fields.length !== sourceFileFields.size ||
-    fields.some((field) => !sourceFileFields.has(field)) ||
+    !exactFields(file, openAIFileFields) ||
     !validSourceFileId(file.id) ||
     (expectedId !== undefined && file.id !== expectedId) ||
     file.object !== "file" ||
     !Number.isSafeInteger(file.bytes) ||
     Number(file.bytes) < 0 ||
-    Number(file.bytes) > maxSourceFileBytes ||
     !Number.isSafeInteger(file.created_at) ||
     Number(file.created_at) < 0 ||
     typeof file.filename !== "string" ||
-    filenameBytes < 1 ||
-    filenameBytes > 1024 ||
+    file.filename === "" ||
     file.filename.includes("\0") ||
     file.purpose !== "user_data" ||
     file.status !== "processed" ||
@@ -1612,10 +1414,8 @@ export function projectSourceFile(value: unknown, expectedId?: string): SourceFi
 export function projectSourceFileDeleted(value: unknown, expectedId: string): SourceFileDeleted {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return invalidSourceFile();
   const deleted = value as Record<string, unknown>;
-  const fields = Object.keys(deleted);
   if (
-    fields.length !== sourceFileDeletedFields.size ||
-    fields.some((field) => !sourceFileDeletedFields.has(field)) ||
+    !exactFields(deleted, deleteFileResponseFields) ||
     deleted.id !== expectedId ||
     deleted.object !== "file" ||
     deleted.deleted !== true
@@ -1644,7 +1444,7 @@ function projectSourceFileListEntry(value: unknown): SourceFileListEntry {
 
 function projectSourceFileList(value: unknown, options?: SourceFileListOptions): SourceFileList {
   if (
-    !isRecord(value) || !exactFields(value, sourceFileListFields) || value.object !== "list" ||
+    !isRecord(value) || !exactFields(value, listFilesResponseFields) || value.object !== "list" ||
     !Array.isArray(value.data) || typeof value.has_more !== "boolean"
   ) return invalidSourceFileList();
   const limit = options?.limit ?? maxSourceFileListLimit;
@@ -1680,17 +1480,14 @@ function projectEnvironmentFile(
     throw new AgentCoreError("OpenAgentCore returned an invalid Environment file.", 502, "invalid_environment_file");
   }
   const file = value as Record<string, unknown>;
-  const fields = Object.keys(file);
   if (
-    fields.length !== environmentFileFields.size ||
-    fields.some((field) => !environmentFileFields.has(field)) ||
+    !exactFields(file, environmentFileResourceFields) ||
     !isExpectedEnvironmentId(file.environment_id, expectedEnvironmentId) ||
     file.object !== "agent.environment.file" ||
     file.path !== expectedPath ||
     !validEnvironmentFilePath(file.path) ||
     !Number.isSafeInteger(file.size_bytes) ||
     Number(file.size_bytes) < 0 ||
-    Number(file.size_bytes) > maxEnvironmentFileBytes ||
     (expectedSize !== undefined && file.size_bytes !== expectedSize)
   ) {
     throw new AgentCoreError("OpenAgentCore returned an invalid Environment file.", 502, "invalid_environment_file");
@@ -1722,7 +1519,6 @@ function canonicalAbsoluteDirectory(value: unknown): string | null {
   if (
     typeof value !== "string" ||
     !value.startsWith("/") ||
-    new TextEncoder().encode(value).length > 4096 ||
     value.includes("\\") ||
     value.includes("\0") ||
     value.includes("\r") ||
@@ -1765,28 +1561,17 @@ function projectEnvironmentFileList(
     return invalidEnvironmentFiles();
   }
   const page = value as Record<string, unknown>;
-  const fields = Object.keys(page);
   const limit = options?.limit ?? 20;
   const order = options?.order ?? "desc";
   const requestedDirectory = canonicalEnvironmentFilesDirectory(options.path ?? "/workspace");
   if (
-    fields.length !== environmentFileListFields.size ||
-    fields.some((field) => !environmentFileListFields.has(field)) ||
+    !exactFields(page, environmentFileListResourceFields) ||
     page.object !== "page" ||
     page.has_more !== (page.next !== null) ||
     !Array.isArray(page.data) ||
-    !Number.isSafeInteger(limit) ||
-    limit < 1 ||
-    limit > 100 ||
     page.data.length > limit ||
-    (order !== "asc" && order !== "desc") ||
     requestedDirectory === null ||
-    !(page.next === null || (
-      typeof page.next === "string" &&
-      page.next.length > 0 &&
-      new TextEncoder().encode(page.next).length <= 1024 &&
-      page.data.length === limit
-    ))
+    !(page.next === null || (typeof page.next === "string" && page.next.length > 0 && page.data.length === limit))
   ) {
     return invalidEnvironmentFiles();
   }
@@ -1798,7 +1583,6 @@ function projectEnvironmentFileList(
       return invalidEnvironmentFiles();
     }
     const file = entry as Record<string, unknown>;
-    const fileFields = Object.keys(file);
     const canonicalPath = canonicalAbsoluteDirectory(file.path);
     const sorted = previousPath === null || (
       order === "asc"
@@ -1806,8 +1590,7 @@ function projectEnvironmentFileList(
         : compareUtf8(previousPath, String(file.path)) > 0
     );
     if (
-      fileFields.length !== environmentFileFields.size ||
-      fileFields.some((field) => !environmentFileFields.has(field)) ||
+      !exactFields(file, environmentFileResourceFields) ||
       !isExpectedEnvironmentId(file.environment_id, expectedId) ||
       file.object !== "agent.environment.file" ||
       canonicalPath === null ||
@@ -1975,7 +1758,7 @@ export class OpenAIAgentsClient implements AgentCore {
 
   async deleteVault(vaultId: string): Promise<VaultDeleted> {
     const value = await this.request<unknown>(`/vaults/${encodeURIComponent(vaultId)}`, { method: "DELETE" }, 200);
-    return projectDeletedResource<VaultDeleted>(value, vaultId, "vault.deleted", vaultDeletedFields, "invalid_vault_deletion");
+    return projectDeletedResource<VaultDeleted>(value, vaultId, "vault.deleted", deletedVaultResourceFields, "invalid_vault_deletion");
   }
 
   async listVaultCredentials(vaultId: string, options?: VaultListOptions): Promise<VaultCredentialList> {
@@ -1990,12 +1773,9 @@ export class OpenAIAgentsClient implements AgentCore {
   }
 
   async createVaultCredential(vaultId: string, input: CreateVaultCredentialInput): Promise<VaultCredential> {
-    const fields = Object.keys(input);
-    const authFields = isRecord(input.auth) ? Object.keys(input.auth) : [];
     if (
-      fields.length !== 2 || fields.some((field) => field !== "name" && field !== "auth") ||
-      !isTrimmedName(input.name) || !isRecord(input.auth) ||
-      authFields.length !== 3 || authFields.some((field) => field !== "type" && field !== "mcp_server_url" && field !== "token") ||
+      !exactFields(input, createVaultCredentialParamsFields) || !isTrimmedName(input.name) ||
+      !isRecord(input.auth) || !exactFields(input.auth, createVaultCredentialAuthParamStaticBearerFields) ||
       input.auth.type !== "static_bearer" || !validCredentialURL(input.auth.mcp_server_url) || typeof input.auth.token !== "string"
     ) {
       throw new TypeError("Credential creation requires a name, an HTTPS MCP URL, and a write-only token.");
@@ -2031,11 +1811,9 @@ export class OpenAIAgentsClient implements AgentCore {
     credentialId: string,
     input: ReplaceVaultCredentialTokenInput,
   ): Promise<VaultCredential> {
-    const fields = Object.keys(input);
-    const authFields = isRecord(input.auth) ? Object.keys(input.auth) : [];
     if (
-      fields.length !== 1 || fields[0] !== "auth" || !isRecord(input.auth) ||
-      authFields.length !== 2 || authFields.some((field) => field !== "type" && field !== "token") ||
+      !exactFields(input, rotateVaultCredentialParamsFields) || !isRecord(input.auth) ||
+      !exactFields(input.auth, rotateVaultCredentialAuthParamStaticBearerFields) ||
       input.auth.type !== "static_bearer" || typeof input.auth.token !== "string"
     ) {
       throw new TypeError("Credential replacement accepts one write-only static bearer token.");
@@ -2072,7 +1850,7 @@ export class OpenAIAgentsClient implements AgentCore {
       value,
       credentialId,
       "vault.credential.deleted",
-      vaultCredentialDeletedFields,
+      deletedVaultCredentialResourceFields,
       "invalid_vault_credential_deletion",
     );
   }
@@ -2172,12 +1950,6 @@ export class OpenAIAgentsClient implements AgentCore {
   }
 
   async listEnvironmentTemplates(options?: PageOptions & ReadOptions): Promise<EnvironmentTemplateList> {
-    if (options?.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100)) {
-      throw new TypeError("Environment Template list limit must be an integer from 1 through 100.");
-    }
-    if (options?.order !== undefined && options.order !== "asc" && options.order !== "desc") {
-      throw new TypeError("Environment Template list order must be asc or desc.");
-    }
     const params = new URLSearchParams();
     addPageOptions(params, options);
     const value = await this.request<unknown>(
@@ -2252,7 +2024,7 @@ export class OpenAIAgentsClient implements AgentCore {
       200,
     );
     if (
-      !isRecord(value) || !exactFields(value, environmentTemplateDeletedFields) ||
+      !isRecord(value) || !exactFields(value, deletedEnvironmentTemplateResourceFields) ||
       !sameUuid(value.id, templateId) ||
       value.object !== "agent.environment.template.deleted" || value.deleted !== true
     ) {
@@ -2290,24 +2062,16 @@ export class OpenAIAgentsClient implements AgentCore {
     if (!validEnvironmentFilePath(input.path)) {
       throw new TypeError("Environment file paths must be canonical absolute paths beneath /workspace.");
     }
-    const fields = Object.keys(input);
     let expectedSize: number | undefined;
     if (input.type === "inline") {
-      if (fields.length !== 3 || fields.some((field) => field !== "type" && field !== "data" && field !== "path")) {
+      if (!exactFields(input, hostedEnvironmentFileParamInlineFields)) {
         throw new TypeError("Inline Environment files accept only type, data, and path.");
       }
       const decodedBytes = strictBase64DecodedBytes(input.data);
       if (decodedBytes === null) throw new TypeError("Inline Environment file data must be strict standard Base64.");
-      if (decodedBytes > maxInlineEnvironmentFileBytes) {
-        throw new TypeError("Inline Environment file data must decode to at most 5 MiB.");
-      }
       expectedSize = decodedBytes;
     } else if (input.type === "file_id") {
-      if (
-        fields.length !== 3 ||
-        fields.some((field) => field !== "type" && field !== "file_id" && field !== "path") ||
-        !validSourceFileId(input.file_id)
-      ) {
+      if (!exactFields(input, hostedEnvironmentFileParamFileIdFields) || !validSourceFileId(input.file_id)) {
         throw new TypeError("Referenced Environment files require an exact Source File ID.");
       }
     } else {
@@ -2326,18 +2090,6 @@ export class OpenAIAgentsClient implements AgentCore {
     if (options?.after !== undefined && !validSourceFileId(options.after)) {
       throw new TypeError("A Files list cursor must be a File ID.");
     }
-    if (
-      options?.limit !== undefined &&
-      (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > maxSourceFileListLimit)
-    ) {
-      throw new TypeError("Files list limit must be an integer from 1 through 10000.");
-    }
-    if (options?.order !== undefined && options.order !== "asc" && options.order !== "desc") {
-      throw new TypeError("Files list order must be asc or desc.");
-    }
-    if (options?.purpose !== undefined && options.purpose !== "user_data") {
-      throw new TypeError("Files list purpose must be user_data.");
-    }
     const params = new URLSearchParams();
     addPageOptions(params, options);
     if (options?.purpose !== undefined) params.set("purpose", options.purpose);
@@ -2346,17 +2098,8 @@ export class OpenAIAgentsClient implements AgentCore {
   }
 
   async uploadSourceFile(input: SourceFileUploadInput, options?: ReadOptions): Promise<SourceFile> {
-    const filenameBytes = new TextEncoder().encode(input.filename).length;
-    if (
-      !(input.file instanceof Blob) ||
-      !Number.isSafeInteger(input.file.size) ||
-      input.file.size < 0 ||
-      input.file.size > maxSourceFileBytes ||
-      filenameBytes < 1 ||
-      filenameBytes > 1024 ||
-      input.filename.includes("\0")
-    ) {
-      throw new TypeError("Source Files require a valid filename and at most 512 MiB of content.");
+    if (!(input.file instanceof Blob) || input.filename === "" || input.filename.includes("\0")) {
+      throw new TypeError("Source Files require a Blob and a nonempty filename without NUL characters.");
     }
     const body = new FormData();
     body.append("file", input.file, input.filename);
@@ -2590,7 +2333,6 @@ export class OpenAIAgentsClient implements AgentCore {
   }
 
   async listItems(sessionId: string, options?: PageOptions & ReadOptions): Promise<ListPage<SessionItem>> {
-    validateHistoryPageOptions(options);
     const params = new URLSearchParams();
     addPageOptions(params, options);
     const value = await this.request<unknown>(withQuery(`/agents/sessions/${encodeURIComponent(sessionId)}/items`, params), {
@@ -2600,7 +2342,6 @@ export class OpenAIAgentsClient implements AgentCore {
   }
 
   async listTurns(sessionId: string, options?: PageOptions & ReadOptions): Promise<ListPage<AgentTurn>> {
-    validateHistoryPageOptions(options);
     const params = new URLSearchParams();
     addPageOptions(params, options);
     const value = await this.request<unknown>(withQuery(`/agents/sessions/${encodeURIComponent(sessionId)}/turns`, params), {
@@ -2622,7 +2363,6 @@ export class OpenAIAgentsClient implements AgentCore {
     events: readonly SessionInputEvent[],
     idempotencyKey: string,
   ): Promise<void> {
-    requireIdempotencyKey(idempotencyKey);
     const body = encodeSessionInputBatch(events);
     return this.request<void>(
       `/agents/sessions/${encodeURIComponent(sessionId)}/events`,
@@ -2662,9 +2402,6 @@ export class OpenAIAgentsClient implements AgentCore {
    * such as one after cancellation or one that differs from the saved result,
    * with HTTP 409 `conflict_error`. A call that is unknown or belongs to another
    * Turn of the Session is HTTP 400 `invalid_request_error`; nothing changes.
-   * Cores before these codes used 409 `turn_conflict`/`idempotency_conflict`
-   * and 404 for unknown targets: treat any 409 as a conflict, and 400 (new) or
-   * 404 (older, within an owned Session) as an unknown target.
    */
   submitFunctionResult(sessionId: string, input: FunctionResultInput, idempotencyKey: string): Promise<void> {
     const event: SessionToolResultInputEvent = {
diff --git a/packages/agents-client/src/environment-template-projection.ts b/packages/agents-client/src/environment-template-projection.ts
index 8cfacc0d1..ecd23ac8b 100644
--- a/packages/agents-client/src/environment-template-projection.ts
+++ b/packages/agents-client/src/environment-template-projection.ts
@@ -12,6 +12,11 @@ import type {
   UpdateEnvironmentTemplateInput,
 } from "./types";
 import { canonicalUuid, exactFields, hasOwn, isNonnegativeInteger, isRecord, onlyFields } from "./response-projection";
+import {
+  environmentPackagesResourceFields, environmentTemplateResourceFields, hostedPluginResourceInlineFields,
+  hostedTemplateFileResourceFileIdFields, hostedTemplateFileResourceInlineFields, hostedTemplateSkillResourceInlineFields,
+  hostedTemplateSkillResourceSkillReferenceFields, networkPolicyResourceFields,
+} from "./generated/public-api";
 
 type Invalid = (message?: string) => never;
 
@@ -19,26 +24,15 @@ const identityFields = ["id", "object", "name", "created_at", "updated_at"] as c
 const templateSections: readonly EnvironmentTemplateSection[] = [
   "network", "capability_directories", "packages", "files", "plugins", "skills",
 ];
-const knownTemplateFields = new Set<string>([...identityFields, ...templateSections]);
-const networkFields = new Set(["access", "allowed_domains"]);
-const packagesFields = new Set(["npm", "python", "system"]);
-const inlineFileFields = new Set(["type", "path", "size_bytes"]);
-const referencedFileFields = new Set(["type", "path", "file_id"]);
-const skillReferenceFields = new Set(["type", "skill_id", "version"]);
-const inlineCapabilityFields = new Set(["type", "name", "description"]);
 const canonicalUuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 // Skill IDs are `skill_` plus Core's resource identifier.
 const skillIdPattern = /^skill_[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 const skillVersionPattern = /^[1-9][0-9]{0,18}$/;
 const controlCharacterPattern = /[\u0000-\u001f\u007f]/;
-// Core accepts 1–100 exact hostnames for restricted access.
-const maxAllowedDomains = 100;
 
-/** Core preserves a Template name verbatim within a 1–256 Unicode character bound. */
+/** Core preserves a nonempty Template name verbatim and enforces its length bound. */
 export function isEnvironmentTemplateName(value: unknown): value is string {
-  if (typeof value !== "string") return false;
-  const characters = [...value].length;
-  return characters >= 1 && characters <= 256;
+  return typeof value === "string" && value !== "";
 }
 
 /** True when every configuration section of a Template was recognized. */
@@ -63,20 +57,20 @@ function stringList(value: unknown, valid: (entry: unknown) => entry is string =
 }
 
 function projectNetwork(value: unknown): EnvironmentNetworkPolicy | null {
-  if (!isRecord(value) || !exactFields(value, networkFields)) return null;
+  if (!isRecord(value) || !exactFields(value, networkPolicyResourceFields)) return null;
   const domains = stringList(value.allowed_domains, isText);
   if (domains === null) return null;
   if (value.access === "enabled" || value.access === "disabled") {
     return domains.length === 0 ? { access: value.access, allowed_domains: [] } : null;
   }
   if (value.access === "restricted") {
-    return domains.length >= 1 && domains.length <= maxAllowedDomains ? { access: "restricted", allowed_domains: domains } : null;
+    return domains.length > 0 ? { access: "restricted", allowed_domains: domains } : null;
   }
   return null;
 }
 
 function projectPackages(value: unknown): AgentEnvironmentPackages | null {
-  if (!isRecord(value) || !exactFields(value, packagesFields)) return null;
+  if (!isRecord(value) || !exactFields(value, environmentPackagesResourceFields)) return null;
   const npm = stringList(value.npm, isText);
   const python = stringList(value.python, isText);
   const system = stringList(value.system, isText);
@@ -95,12 +89,12 @@ function projectEntries<T>(value: unknown, project: (entry: Record<string, unkno
 }
 
 function projectFile(entry: Record<string, unknown>): EnvironmentTemplateFile | null {
-  if (entry.type === "inline" && exactFields(entry, inlineFileFields)) {
+  if (entry.type === "inline" && exactFields(entry, hostedTemplateFileResourceInlineFields)) {
     return isWorkspacePath(entry.path) && isNonnegativeInteger(entry.size_bytes)
       ? { type: "inline", path: entry.path, size_bytes: entry.size_bytes }
       : null;
   }
-  if (entry.type === "file_id" && exactFields(entry, referencedFileFields)) {
+  if (entry.type === "file_id" && exactFields(entry, hostedTemplateFileResourceFileIdFields)) {
     return isWorkspacePath(entry.path) && isText(entry.file_id)
       ? { type: "file_id", path: entry.path, file_id: entry.file_id }
       : null;
@@ -109,14 +103,14 @@ function projectFile(entry: Record<string, unknown>): EnvironmentTemplateFile |
 }
 
 function projectSkill(entry: Record<string, unknown>): EnvironmentTemplateSkill | null {
-  if (entry.type === "skill_reference" && exactFields(entry, skillReferenceFields)) {
+  if (entry.type === "skill_reference" && exactFields(entry, hostedTemplateSkillResourceSkillReferenceFields)) {
     const version = entry.version;
     return typeof entry.skill_id === "string" && skillIdPattern.test(entry.skill_id) &&
       (version === null || version === "latest" || (typeof version === "string" && skillVersionPattern.test(version)))
       ? { type: "skill_reference", skill_id: entry.skill_id, version }
       : null;
   }
-  if (entry.type === "inline" && exactFields(entry, inlineCapabilityFields)) {
+  if (entry.type === "inline" && exactFields(entry, hostedTemplateSkillResourceInlineFields)) {
     return typeof entry.name === "string" && entry.name.length > 0 && typeof entry.description === "string" && entry.description.length > 0
       ? { type: "inline", name: entry.name, description: entry.description }
       : null;
@@ -125,7 +119,7 @@ function projectSkill(entry: Record<string, unknown>): EnvironmentTemplateSkill
 }
 
 function projectPlugin(entry: Record<string, unknown>): EnvironmentTemplatePlugin | null {
-  return entry.type === "inline" && exactFields(entry, inlineCapabilityFields) &&
+  return entry.type === "inline" && exactFields(entry, hostedPluginResourceInlineFields) &&
     typeof entry.name === "string" && entry.name.length > 0 &&
     typeof entry.description === "string" && entry.description.length > 0
     ? { type: "inline", name: entry.name, description: entry.description }
@@ -171,7 +165,7 @@ export function projectEnvironmentTemplate(
     else (configuration as Record<string, unknown>)[section] = projected;
   }
   for (const field of Object.keys(value)) {
-    if (!knownTemplateFields.has(field)) unrecognized.push(field);
+    if (!(environmentTemplateResourceFields as readonly string[]).includes(field)) unrecognized.push(field);
   }
   const identity = {
     id: value.id,
@@ -184,7 +178,7 @@ export function projectEnvironmentTemplate(
   return { ...identity, ...configuration, unrecognized };
 }
 
-/** Validates a create or update body: only name and network are ever sent. */
+/** Validates a create or update body: the client supports only the name and network of the schema's Template fields. */
 export function environmentTemplateRequestBody(
   input: CreateEnvironmentTemplateInput | UpdateEnvironmentTemplateInput,
 ): string {
@@ -192,13 +186,13 @@ export function environmentTemplateRequestBody(
     throw new TypeError("Environment Template requests accept only name and network.");
   }
   if (hasOwn(input, "name") && !(input.name === null || isEnvironmentTemplateName(input.name))) {
-    throw new TypeError("An Environment Template name must be null or 1 through 256 characters.");
+    throw new TypeError("An Environment Template name must be null or a nonempty string.");
   }
   if (hasOwn(input, "network") && input.network !== null) {
     const network: unknown = input.network;
     const basic = isRecord(network) && exactFields(network, new Set(["access"])) &&
       (network.access === "enabled" || network.access === "disabled");
-    const restricted = isRecord(network) && exactFields(network, networkFields) && network.access === "restricted" &&
+    const restricted = isRecord(network) && exactFields(network, networkPolicyResourceFields) && network.access === "restricted" &&
       Array.isArray(network.allowed_domains) && network.allowed_domains.every((domain) => typeof domain === "string");
     if (!basic && !restricted) {
       throw new TypeError("An Environment Template network accepts enabled or disabled access, or restricted access with a domain list.");
diff --git a/packages/agents-client/src/environment-templates.test.ts b/packages/agents-client/src/environment-templates.test.ts
index 54d19c3ab..613870bfd 100644
--- a/packages/agents-client/src/environment-templates.test.ts
+++ b/packages/agents-client/src/environment-templates.test.ts
@@ -183,7 +183,7 @@ describe("Session creation with a referenced Template", () => {
         name: null,
         instructions: null,
         multi_agent: { enabled: false, max_concurrent_subagents: null },
-        reasoning: {},
+        reasoning: { effort: null, summary: null },
         service_tier: "auto",
         text: { format: { type: "text" }, verbosity: "medium" },
         tools: [],
@@ -412,7 +412,7 @@ describe("Sessions created from an advanced Template", () => {
       name: null,
       instructions: null,
       multi_agent: { enabled: false, max_concurrent_subagents: null },
-      reasoning: {},
+      reasoning: { effort: null, summary: null },
       service_tier: "auto",
       text: { format: { type: "text" }, verbosity: "medium" },
       tools: [],
diff --git a/packages/agents-client/src/execution-configuration-projection.ts b/packages/agents-client/src/execution-configuration-projection.ts
index 35ff00a33..577a2fd36 100644
--- a/packages/agents-client/src/execution-configuration-projection.ts
+++ b/packages/agents-client/src/execution-configuration-projection.ts
@@ -1,11 +1,11 @@
 import { modelProviderProtocols } from "./harness-catalog";
 import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import { modelProviderViewFields } from "./generated/public-api";
 import type { ExecutionConfigurationSource, ModelProviderView, SessionExecutionConfiguration } from "./types";
 
 type Invalid = () => never;
 const sources = new Set(["session", "agent", "deployment", "unknown"]);
 const selectionFields = new Set(["value", "source"]);
-const providerFields = new Set(["protocol", "base_url", "api_key_configured", "context_window", "max_output_tokens"]);
 const protocols: ReadonlySet<unknown> = new Set(modelProviderProtocols);
 
 function selection(value: unknown, invalid: Invalid): SessionExecutionConfiguration["model"] {
@@ -33,7 +33,7 @@ function safeBaseURL(value: string): boolean {
 
 /** The safe provider view shared by frozen Session configuration and saved Agent reads. */
 export function safeProvider(value: unknown, invalid: Invalid): ModelProviderView {
-  if (!isRecord(value) || !onlyFields(value, providerFields) ||
+  if (!isRecord(value) || !onlyFields(value, modelProviderViewFields) ||
     !protocols.has(value.protocol) ||
     typeof value.base_url !== "string" || typeof value.api_key_configured !== "boolean" ||
     (value.context_window !== undefined && !isNonnegativeInteger(value.context_window)) ||
diff --git a/packages/agents-client/src/generated/public-api.ts b/packages/agents-client/src/generated/public-api.ts
new file mode 100644
index 000000000..4edc43fd2
--- /dev/null
+++ b/packages/agents-client/src/generated/public-api.ts
@@ -0,0 +1,1970 @@
+// Code generated by scripts/generate-public-api.py from contracts/agents-api/openapi.yaml; DO NOT EDIT.
+
+export type AgentContentResource = OutputTextResource | EncryptedContentResource;
+export interface AgentListResource {
+  object: "list";
+  data: AgentResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const agentListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface AgentMessageItemResource {
+  id: string;
+  turn_id: string;
+  type: "agent_message";
+  sender_agent_id: string;
+  recipient_agent_id: string;
+  content: AgentContentResource[];
+}
+export const agentMessageItemResourceFields = ["id", "turn_id", "type", "sender_agent_id", "recipient_agent_id", "content"] as const;
+export type AgentOutputItemResource = AssistantMessageItemResource | ReasoningItemResource | FunctionCallItemResource | McpCallItemResource | WebSearchCallItemResource | CommandExecutionItemResource | CreateSubagentCallItemResource | SendSubagentInputCallItemResource | ResumeSubagentCallItemResource | WaitForSubagentsCallItemResource | InterruptSubagentCallItemResource | CloseSubagentCallItemResource;
+export interface AgentResource {
+  id: string;
+  object: "agent";
+  created_at: number;
+  updated_at: number;
+  name: string | null;
+  metadata: Record<string, string>;
+  model: string;
+  reasoning: ReasoningResource;
+  text: TextResource;
+  service_tier: ServiceTierResource;
+  instructions: string | null;
+  tools: PersistedAgentToolResource[];
+  multi_agent: MultiAgentConfigResource;
+  x_agents_core?: SavedAgentCore | null;
+}
+export const agentResourceFields = ["id", "object", "created_at", "updated_at", "name", "metadata", "model", "reasoning", "text", "service_tier", "instructions", "tools", "multi_agent", "x_agents_core"] as const;
+export const agentResourceRequired = ["id", "object", "created_at", "updated_at", "name", "metadata", "model", "reasoning", "text", "service_tier", "instructions", "tools", "multi_agent"] as const;
+export type AgentToolConfigParam = AgentToolConfigParamFunction | AgentToolConfigParamToolSearch | AgentToolConfigParamProgrammaticToolCalling | AgentToolConfigParamMcp | AgentToolConfigParamWebSearch;
+export interface AgentToolConfigParamFunction {
+  type: "function";
+  name: string;
+  description: string;
+  parameters: Record<string, unknown>;
+  defer_loading?: boolean;
+}
+export const agentToolConfigParamFunctionFields = ["type", "name", "description", "parameters", "defer_loading"] as const;
+export const agentToolConfigParamFunctionRequired = ["type", "name", "description", "parameters"] as const;
+export interface AgentToolConfigParamMcp {
+  type: "mcp";
+  server_label: string;
+  credential_id?: string | null;
+  transport: McpTransportConfigParam;
+  request_metadata?: Record<string, unknown> | null;
+  allowed_tools?: string[] | null;
+  required?: boolean;
+  connection_origin?: McpConnectionOriginParam | null;
+}
+export const agentToolConfigParamMcpFields = ["type", "server_label", "credential_id", "transport", "request_metadata", "allowed_tools", "required", "connection_origin"] as const;
+export const agentToolConfigParamMcpRequired = ["type", "server_label", "transport"] as const;
+export interface AgentToolConfigParamProgrammaticToolCalling {
+  type: "programmatic_tool_calling";
+  enabled?: boolean;
+}
+export const agentToolConfigParamProgrammaticToolCallingFields = ["type", "enabled"] as const;
+export const agentToolConfigParamProgrammaticToolCallingRequired = ["type"] as const;
+export interface AgentToolConfigParamToolSearch {
+  type: "tool_search";
+}
+export const agentToolConfigParamToolSearchFields = ["type"] as const;
+export interface AgentToolConfigParamWebSearch {
+  type: "web_search";
+  mode?: WebSearchModeParam | null;
+  context_size?: WebSearchContextSizeParam | null;
+  allowed_domains?: string[] | null;
+  location?: WebSearchLocationParam | null;
+}
+export const agentToolConfigParamWebSearchFields = ["type", "mode", "context_size", "allowed_domains", "location"] as const;
+export const agentToolConfigParamWebSearchRequired = ["type"] as const;
+export type AgentToolResource = AgentToolResourceFunction | AgentToolResourceProgrammaticToolCalling | AgentToolResourceMcp | AgentToolResourceWebSearch;
+export interface AgentToolResourceFunction {
+  type: "function";
+  name: string;
+  description: string;
+  parameters: Record<string, unknown>;
+  defer_loading: boolean;
+}
+export const agentToolResourceFunctionFields = ["type", "name", "description", "parameters", "defer_loading"] as const;
+export interface AgentToolResourceMcp {
+  type: "mcp";
+  server_label: string;
+  credential_id: string | null;
+  transport: McpTransportResource;
+  request_metadata: Record<string, unknown>;
+  allowed_tools: string[] | null;
+  required: boolean;
+  connection_origin: McpConnectionOriginResource;
+}
+export const agentToolResourceMcpFields = ["type", "server_label", "credential_id", "transport", "request_metadata", "allowed_tools", "required", "connection_origin"] as const;
+export interface AgentToolResourceProgrammaticToolCalling {
+  type: "programmatic_tool_calling";
+  enabled: boolean;
+}
+export const agentToolResourceProgrammaticToolCallingFields = ["type", "enabled"] as const;
+export interface AgentToolResourceWebSearch {
+  type: "web_search";
+  mode: WebSearchModeResource;
+  context_size: WebSearchContextSizeResource;
+  allowed_domains: string[] | null;
+  location: WebSearchLocationResource | null;
+}
+export const agentToolResourceWebSearchFields = ["type", "mode", "context_size", "allowed_domains", "location"] as const;
+export interface AgentsCore {
+  harness?: "claude_sdk" | "codex" | "mcode";
+  harness_config?: Record<string, unknown>;
+}
+export const agentsCoreFields = ["harness", "harness_config"] as const;
+export const agentsCoreRequired = [] as const;
+export interface AssistantMessageItemResource {
+  type: "message";
+  id: string;
+  turn_id: string;
+  role: "assistant";
+  status: OutputItemStatusResource;
+  content: OutputTextResource[];
+  phase: MessagePhaseResource | null;
+}
+export const assistantMessageItemResourceFields = ["type", "id", "turn_id", "role", "status", "content", "phase"] as const;
+export interface CloseSubagentCallItemResource {
+  type: "close_subagent_call";
+  id: string;
+  turn_id: string;
+  status: FunctionCallStatusResource;
+  sender_agent_id: string;
+  recipient_agent_id: string;
+}
+export const closeSubagentCallItemResourceFields = ["type", "id", "turn_id", "status", "sender_agent_id", "recipient_agent_id"] as const;
+export interface CommandExecutionItemResource {
+  type: "command_execution";
+  id: string;
+  turn_id: string;
+  command: string;
+  cwd: string | null;
+  status: FunctionCallStatusResource;
+  output: string | null;
+  exit_code: number | null;
+  duration_ms: number | null;
+}
+export const commandExecutionItemResourceFields = ["type", "id", "turn_id", "command", "cwd", "status", "output", "exit_code", "duration_ms"] as const;
+export interface CreateAgentParams {
+  metadata?: Record<string, string> | null;
+  name?: string | null;
+  model: string;
+  reasoning?: ReasoningParam | null;
+  text?: TextParam | null;
+  service_tier?: ServiceTierParam | null;
+  instructions?: string | null;
+  tools?: PersistedAgentToolConfigParam[] | null;
+  multi_agent?: MultiAgentConfigCurrentParam | null;
+  x_agents_core?: SavedAgentCoreInput | null;
+}
+export const createAgentParamsFields = ["metadata", "name", "model", "reasoning", "text", "service_tier", "instructions", "tools", "multi_agent", "x_agents_core"] as const;
+export const createAgentParamsRequired = ["model"] as const;
+export interface CreateAgentSessionParams {
+  metadata?: Record<string, string> | null;
+  agent?: SessionAgentConfigParam;
+  agent_id?: string;
+  environment: EnvironmentParam;
+  vault_ids?: string[] | null;
+  input?: CreateSessionInputParam | null;
+  stream?: boolean;
+  x_agents_core?: SessionExecutionInput | null;
+}
+export const createAgentSessionParamsFields = ["metadata", "agent", "agent_id", "environment", "vault_ids", "input", "stream", "x_agents_core"] as const;
+export const createAgentSessionParamsRequired = ["environment"] as const;
+export interface CreateEnvironmentTemplateParams {
+  packages?: EnvironmentPackagesParam | null;
+  setup_commands?: SetupCommandParam[] | null;
+  network?: NetworkPolicyParam | null;
+  env?: Record<string, string> | null;
+  capability_directories?: string[] | null;
+  skills?: HostedSkillParam[] | null;
+  plugins?: HostedPluginParam[] | null;
+  files?: HostedEnvironmentFileParam[] | null;
+  name?: string | null;
+}
+export const createEnvironmentTemplateParamsFields = ["packages", "setup_commands", "network", "env", "capability_directories", "skills", "plugins", "files", "name"] as const;
+export const createEnvironmentTemplateParamsRequired = [] as const;
+export interface CreateFileRequest {
+  file: string;
+  purpose: "assistants" | "batch" | "fine-tune" | "vision" | "user_data" | "evals";
+  expires_after?: FileExpirationAfter;
+}
+export const createFileRequestFields = ["file", "purpose", "expires_after"] as const;
+export const createFileRequestRequired = ["file", "purpose"] as const;
+export interface CreateMcpOauthRefreshParam {
+  token_endpoint: string;
+  client_id: string;
+  resource?: string | null;
+  scope?: string | null;
+  refresh_token: string;
+  token_endpoint_auth: CreateMcpOauthTokenEndpointAuthParam;
+}
+export const createMcpOauthRefreshParamFields = ["token_endpoint", "client_id", "resource", "scope", "refresh_token", "token_endpoint_auth"] as const;
+export const createMcpOauthRefreshParamRequired = ["token_endpoint", "client_id", "refresh_token", "token_endpoint_auth"] as const;
+export type CreateMcpOauthTokenEndpointAuthParam = CreateMcpOauthTokenEndpointAuthParamNone | CreateMcpOauthTokenEndpointAuthParamClientSecretBasic | CreateMcpOauthTokenEndpointAuthParamClientSecretPost;
+export interface CreateMcpOauthTokenEndpointAuthParamClientSecretBasic {
+  type: "client_secret_basic";
+  client_secret: string;
+}
+export const createMcpOauthTokenEndpointAuthParamClientSecretBasicFields = ["type", "client_secret"] as const;
+export interface CreateMcpOauthTokenEndpointAuthParamClientSecretPost {
+  type: "client_secret_post";
+  client_secret: string;
+}
+export const createMcpOauthTokenEndpointAuthParamClientSecretPostFields = ["type", "client_secret"] as const;
+export interface CreateMcpOauthTokenEndpointAuthParamNone {
+  type: "none";
+}
+export const createMcpOauthTokenEndpointAuthParamNoneFields = ["type"] as const;
+export interface CreateSessionEventsParams {
+  events: SessionInputParam[];
+}
+export const createSessionEventsParamsFields = ["events"] as const;
+export type CreateSessionInputParam = string | InputMessageParam[];
+export interface CreateSkillBody {
+  files: string[] | string;
+}
+export const createSkillBodyFields = ["files"] as const;
+export interface CreateSkillVersionBody {
+  files: string[] | string;
+  default?: boolean;
+}
+export const createSkillVersionBodyFields = ["files", "default"] as const;
+export const createSkillVersionBodyRequired = ["files"] as const;
+export interface CreateSubagentCallItemResource {
+  type: "create_subagent_call";
+  id: string;
+  turn_id: string;
+  status: FunctionCallStatusResource;
+  agent_id: string;
+  content: AgentContentResource[];
+  model: string | null;
+  reasoning_effort: string | null;
+}
+export const createSubagentCallItemResourceFields = ["type", "id", "turn_id", "status", "agent_id", "content", "model", "reasoning_effort"] as const;
+export type CreateVaultCredentialAuthParam = CreateVaultCredentialAuthParamMcpOauth | CreateVaultCredentialAuthParamStaticBearer;
+export interface CreateVaultCredentialAuthParamMcpOauth {
+  type: "mcp_oauth";
+  mcp_server_url: string;
+  access_token: string;
+  expires_at?: string | null;
+  refresh?: CreateMcpOauthRefreshParam | null;
+}
+export const createVaultCredentialAuthParamMcpOauthFields = ["type", "mcp_server_url", "access_token", "expires_at", "refresh"] as const;
+export const createVaultCredentialAuthParamMcpOauthRequired = ["type", "mcp_server_url", "access_token"] as const;
+export interface CreateVaultCredentialAuthParamStaticBearer {
+  type: "static_bearer";
+  mcp_server_url: string;
+  token: string;
+}
+export const createVaultCredentialAuthParamStaticBearerFields = ["type", "mcp_server_url", "token"] as const;
+export interface CreateVaultCredentialParams {
+  name: string;
+  auth: CreateVaultCredentialAuthParam;
+}
+export const createVaultCredentialParamsFields = ["name", "auth"] as const;
+export interface CreateVaultParams {
+  name?: string;
+  metadata?: Record<string, string> | null;
+}
+export const createVaultParamsFields = ["name", "metadata"] as const;
+export const createVaultParamsRequired = [] as const;
+export interface DeleteFileResponse {
+  id: string;
+  object: "file";
+  deleted: boolean;
+}
+export const deleteFileResponseFields = ["id", "object", "deleted"] as const;
+export interface DeletedAgentResource {
+  id: string;
+  object: "agent.deleted";
+  deleted: boolean;
+}
+export const deletedAgentResourceFields = ["id", "object", "deleted"] as const;
+export interface DeletedEnvironmentTemplateResource {
+  id: string;
+  object: "agent.environment.template.deleted";
+  deleted: boolean;
+}
+export const deletedEnvironmentTemplateResourceFields = ["id", "object", "deleted"] as const;
+export interface DeletedSessionArtifactResource {
+  id: string;
+  object: "agent.session.artifact.deleted";
+  deleted: boolean;
+}
+export const deletedSessionArtifactResourceFields = ["id", "object", "deleted"] as const;
+export interface DeletedSessionResource {
+  id: string;
+  object: "agent.session.deleted";
+  deleted: boolean;
+}
+export const deletedSessionResourceFields = ["id", "object", "deleted"] as const;
+export interface DeletedSkillResource {
+  object: "skill.deleted";
+  deleted: boolean;
+  id: string;
+}
+export const deletedSkillResourceFields = ["object", "deleted", "id"] as const;
+export interface DeletedSkillVersionResource {
+  object: "skill.version.deleted";
+  deleted: boolean;
+  id: string;
+  version: string;
+}
+export const deletedSkillVersionResourceFields = ["object", "deleted", "id", "version"] as const;
+export interface DeletedVaultCredentialResource {
+  id: string;
+  object: "vault.credential.deleted";
+  deleted: boolean;
+}
+export const deletedVaultCredentialResourceFields = ["id", "object", "deleted"] as const;
+export interface DeletedVaultResource {
+  id: string;
+  object: "vault.deleted";
+  deleted: boolean;
+}
+export const deletedVaultResourceFields = ["id", "object", "deleted"] as const;
+export interface EncryptedContentResource {
+  type: "encrypted_content";
+  encrypted_content: string;
+}
+export const encryptedContentResourceFields = ["type", "encrypted_content"] as const;
+export interface EnvironmentFileListResource {
+  object: EnvironmentFilePageObjectResource;
+  data: EnvironmentFileResource[];
+  next: string | null;
+  has_more: boolean;
+}
+export const environmentFileListResourceFields = ["object", "data", "next", "has_more"] as const;
+export const environmentFilePageObjectResourceValues = ["page"] as const;
+export type EnvironmentFilePageObjectResource = (typeof environmentFilePageObjectResourceValues)[number];
+export interface EnvironmentFileResource {
+  object: "agent.environment.file";
+  environment_id: string;
+  path: string;
+  size_bytes: number;
+}
+export const environmentFileResourceFields = ["object", "environment_id", "path", "size_bytes"] as const;
+export interface EnvironmentInstallation {
+  commands?: Record<string, string>;
+  expires_at?: number;
+  message?: string;
+  status?: "available" | "unavailable";
+  version?: string;
+}
+export const environmentInstallationFields = ["commands", "expires_at", "message", "status", "version"] as const;
+export const environmentInstallationRequired = [] as const;
+export interface EnvironmentPackagesParam {
+  python?: string[] | null;
+  system?: string[] | null;
+  npm?: string[] | null;
+}
+export const environmentPackagesParamFields = ["python", "system", "npm"] as const;
+export const environmentPackagesParamRequired = [] as const;
+export interface EnvironmentPackagesResource {
+  python: string[];
+  system: string[];
+  npm: string[];
+}
+export const environmentPackagesResourceFields = ["python", "system", "npm"] as const;
+export type EnvironmentParam = EnvironmentParamNone | EnvironmentParamOpenaiHosted | EnvironmentParamSelfHosted;
+export interface EnvironmentParamNone {
+  type: "none";
+}
+export const environmentParamNoneFields = ["type"] as const;
+export interface EnvironmentParamOpenaiHosted {
+  type: "openai_hosted";
+  packages?: EnvironmentPackagesParam | null;
+  setup_commands?: SetupCommandParam[] | null;
+  network?: NetworkPolicyParam | null;
+  env?: Record<string, string> | null;
+  capability_directories?: string[] | null;
+  skills?: HostedSkillParam[] | null;
+  plugins?: HostedPluginParam[] | null;
+  files?: HostedEnvironmentFileParam[] | null;
+  environment_template_id?: string;
+}
+export const environmentParamOpenaiHostedFields = ["type", "packages", "setup_commands", "network", "env", "capability_directories", "skills", "plugins", "files", "environment_template_id"] as const;
+export const environmentParamOpenaiHostedRequired = ["type"] as const;
+export interface EnvironmentParamSelfHosted {
+  type: "self_hosted";
+  workspace_directory: string;
+  capability_directories?: string[] | null;
+}
+export const environmentParamSelfHostedFields = ["type", "workspace_directory", "capability_directories"] as const;
+export const environmentParamSelfHostedRequired = ["type", "workspace_directory"] as const;
+export type EnvironmentResource = EnvironmentResourceNone | EnvironmentResourceOpenaiHosted | EnvironmentResourceSelfHosted;
+export interface EnvironmentResourceNone {
+  type: "none";
+}
+export const environmentResourceNoneFields = ["type"] as const;
+export interface EnvironmentResourceOpenaiHosted {
+  type: "openai_hosted";
+  id: string;
+  packages: EnvironmentPackagesResource;
+  network: NetworkPolicyResource;
+  capability_directories: string[];
+  skills: HostedSkillResource[];
+  plugins: HostedPluginResource[];
+  files: HostedEnvironmentFileResource[];
+}
+export const environmentResourceOpenaiHostedFields = ["type", "id", "packages", "network", "capability_directories", "skills", "plugins", "files"] as const;
+export interface EnvironmentResourceSelfHosted {
+  type: "self_hosted";
+  remote_url: string;
+  id: string;
+  workspace_directory: string;
+  capability_directories: string[];
+}
+export const environmentResourceSelfHostedFields = ["type", "remote_url", "id", "workspace_directory", "capability_directories"] as const;
+export const environmentStatusResourceValues = ["pending", "connected", "disconnected", "expired", "failed"] as const;
+export type EnvironmentStatusResource = (typeof environmentStatusResourceValues)[number];
+export interface EnvironmentTemplateListResource {
+  object: "list";
+  data: EnvironmentTemplateResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const environmentTemplateListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface EnvironmentTemplateResource {
+  id: string;
+  name: string | null;
+  object: "agent.environment.template";
+  created_at: number;
+  updated_at: number;
+  packages: EnvironmentPackagesResource;
+  network: NetworkPolicyResource;
+  capability_directories: string[];
+  skills: HostedTemplateSkillResource[];
+  plugins: HostedPluginResource[];
+  files: HostedTemplateFileResource[];
+}
+export const environmentTemplateResourceFields = ["id", "name", "object", "created_at", "updated_at", "packages", "network", "capability_directories", "skills", "plugins", "files"] as const;
+export const environmentTypeResourceValues = ["openai_hosted", "self_hosted"] as const;
+export type EnvironmentTypeResource = (typeof environmentTypeResourceValues)[number];
+export interface Error {
+  code: string | null;
+  message: string;
+  param: string | null;
+  type: string;
+  misalignment?: MisalignmentErrorDetailsResource;
+}
+export const errorFields = ["code", "message", "param", "type", "misalignment"] as const;
+export const errorRequired = ["type", "message", "param", "code"] as const;
+export interface ErrorBodyResource {
+  type: string;
+  code: string;
+  message: string;
+  param: string | null;
+}
+export const errorBodyResourceFields = ["type", "code", "message", "param"] as const;
+export interface ErrorResponse {
+  error: Error;
+}
+export const errorResponseFields = ["error"] as const;
+export interface ErrorResponse2 {
+  error: ErrorBodyResource;
+}
+export const errorResponse2Fields = ["error"] as const;
+export interface FileExpirationAfter {
+  anchor: "created_at";
+  seconds: number;
+}
+export const fileExpirationAfterFields = ["anchor", "seconds"] as const;
+export interface FunctionCallItemResource {
+  type: "function_call";
+  id: string;
+  turn_id: string;
+  call_id: string;
+  name: string;
+  arguments: unknown;
+  status: FunctionCallStatusResource;
+}
+export const functionCallItemResourceFields = ["type", "id", "turn_id", "call_id", "name", "arguments", "status"] as const;
+export interface FunctionCallOutputItemResource {
+  id: string;
+  turn_id: string;
+  type: "function_call_output";
+  call_id: string;
+  status: FunctionCallStatusResource;
+  output: FunctionCallOutputResource | null;
+  error: string | null;
+}
+export const functionCallOutputItemResourceFields = ["id", "turn_id", "type", "call_id", "status", "output", "error"] as const;
+export type FunctionCallOutputParam = string | InputContentParam[];
+export type FunctionCallOutputResource = string | InputContentResource[];
+export const functionCallStatusResourceValues = ["in_progress", "completed", "failed", "incomplete"] as const;
+export type FunctionCallStatusResource = (typeof functionCallStatusResourceValues)[number];
+export type HostedEnvironmentFileParam = HostedEnvironmentFileParamFileId | HostedEnvironmentFileParamInline;
+export interface HostedEnvironmentFileParamFileId {
+  type: "file_id";
+  file_id: string;
+  path: string;
+}
+export const hostedEnvironmentFileParamFileIdFields = ["type", "file_id", "path"] as const;
+export interface HostedEnvironmentFileParamInline {
+  type: "inline";
+  data: string;
+  path: string;
+}
+export const hostedEnvironmentFileParamInlineFields = ["type", "data", "path"] as const;
+export type HostedEnvironmentFileResource = HostedEnvironmentFileResourceFileId | HostedEnvironmentFileResourceInline;
+export interface HostedEnvironmentFileResourceFileId {
+  type: "file_id";
+  id: string;
+  file_id: string;
+  path: string;
+  size_bytes: number;
+}
+export const hostedEnvironmentFileResourceFileIdFields = ["type", "id", "file_id", "path", "size_bytes"] as const;
+export interface HostedEnvironmentFileResourceInline {
+  type: "inline";
+  id: string;
+  path: string;
+  size_bytes: number;
+}
+export const hostedEnvironmentFileResourceInlineFields = ["type", "id", "path", "size_bytes"] as const;
+export type HostedPluginParam = HostedPluginParamInline;
+export interface HostedPluginParamInline {
+  type: "inline";
+  name: string;
+  description: string;
+  source: InlineCapabilitySourceParam;
+}
+export const hostedPluginParamInlineFields = ["type", "name", "description", "source"] as const;
+export type HostedPluginResource = HostedPluginResourceInline;
+export interface HostedPluginResourceInline {
+  type: "inline";
+  name: string;
+  description: string;
+}
+export const hostedPluginResourceInlineFields = ["type", "name", "description"] as const;
+export type HostedSkillParam = HostedSkillParamSkillReference | HostedSkillParamInline;
+export interface HostedSkillParamInline {
+  type: "inline";
+  name: string;
+  description: string;
+  source: InlineCapabilitySourceParam;
+}
+export const hostedSkillParamInlineFields = ["type", "name", "description", "source"] as const;
+export interface HostedSkillParamSkillReference {
+  type: "skill_reference";
+  skill_id: string;
+  version?: string | null;
+}
+export const hostedSkillParamSkillReferenceFields = ["type", "skill_id", "version"] as const;
+export const hostedSkillParamSkillReferenceRequired = ["type", "skill_id"] as const;
+export type HostedSkillResource = HostedSkillResourceSkillReference | HostedSkillResourceInline;
+export interface HostedSkillResourceInline {
+  type: "inline";
+  name: string;
+  description: string;
+}
+export const hostedSkillResourceInlineFields = ["type", "name", "description"] as const;
+export interface HostedSkillResourceSkillReference {
+  type: "skill_reference";
+  skill_id: string;
+  version: string;
+  name: string;
+  description: string;
+}
+export const hostedSkillResourceSkillReferenceFields = ["type", "skill_id", "version", "name", "description"] as const;
+export type HostedTemplateFileResource = HostedTemplateFileResourceFileId | HostedTemplateFileResourceInline;
+export interface HostedTemplateFileResourceFileId {
+  type: "file_id";
+  file_id: string;
+  path: string;
+}
+export const hostedTemplateFileResourceFileIdFields = ["type", "file_id", "path"] as const;
+export interface HostedTemplateFileResourceInline {
+  type: "inline";
+  path: string;
+  size_bytes: number;
+}
+export const hostedTemplateFileResourceInlineFields = ["type", "path", "size_bytes"] as const;
+export type HostedTemplateSkillResource = HostedTemplateSkillResourceSkillReference | HostedTemplateSkillResourceInline;
+export interface HostedTemplateSkillResourceInline {
+  type: "inline";
+  name: string;
+  description: string;
+}
+export const hostedTemplateSkillResourceInlineFields = ["type", "name", "description"] as const;
+export interface HostedTemplateSkillResourceSkillReference {
+  type: "skill_reference";
+  skill_id: string;
+  version: string | null;
+}
+export const hostedTemplateSkillResourceSkillReferenceFields = ["type", "skill_id", "version"] as const;
+export type InlineCapabilitySourceParam = InlineCapabilitySourceParamBase64;
+export interface InlineCapabilitySourceParamBase64 {
+  type: "base64";
+  media_type: "application/zip";
+  data: string;
+}
+export const inlineCapabilitySourceParamBase64Fields = ["type", "media_type", "data"] as const;
+export type InputContentParam = InputContentParamInputText | InputContentParamInputImage;
+export interface InputContentParamInputImage {
+  type: "input_image";
+  image_url: string;
+}
+export const inputContentParamInputImageFields = ["type", "image_url"] as const;
+export interface InputContentParamInputText {
+  type: "input_text";
+  text: string;
+}
+export const inputContentParamInputTextFields = ["type", "text"] as const;
+export type InputContentResource = InputContentResourceInputText | InputContentResourceInputImage;
+export interface InputContentResourceInputImage {
+  type: "input_image";
+  image_url: string;
+}
+export const inputContentResourceInputImageFields = ["type", "image_url"] as const;
+export interface InputContentResourceInputText {
+  type: "input_text";
+  text: string;
+}
+export const inputContentResourceInputTextFields = ["type", "text"] as const;
+export interface InputMessageParam {
+  type?: "message";
+  role: "user";
+  content: InputContentParam[];
+}
+export const inputMessageParamFields = ["type", "role", "content"] as const;
+export const inputMessageParamRequired = ["role", "content"] as const;
+export interface InputTokensDetailsResource {
+  cached_tokens: number;
+}
+export const inputTokensDetailsResourceFields = ["cached_tokens"] as const;
+export interface InterruptSubagentCallItemResource {
+  type: "interrupt_subagent_call";
+  id: string;
+  turn_id: string;
+  status: FunctionCallStatusResource;
+  sender_agent_id: string;
+  recipient_agent_id: string;
+}
+export const interruptSubagentCallItemResourceFields = ["type", "id", "turn_id", "status", "sender_agent_id", "recipient_agent_id"] as const;
+export interface ListFilesResponse {
+  object: string;
+  data: OpenAIFile[];
+  first_id: string;
+  last_id: string;
+  has_more: boolean;
+}
+export const listFilesResponseFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export const listOrderParamValues = ["asc", "desc"] as const;
+export type ListOrderParam = (typeof listOrderParamValues)[number];
+export interface McpCallItemResource {
+  type: "mcp_call";
+  id: string;
+  turn_id: string;
+  server_label: string;
+  name: string;
+  arguments: unknown;
+  status: FunctionCallStatusResource;
+  output: unknown | null;
+  error: unknown | null;
+}
+export const mcpCallItemResourceFields = ["type", "id", "turn_id", "server_label", "name", "arguments", "status", "output", "error"] as const;
+export const mcpConnectionOriginParamValues = ["service", "environment"] as const;
+export type McpConnectionOriginParam = (typeof mcpConnectionOriginParamValues)[number];
+export const mcpConnectionOriginResourceValues = ["service", "environment"] as const;
+export type McpConnectionOriginResource = (typeof mcpConnectionOriginResourceValues)[number];
+export interface McpOauthRefreshResource {
+  token_endpoint: string;
+  client_id: string;
+  resource: string | null;
+  scope: string | null;
+  token_endpoint_auth: McpOauthTokenEndpointAuthResource;
+}
+export const mcpOauthRefreshResourceFields = ["token_endpoint", "client_id", "resource", "scope", "token_endpoint_auth"] as const;
+export type McpOauthTokenEndpointAuthResource = McpOauthTokenEndpointAuthResourceNone | McpOauthTokenEndpointAuthResourceClientSecretBasic | McpOauthTokenEndpointAuthResourceClientSecretPost;
+export interface McpOauthTokenEndpointAuthResourceClientSecretBasic {
+  type: "client_secret_basic";
+}
+export const mcpOauthTokenEndpointAuthResourceClientSecretBasicFields = ["type"] as const;
+export interface McpOauthTokenEndpointAuthResourceClientSecretPost {
+  type: "client_secret_post";
+}
+export const mcpOauthTokenEndpointAuthResourceClientSecretPostFields = ["type"] as const;
+export interface McpOauthTokenEndpointAuthResourceNone {
+  type: "none";
+}
+export const mcpOauthTokenEndpointAuthResourceNoneFields = ["type"] as const;
+export type McpTransportConfigParam = McpTransportConfigParamHttp | McpTransportConfigParamStdio;
+export interface McpTransportConfigParamHttp {
+  type: "http";
+  server_url: string;
+  authorization?: string | null;
+  headers?: Record<string, string> | null;
+}
+export const mcpTransportConfigParamHttpFields = ["type", "server_url", "authorization", "headers"] as const;
+export const mcpTransportConfigParamHttpRequired = ["type", "server_url"] as const;
+export interface McpTransportConfigParamStdio {
+  type: "stdio";
+  command: string;
+  args?: string[] | null;
+  cwd: string;
+  env?: Record<string, string> | null;
+  env_vars?: string[] | null;
+}
+export const mcpTransportConfigParamStdioFields = ["type", "command", "args", "cwd", "env", "env_vars"] as const;
+export const mcpTransportConfigParamStdioRequired = ["type", "command", "cwd"] as const;
+export type McpTransportResource = McpTransportResourceHttp | McpTransportResourceStdio;
+export interface McpTransportResourceHttp {
+  type: "http";
+  server_url: string;
+}
+export const mcpTransportResourceHttpFields = ["type", "server_url"] as const;
+export interface McpTransportResourceStdio {
+  type: "stdio";
+  command: string;
+  args: string[];
+  cwd: string;
+  env_vars: string[];
+}
+export const mcpTransportResourceStdioFields = ["type", "command", "args", "cwd", "env_vars"] as const;
+export type MessageContentResource = MessageContentResourceInputText | MessageContentResourceInputImage | MessageContentResourceOutputText;
+export interface MessageContentResourceInputImage {
+  type: "input_image";
+  image_url: string;
+}
+export const messageContentResourceInputImageFields = ["type", "image_url"] as const;
+export interface MessageContentResourceInputText {
+  type: "input_text";
+  text: string;
+}
+export const messageContentResourceInputTextFields = ["type", "text"] as const;
+export interface MessageContentResourceOutputText {
+  type: "output_text";
+  text: string;
+}
+export const messageContentResourceOutputTextFields = ["type", "text"] as const;
+export interface MessageItemResource {
+  type: "message";
+  id: string | null;
+  turn_id: string;
+  role: SessionMessageRoleResource;
+  content: MessageContentResource[];
+  status: OutputItemStatusResource;
+  phase: MessagePhaseResource | null;
+}
+export const messageItemResourceFields = ["type", "id", "turn_id", "role", "content", "status", "phase"] as const;
+export const messagePhaseResourceValues = ["commentary", "final_answer"] as const;
+export type MessagePhaseResource = (typeof messagePhaseResourceValues)[number];
+export interface MisalignmentErrorDetailsResource {
+  error_type?: _MisalignmentErrorType;
+  detailed_explanation?: string;
+  steer?: _MisalignmentSteer;
+}
+export const misalignmentErrorDetailsResourceFields = ["error_type", "detailed_explanation", "steer"] as const;
+export const misalignmentErrorDetailsResourceRequired = [] as const;
+export interface ModelProviderInput {
+  api_key: string;
+  base_url: string;
+  context_window?: number;
+  max_output_tokens?: number;
+  protocol: "anthropic" | "responses" | "chat_completions";
+}
+export const modelProviderInputFields = ["api_key", "base_url", "context_window", "max_output_tokens", "protocol"] as const;
+export const modelProviderInputRequired = ["api_key", "base_url", "protocol"] as const;
+export interface ModelProviderView {
+  api_key_configured: boolean;
+  base_url: string;
+  context_window?: number;
+  max_output_tokens?: number;
+  protocol: "anthropic" | "responses" | "chat_completions";
+}
+export const modelProviderViewFields = ["api_key_configured", "base_url", "context_window", "max_output_tokens", "protocol"] as const;
+export const modelProviderViewRequired = ["api_key_configured", "base_url", "protocol"] as const;
+export interface MultiAgentConfigCurrentParam {
+  enabled: boolean;
+  max_concurrent_subagents?: number;
+}
+export const multiAgentConfigCurrentParamFields = ["enabled", "max_concurrent_subagents"] as const;
+export const multiAgentConfigCurrentParamRequired = ["enabled"] as const;
+export interface MultiAgentConfigResource {
+  enabled: boolean;
+  max_concurrent_subagents: number | null;
+}
+export const multiAgentConfigResourceFields = ["enabled", "max_concurrent_subagents"] as const;
+export const networkAccessParamValues = ["enabled", "disabled", "restricted"] as const;
+export type NetworkAccessParam = (typeof networkAccessParamValues)[number];
+export const networkAccessResourceValues = ["enabled", "disabled", "restricted"] as const;
+export type NetworkAccessResource = (typeof networkAccessResourceValues)[number];
+export interface NetworkPolicyParam {
+  access: NetworkAccessParam;
+  allowed_domains?: string[] | null;
+}
+export const networkPolicyParamFields = ["access", "allowed_domains"] as const;
+export const networkPolicyParamRequired = ["access"] as const;
+export interface NetworkPolicyResource {
+  access: NetworkAccessResource;
+  allowed_domains: string[];
+}
+export const networkPolicyResourceFields = ["access", "allowed_domains"] as const;
+export interface OpenAIFile {
+  id: string;
+  bytes: number;
+  created_at: number;
+  expires_at?: number;
+  filename: string;
+  object: "file";
+  purpose: "assistants" | "assistants_output" | "batch" | "batch_output" | "fine-tune" | "fine-tune-results" | "vision" | "user_data";
+  status: "uploaded" | "processed" | "error";
+  status_details?: string;
+}
+export const openAIFileFields = ["id", "bytes", "created_at", "expires_at", "filename", "object", "purpose", "status", "status_details"] as const;
+export const openAIFileRequired = ["id", "object", "bytes", "created_at", "filename", "purpose", "status"] as const;
+export const orderEnumValues = ["asc", "desc"] as const;
+export type OrderEnum = (typeof orderEnumValues)[number];
+export const outputItemStatusResourceValues = ["in_progress", "completed", "incomplete"] as const;
+export type OutputItemStatusResource = (typeof outputItemStatusResourceValues)[number];
+export interface OutputTextResource {
+  type: "output_text";
+  text: string;
+}
+export const outputTextResourceFields = ["type", "text"] as const;
+export interface OutputTokensDetailsResource {
+  reasoning_tokens: number;
+}
+export const outputTokensDetailsResourceFields = ["reasoning_tokens"] as const;
+export type PersistedAgentToolConfigParam = PersistedAgentToolConfigParamFunction | PersistedAgentToolConfigParamToolSearch | PersistedAgentToolConfigParamProgrammaticToolCalling | PersistedAgentToolConfigParamMcp | PersistedAgentToolConfigParamWebSearch;
+export interface PersistedAgentToolConfigParamFunction {
+  type: "function";
+  name: string;
+  description: string;
+  parameters: Record<string, unknown>;
+  defer_loading?: boolean;
+}
+export const persistedAgentToolConfigParamFunctionFields = ["type", "name", "description", "parameters", "defer_loading"] as const;
+export const persistedAgentToolConfigParamFunctionRequired = ["type", "name", "description", "parameters"] as const;
+export interface PersistedAgentToolConfigParamMcp {
+  type: "mcp";
+  server_label: string;
+  credential_id?: string | null;
+  transport: PersistedMcpTransportConfigParam;
+  request_metadata?: Record<string, unknown> | null;
+  allowed_tools?: string[] | null;
+  required?: boolean;
+  connection_origin?: McpConnectionOriginParam | null;
+}
+export const persistedAgentToolConfigParamMcpFields = ["type", "server_label", "credential_id", "transport", "request_metadata", "allowed_tools", "required", "connection_origin"] as const;
+export const persistedAgentToolConfigParamMcpRequired = ["type", "server_label", "transport"] as const;
+export interface PersistedAgentToolConfigParamProgrammaticToolCalling {
+  type: "programmatic_tool_calling";
+  enabled?: boolean;
+}
+export const persistedAgentToolConfigParamProgrammaticToolCallingFields = ["type", "enabled"] as const;
+export const persistedAgentToolConfigParamProgrammaticToolCallingRequired = ["type"] as const;
+export interface PersistedAgentToolConfigParamToolSearch {
+  type: "tool_search";
+}
+export const persistedAgentToolConfigParamToolSearchFields = ["type"] as const;
+export interface PersistedAgentToolConfigParamWebSearch {
+  type: "web_search";
+  mode?: WebSearchModeParam | null;
+  context_size?: WebSearchContextSizeParam | null;
+  allowed_domains?: string[] | null;
+  location?: WebSearchLocationParam | null;
+}
+export const persistedAgentToolConfigParamWebSearchFields = ["type", "mode", "context_size", "allowed_domains", "location"] as const;
+export const persistedAgentToolConfigParamWebSearchRequired = ["type"] as const;
+export type PersistedAgentToolResource = PersistedAgentToolResourceFunction | PersistedAgentToolResourceToolSearch | PersistedAgentToolResourceProgrammaticToolCalling | PersistedAgentToolResourceMcp | PersistedAgentToolResourceWebSearch;
+export interface PersistedAgentToolResourceFunction {
+  type: "function";
+  name: string;
+  description: string;
+  parameters: Record<string, unknown>;
+  defer_loading: boolean;
+}
+export const persistedAgentToolResourceFunctionFields = ["type", "name", "description", "parameters", "defer_loading"] as const;
+export interface PersistedAgentToolResourceMcp {
+  type: "mcp";
+  server_label: string;
+  credential_id: string | null;
+  transport: PersistedMcpTransportResource;
+  request_metadata: Record<string, unknown>;
+  allowed_tools: string[] | null;
+  required: boolean;
+  connection_origin: McpConnectionOriginResource;
+}
+export const persistedAgentToolResourceMcpFields = ["type", "server_label", "credential_id", "transport", "request_metadata", "allowed_tools", "required", "connection_origin"] as const;
+export interface PersistedAgentToolResourceProgrammaticToolCalling {
+  type: "programmatic_tool_calling";
+  enabled: boolean;
+}
+export const persistedAgentToolResourceProgrammaticToolCallingFields = ["type", "enabled"] as const;
+export interface PersistedAgentToolResourceToolSearch {
+  type: "tool_search";
+}
+export const persistedAgentToolResourceToolSearchFields = ["type"] as const;
+export interface PersistedAgentToolResourceWebSearch {
+  type: "web_search";
+  mode: WebSearchModeResource;
+  context_size: WebSearchContextSizeResource;
+  allowed_domains: string[] | null;
+  location: WebSearchLocationResource | null;
+}
+export const persistedAgentToolResourceWebSearchFields = ["type", "mode", "context_size", "allowed_domains", "location"] as const;
+export type PersistedMcpTransportConfigParam = PersistedMcpTransportConfigParamHttp | PersistedMcpTransportConfigParamStdio;
+export interface PersistedMcpTransportConfigParamHttp {
+  type: "http";
+  server_url: string;
+  headers?: Record<string, string> | null;
+}
+export const persistedMcpTransportConfigParamHttpFields = ["type", "server_url", "headers"] as const;
+export const persistedMcpTransportConfigParamHttpRequired = ["type", "server_url"] as const;
+export interface PersistedMcpTransportConfigParamStdio {
+  type: "stdio";
+  command: string;
+  args?: string[] | null;
+  cwd: string;
+  env_vars?: string[] | null;
+}
+export const persistedMcpTransportConfigParamStdioFields = ["type", "command", "args", "cwd", "env_vars"] as const;
+export const persistedMcpTransportConfigParamStdioRequired = ["type", "command", "cwd"] as const;
+export type PersistedMcpTransportResource = PersistedMcpTransportResourceHttp | PersistedMcpTransportResourceStdio;
+export interface PersistedMcpTransportResourceHttp {
+  type: "http";
+  server_url: string;
+  headers: Record<string, string>;
+}
+export const persistedMcpTransportResourceHttpFields = ["type", "server_url", "headers"] as const;
+export interface PersistedMcpTransportResourceStdio {
+  type: "stdio";
+  command: string;
+  args: string[];
+  cwd: string;
+  env_vars: string[];
+}
+export const persistedMcpTransportResourceStdioFields = ["type", "command", "args", "cwd", "env_vars"] as const;
+export interface PublicEnvironmentResource {
+  id: string;
+  object: "agent.environment";
+  type: EnvironmentTypeResource;
+  status: EnvironmentStatusResource;
+  files: HostedEnvironmentFileResource[];
+  skills: HostedSkillResource[];
+  plugins: HostedPluginResource[];
+}
+export const publicEnvironmentResourceFields = ["id", "object", "type", "status", "files", "skills", "plugins"] as const;
+export const reasoningEffortParamValues = ["none", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
+export type ReasoningEffortParam = (typeof reasoningEffortParamValues)[number];
+export const reasoningEffortResourceValues = ["none", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
+export type ReasoningEffortResource = (typeof reasoningEffortResourceValues)[number];
+export interface ReasoningItemResource {
+  type: "reasoning";
+  id: string;
+  turn_id: string;
+  summary: SummaryTextResource[];
+  status: OutputItemStatusResource | null;
+}
+export const reasoningItemResourceFields = ["type", "id", "turn_id", "summary", "status"] as const;
+export interface ReasoningParam {
+  effort?: ReasoningEffortParam | null;
+  summary?: ReasoningSummaryParam | null;
+}
+export const reasoningParamFields = ["effort", "summary"] as const;
+export const reasoningParamRequired = [] as const;
+export interface ReasoningResource {
+  effort: ReasoningEffortResource | null;
+  summary: ReasoningSummaryResource | null;
+}
+export const reasoningResourceFields = ["effort", "summary"] as const;
+export const reasoningSummaryParamValues = ["concise", "detailed", "auto"] as const;
+export type ReasoningSummaryParam = (typeof reasoningSummaryParamValues)[number];
+export const reasoningSummaryResourceValues = ["concise", "detailed", "auto"] as const;
+export type ReasoningSummaryResource = (typeof reasoningSummaryResourceValues)[number];
+export interface ResumeSubagentCallItemResource {
+  type: "resume_subagent_call";
+  id: string;
+  turn_id: string;
+  status: FunctionCallStatusResource;
+  sender_agent_id: string;
+  recipient_agent_id: string;
+}
+export const resumeSubagentCallItemResourceFields = ["type", "id", "turn_id", "status", "sender_agent_id", "recipient_agent_id"] as const;
+export interface RotateMcpOauthRefreshParam {
+  refresh_token?: string | null;
+  scope?: string | null;
+  token_endpoint_auth?: RotateMcpOauthTokenEndpointAuthParam | null;
+}
+export const rotateMcpOauthRefreshParamFields = ["refresh_token", "scope", "token_endpoint_auth"] as const;
+export const rotateMcpOauthRefreshParamRequired = [] as const;
+export type RotateMcpOauthTokenEndpointAuthParam = RotateMcpOauthTokenEndpointAuthParamClientSecretBasic | RotateMcpOauthTokenEndpointAuthParamClientSecretPost;
+export interface RotateMcpOauthTokenEndpointAuthParamClientSecretBasic {
+  type: "client_secret_basic";
+  client_secret?: string | null;
+}
+export const rotateMcpOauthTokenEndpointAuthParamClientSecretBasicFields = ["type", "client_secret"] as const;
+export const rotateMcpOauthTokenEndpointAuthParamClientSecretBasicRequired = ["type"] as const;
+export interface RotateMcpOauthTokenEndpointAuthParamClientSecretPost {
+  type: "client_secret_post";
+  client_secret?: string | null;
+}
+export const rotateMcpOauthTokenEndpointAuthParamClientSecretPostFields = ["type", "client_secret"] as const;
+export const rotateMcpOauthTokenEndpointAuthParamClientSecretPostRequired = ["type"] as const;
+export type RotateVaultCredentialAuthParam = RotateVaultCredentialAuthParamMcpOauth | RotateVaultCredentialAuthParamStaticBearer;
+export interface RotateVaultCredentialAuthParamMcpOauth {
+  type: "mcp_oauth";
+  access_token?: string | null;
+  expires_at?: string | null;
+  refresh?: RotateMcpOauthRefreshParam | null;
+}
+export const rotateVaultCredentialAuthParamMcpOauthFields = ["type", "access_token", "expires_at", "refresh"] as const;
+export const rotateVaultCredentialAuthParamMcpOauthRequired = ["type"] as const;
+export interface RotateVaultCredentialAuthParamStaticBearer {
+  type: "static_bearer";
+  token: string;
+}
+export const rotateVaultCredentialAuthParamStaticBearerFields = ["type", "token"] as const;
+export interface RotateVaultCredentialParams {
+  auth: RotateVaultCredentialAuthParam;
+}
+export const rotateVaultCredentialParamsFields = ["auth"] as const;
+export interface SavedAgentCore {
+  harness?: "claude_sdk" | "codex" | "mcode";
+  harness_config?: Record<string, unknown>;
+  model_provider?: ModelProviderView;
+}
+export const savedAgentCoreFields = ["harness", "harness_config", "model_provider"] as const;
+export const savedAgentCoreRequired = [] as const;
+export interface SavedAgentCoreInput {
+  harness?: "claude_sdk" | "codex" | "mcode";
+  harness_config?: Record<string, unknown>;
+  model_provider?: ModelProviderInput | null;
+}
+export const savedAgentCoreInputFields = ["harness", "harness_config", "model_provider"] as const;
+export const savedAgentCoreInputRequired = [] as const;
+export interface SendSubagentInputCallItemResource {
+  type: "send_subagent_input_call";
+  id: string;
+  turn_id: string;
+  status: FunctionCallStatusResource;
+  sender_agent_id: string;
+  recipient_agent_id: string;
+  content: AgentContentResource[];
+}
+export const sendSubagentInputCallItemResourceFields = ["type", "id", "turn_id", "status", "sender_agent_id", "recipient_agent_id", "content"] as const;
+export const serviceTierParamValues = ["auto", "default", "flex", "priority", "fast"] as const;
+export type ServiceTierParam = (typeof serviceTierParamValues)[number];
+export const serviceTierResourceValues = ["auto", "default", "flex", "priority", "fast"] as const;
+export type ServiceTierResource = (typeof serviceTierResourceValues)[number];
+export interface SessionAgentConfigParam {
+  model?: string;
+  reasoning?: ReasoningParam | null;
+  text?: TextParam | null;
+  service_tier?: ServiceTierParam | null;
+  instructions?: string | null;
+  multi_agent?: MultiAgentConfigCurrentParam | null;
+  tools?: AgentToolConfigParam[] | null;
+  x_agents_core?: AgentsCore | null;
+}
+export const sessionAgentConfigParamFields = ["model", "reasoning", "text", "service_tier", "instructions", "multi_agent", "tools", "x_agents_core"] as const;
+export const sessionAgentConfigParamRequired = [] as const;
+export interface SessionAgentResource {
+  id: string;
+  name: string | null;
+  model: string;
+  reasoning: ReasoningResource;
+  text: TextResource;
+  service_tier: ServiceTierResource;
+  instructions: string | null;
+  tools: AgentToolResource[];
+  multi_agent: MultiAgentConfigResource;
+  x_agents_core?: AgentsCore | null;
+}
+export const sessionAgentResourceFields = ["id", "name", "model", "reasoning", "text", "service_tier", "instructions", "tools", "multi_agent", "x_agents_core"] as const;
+export const sessionAgentResourceRequired = ["id", "name", "model", "reasoning", "text", "service_tier", "instructions", "tools", "multi_agent"] as const;
+export interface SessionArtifactListResource {
+  object: "list";
+  data: SessionArtifactResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const sessionArtifactListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface SessionArtifactResource {
+  id: string;
+  object: "agent.session.artifact";
+  session_id: string;
+  environment_id: string;
+  turn_id: string;
+  path: string;
+  size_bytes: number;
+  created_at: number;
+}
+export const sessionArtifactResourceFields = ["id", "object", "session_id", "environment_id", "turn_id", "path", "size_bytes", "created_at"] as const;
+export interface SessionCore {
+  installation?: EnvironmentInstallation;
+}
+export const sessionCoreFields = ["installation"] as const;
+export const sessionCoreRequired = [] as const;
+export interface SessionEnvironmentErrorResource {
+  type: string;
+  code: string;
+  message: string;
+}
+export const sessionEnvironmentErrorResourceFields = ["type", "code", "message"] as const;
+export interface SessionEnvironmentStateResource {
+  id: string;
+  type: string;
+  status: SessionEnvironmentStatusResource;
+  error: SessionEnvironmentErrorResource | null;
+}
+export const sessionEnvironmentStateResourceFields = ["id", "type", "status", "error"] as const;
+export const sessionEnvironmentStatusResourceValues = ["pending", "ready", "connected", "disconnected", "failed"] as const;
+export type SessionEnvironmentStatusResource = (typeof sessionEnvironmentStatusResourceValues)[number];
+export interface SessionErrorResource {
+  type: string;
+  code: string | null;
+  message: string;
+  param: string | null;
+}
+export const sessionErrorResourceFields = ["type", "code", "message", "param"] as const;
+export type SessionEvent = SessionEventError | SessionEventAgentSessionEnvironmentReady | SessionEventAgentOutputCommandExecutionOutputDelta | SessionEventAgentSessionCreated | SessionEventAgentSessionTurnCreated | SessionEventAgentSessionTurnInProgress | SessionEventAgentSessionTurnCompleted | SessionEventAgentSessionTurnFailed | SessionEventAgentSessionTurnCancelled | SessionEventAgentSessionTurnItemAdded | SessionEventAgentSessionIdle | SessionEventAgentSessionInProgress | SessionEventAgentSessionRequiresAction | SessionEventAgentSessionFailed | SessionEventAgentSessionEnvironmentPending | SessionEventAgentSessionEnvironmentConnected | SessionEventAgentSessionEnvironmentDisconnected | SessionEventAgentSessionEnvironmentFailed | SessionEventAgentSessionSubagentCreated | SessionEventAgentSessionSubagentActive | SessionEventAgentSessionSubagentClosed | SessionEventAgentSessionTurnItemDone | SessionEventAgentSessionTurnContentPartAdded | SessionEventAgentSessionTurnContentPartDone | SessionEventAgentSessionTurnOutputTextDelta | SessionEventAgentSessionTurnOutputTextDone | SessionEventAgentSessionTurnReasoningSummaryPartAdded | SessionEventAgentSessionTurnReasoningSummaryPartDone | SessionEventAgentSessionTurnReasoningSummaryTextDelta | SessionEventAgentSessionTurnReasoningSummaryTextDone;
+export interface SessionEventAgentOutputCommandExecutionOutputDelta {
+  type: "agent.output.command_execution_output.delta";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  delta: string;
+}
+export const sessionEventAgentOutputCommandExecutionOutputDeltaFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "delta"] as const;
+export interface SessionEventAgentSessionCreated {
+  type: "agent.session.created";
+  event_id: string;
+  session: SessionResource;
+}
+export const sessionEventAgentSessionCreatedFields = ["type", "event_id", "session"] as const;
+export interface SessionEventAgentSessionEnvironmentConnected {
+  type: "agent.session.environment.connected";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  environment: SessionEnvironmentStateResource;
+}
+export const sessionEventAgentSessionEnvironmentConnectedFields = ["type", "event_id", "session_id", "turn_id", "environment"] as const;
+export interface SessionEventAgentSessionEnvironmentDisconnected {
+  type: "agent.session.environment.disconnected";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  environment: SessionEnvironmentStateResource;
+}
+export const sessionEventAgentSessionEnvironmentDisconnectedFields = ["type", "event_id", "session_id", "turn_id", "environment"] as const;
+export interface SessionEventAgentSessionEnvironmentFailed {
+  type: "agent.session.environment.failed";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  environment: SessionEnvironmentStateResource;
+}
+export const sessionEventAgentSessionEnvironmentFailedFields = ["type", "event_id", "session_id", "turn_id", "environment"] as const;
+export interface SessionEventAgentSessionEnvironmentPending {
+  type: "agent.session.environment.pending";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  environment: SessionEnvironmentStateResource;
+}
+export const sessionEventAgentSessionEnvironmentPendingFields = ["type", "event_id", "session_id", "turn_id", "environment"] as const;
+export interface SessionEventAgentSessionEnvironmentReady {
+  type: "agent.session.environment.ready";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  environment: SessionEnvironmentStateResource;
+}
+export const sessionEventAgentSessionEnvironmentReadyFields = ["type", "event_id", "session_id", "turn_id", "environment"] as const;
+export interface SessionEventAgentSessionFailed {
+  type: "agent.session.failed";
+  event_id: string;
+  session: SessionResource;
+}
+export const sessionEventAgentSessionFailedFields = ["type", "event_id", "session"] as const;
+export interface SessionEventAgentSessionIdle {
+  type: "agent.session.idle";
+  event_id: string;
+  session: SessionResource;
+}
+export const sessionEventAgentSessionIdleFields = ["type", "event_id", "session"] as const;
+export interface SessionEventAgentSessionInProgress {
+  type: "agent.session.in_progress";
+  event_id: string;
+  session: SessionResource;
+}
+export const sessionEventAgentSessionInProgressFields = ["type", "event_id", "session"] as const;
+export interface SessionEventAgentSessionRequiresAction {
+  type: "agent.session.requires_action";
+  event_id: string;
+  session: SessionResource;
+}
+export const sessionEventAgentSessionRequiresActionFields = ["type", "event_id", "session"] as const;
+export interface SessionEventAgentSessionSubagentActive {
+  type: "agent.session.subagent.active";
+  event_id: string;
+  subagent: SubagentResource;
+}
+export const sessionEventAgentSessionSubagentActiveFields = ["type", "event_id", "subagent"] as const;
+export interface SessionEventAgentSessionSubagentClosed {
+  type: "agent.session.subagent.closed";
+  event_id: string;
+  subagent: SubagentResource;
+}
+export const sessionEventAgentSessionSubagentClosedFields = ["type", "event_id", "subagent"] as const;
+export interface SessionEventAgentSessionSubagentCreated {
+  type: "agent.session.subagent.created";
+  event_id: string;
+  subagent: SubagentResource;
+}
+export const sessionEventAgentSessionSubagentCreatedFields = ["type", "event_id", "subagent"] as const;
+export interface SessionEventAgentSessionTurnCancelled {
+  type: "agent.session.turn.cancelled";
+  event_id: string;
+  session_id: string;
+  turn_id: string;
+  turn: TurnResource;
+  usage: TokenUsageResource | null;
+}
+export const sessionEventAgentSessionTurnCancelledFields = ["type", "event_id", "session_id", "turn_id", "turn", "usage"] as const;
+export interface SessionEventAgentSessionTurnCompleted {
+  type: "agent.session.turn.completed";
+  event_id: string;
+  session_id: string;
+  turn_id: string;
+  turn: TurnResource;
+  usage: TokenUsageResource | null;
+}
+export const sessionEventAgentSessionTurnCompletedFields = ["type", "event_id", "session_id", "turn_id", "turn", "usage"] as const;
+export interface SessionEventAgentSessionTurnContentPartAdded {
+  type: "agent.session.turn.content_part.added";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  content_index: number;
+  part: OutputTextResource;
+}
+export const sessionEventAgentSessionTurnContentPartAddedFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "content_index", "part"] as const;
+export interface SessionEventAgentSessionTurnContentPartDone {
+  type: "agent.session.turn.content_part.done";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  content_index: number;
+  part: OutputTextResource;
+}
+export const sessionEventAgentSessionTurnContentPartDoneFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "content_index", "part"] as const;
+export interface SessionEventAgentSessionTurnCreated {
+  type: "agent.session.turn.created";
+  event_id: string;
+  session_id: string;
+  turn_id: string;
+  turn: TurnResource;
+}
+export const sessionEventAgentSessionTurnCreatedFields = ["type", "event_id", "session_id", "turn_id", "turn"] as const;
+export interface SessionEventAgentSessionTurnFailed {
+  type: "agent.session.turn.failed";
+  event_id: string;
+  session_id: string;
+  turn_id: string;
+  turn: TurnResource;
+  usage: TokenUsageResource | null;
+}
+export const sessionEventAgentSessionTurnFailedFields = ["type", "event_id", "session_id", "turn_id", "turn", "usage"] as const;
+export interface SessionEventAgentSessionTurnInProgress {
+  type: "agent.session.turn.in_progress";
+  event_id: string;
+  session_id: string;
+  turn_id: string;
+  turn: TurnResource;
+}
+export const sessionEventAgentSessionTurnInProgressFields = ["type", "event_id", "session_id", "turn_id", "turn"] as const;
+export interface SessionEventAgentSessionTurnItemAdded {
+  type: "agent.session.turn.item.added";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  output_index: number | null;
+  item: SessionTurnItemResource;
+}
+export const sessionEventAgentSessionTurnItemAddedFields = ["type", "event_id", "session_id", "turn_id", "output_index", "item"] as const;
+export interface SessionEventAgentSessionTurnItemDone {
+  type: "agent.session.turn.item.done";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  output_index: number;
+  item: AgentOutputItemResource;
+}
+export const sessionEventAgentSessionTurnItemDoneFields = ["type", "event_id", "session_id", "turn_id", "output_index", "item"] as const;
+export interface SessionEventAgentSessionTurnOutputTextDelta {
+  type: "agent.session.turn.output_text.delta";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  content_index: number;
+  delta: string;
+}
+export const sessionEventAgentSessionTurnOutputTextDeltaFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "content_index", "delta"] as const;
+export interface SessionEventAgentSessionTurnOutputTextDone {
+  type: "agent.session.turn.output_text.done";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  content_index: number;
+  text: string;
+}
+export const sessionEventAgentSessionTurnOutputTextDoneFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "content_index", "text"] as const;
+export interface SessionEventAgentSessionTurnReasoningSummaryPartAdded {
+  type: "agent.session.turn.reasoning_summary_part.added";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  summary_index: number;
+  part: SummaryTextResource;
+}
+export const sessionEventAgentSessionTurnReasoningSummaryPartAddedFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "summary_index", "part"] as const;
+export interface SessionEventAgentSessionTurnReasoningSummaryPartDone {
+  type: "agent.session.turn.reasoning_summary_part.done";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  summary_index: number;
+  part: SummaryTextResource;
+  status: "incomplete" | null;
+}
+export const sessionEventAgentSessionTurnReasoningSummaryPartDoneFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "summary_index", "part", "status"] as const;
+export interface SessionEventAgentSessionTurnReasoningSummaryTextDelta {
+  type: "agent.session.turn.reasoning_summary_text.delta";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  summary_index: number;
+  delta: string;
+}
+export const sessionEventAgentSessionTurnReasoningSummaryTextDeltaFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "summary_index", "delta"] as const;
+export interface SessionEventAgentSessionTurnReasoningSummaryTextDone {
+  type: "agent.session.turn.reasoning_summary_text.done";
+  event_id: string;
+  session_id: string;
+  turn_id: string | null;
+  item_id: string;
+  output_index: number;
+  summary_index: number;
+  text: string;
+}
+export const sessionEventAgentSessionTurnReasoningSummaryTextDoneFields = ["type", "event_id", "session_id", "turn_id", "item_id", "output_index", "summary_index", "text"] as const;
+export interface SessionEventError {
+  type: "error";
+  event_id: string;
+  session_id: string;
+  error: SessionErrorResource;
+}
+export const sessionEventErrorFields = ["type", "event_id", "session_id", "error"] as const;
+export interface SessionExecutionInput {
+  environment?: Record<string, unknown>;
+  harness_config?: Record<string, unknown>;
+  model_provider?: ModelProviderInput;
+}
+export const sessionExecutionInputFields = ["environment", "harness_config", "model_provider"] as const;
+export const sessionExecutionInputRequired = [] as const;
+export type SessionInputParam = SessionInputParamAgentSessionInputMessage | SessionInputParamAgentSessionInputCancel | SessionInputParamAgentSessionInputToolResult;
+export interface SessionInputParamAgentSessionInputCancel {
+  type: "agent.session.input.cancel";
+}
+export const sessionInputParamAgentSessionInputCancelFields = ["type"] as const;
+export interface SessionInputParamAgentSessionInputMessage {
+  type: "agent.session.input.message";
+  input: InputMessageParam[];
+}
+export const sessionInputParamAgentSessionInputMessageFields = ["type", "input"] as const;
+export interface SessionInputParamAgentSessionInputToolResult {
+  type: "agent.session.input.tool_result";
+  turn_id: string;
+  call_id: string;
+  success: boolean;
+  output?: FunctionCallOutputParam | null;
+  error?: string | null;
+}
+export const sessionInputParamAgentSessionInputToolResultFields = ["type", "turn_id", "call_id", "success", "output", "error"] as const;
+export const sessionInputParamAgentSessionInputToolResultRequired = ["type", "turn_id", "call_id", "success"] as const;
+export interface SessionItemListResource {
+  object: "list";
+  data: SessionTurnItemResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const sessionItemListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface SessionListResource {
+  object: "list";
+  data: SessionResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const sessionListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export const sessionMessageRoleResourceValues = ["user", "assistant"] as const;
+export type SessionMessageRoleResource = (typeof sessionMessageRoleResourceValues)[number];
+export type SessionRequiredActionResource = SessionRequiredActionResourceFunctionCall | SessionRequiredActionResourceEnvironmentConnection;
+export interface SessionRequiredActionResourceEnvironmentConnection {
+  type: "environment_connection";
+  environment_id: string;
+}
+export const sessionRequiredActionResourceEnvironmentConnectionFields = ["type", "environment_id"] as const;
+export interface SessionRequiredActionResourceFunctionCall {
+  type: "function_call";
+  turn_id: string;
+  call_id: string;
+  name: string;
+  arguments: unknown;
+}
+export const sessionRequiredActionResourceFunctionCallFields = ["type", "turn_id", "call_id", "name", "arguments"] as const;
+export interface SessionResource {
+  metadata: Record<string, string>;
+  id: string;
+  object: "agent.session";
+  created_at: number;
+  last_active_at: number;
+  status: SessionStatusResource;
+  required_actions: SessionRequiredActionResource[];
+  error: string | null;
+  agent: SessionAgentResource;
+  environment: EnvironmentResource;
+  vault_ids: string[];
+  usage: TokenUsageResource | null;
+  x_agents_core?: SessionCore | null;
+}
+export const sessionResourceFields = ["metadata", "id", "object", "created_at", "last_active_at", "status", "required_actions", "error", "agent", "environment", "vault_ids", "usage", "x_agents_core"] as const;
+export const sessionResourceRequired = ["metadata", "id", "object", "created_at", "last_active_at", "status", "required_actions", "error", "agent", "environment", "vault_ids", "usage"] as const;
+export const sessionStatusResourceValues = ["idle", "in_progress", "requires_action", "failed"] as const;
+export type SessionStatusResource = (typeof sessionStatusResourceValues)[number];
+export const sessionTurnErrorCodeResourceValues = ["context_length_exceeded", "session_budget_exceeded", "usage_limit_exceeded", "rate_limit_exceeded", "server_overloaded", "cyber_policy", "connection_failed", "server_error", "authentication_error", "invalid_request", "resource_not_found", "sandbox_error", "executor_version_incompatible", "active_turn_not_steerable", "request_timeout", "internal_error"] as const;
+export type SessionTurnErrorCodeResource = (typeof sessionTurnErrorCodeResourceValues)[number];
+export interface SessionTurnErrorResource {
+  code: SessionTurnErrorCodeResource;
+  message: string;
+}
+export const sessionTurnErrorResourceFields = ["code", "message"] as const;
+export type SessionTurnItemResource = MessageItemResource | ReasoningItemResource | FunctionCallItemResource | FunctionCallOutputItemResource | AgentMessageItemResource | McpCallItemResource | WebSearchCallItemResource | CommandExecutionItemResource | CreateSubagentCallItemResource | SendSubagentInputCallItemResource | ResumeSubagentCallItemResource | WaitForSubagentsCallItemResource | InterruptSubagentCallItemResource | CloseSubagentCallItemResource;
+export interface SessionTurnListResource {
+  object: "list";
+  data: TurnResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const sessionTurnListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface SetDefaultSkillVersionBody {
+  default_version: string;
+}
+export const setDefaultSkillVersionBodyFields = ["default_version"] as const;
+export interface SetupCommandParam {
+  command: string;
+  cwd?: string | null;
+}
+export const setupCommandParamFields = ["command", "cwd"] as const;
+export const setupCommandParamRequired = ["command"] as const;
+export interface SkillListResource {
+  object: "list";
+  data: SkillResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const skillListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface SkillResource {
+  id: string;
+  object: "skill";
+  name: string;
+  description: string;
+  created_at: number;
+  default_version: string;
+  latest_version: string;
+}
+export const skillResourceFields = ["id", "object", "name", "description", "created_at", "default_version", "latest_version"] as const;
+export interface SkillVersionListResource {
+  object: "list";
+  data: SkillVersionResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const skillVersionListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface SkillVersionResource {
+  object: "skill.version";
+  id: string;
+  skill_id: string;
+  version: string;
+  created_at: number;
+  name: string;
+  description: string;
+}
+export const skillVersionResourceFields = ["object", "id", "skill_id", "version", "created_at", "name", "description"] as const;
+export const subagentObjectResourceValues = ["agent.session.subagent"] as const;
+export type SubagentObjectResource = (typeof subagentObjectResourceValues)[number];
+export interface SubagentResource {
+  id: string;
+  object: SubagentObjectResource;
+  session_id: string;
+  name: string | null;
+  instructions: AgentContentResource[] | null;
+  parent_agent_id: string;
+  status: SubagentStatusResource;
+  opened_at: number;
+  closed_at: number | null;
+}
+export const subagentResourceFields = ["id", "object", "session_id", "name", "instructions", "parent_agent_id", "status", "opened_at", "closed_at"] as const;
+export const subagentStatusResourceValues = ["active", "closed"] as const;
+export type SubagentStatusResource = (typeof subagentStatusResourceValues)[number];
+export interface SummaryTextResource {
+  type: "summary_text";
+  text: string;
+}
+export const summaryTextResourceFields = ["type", "text"] as const;
+export type TextFormatParam = TextFormatParamText | TextFormatParamJsonSchema;
+export interface TextFormatParamJsonSchema {
+  type: "json_schema";
+  schema: Record<string, unknown>;
+}
+export const textFormatParamJsonSchemaFields = ["type", "schema"] as const;
+export interface TextFormatParamText {
+  type: "text";
+}
+export const textFormatParamTextFields = ["type"] as const;
+export type TextFormatResource = TextFormatResourceText | TextFormatResourceJsonSchema;
+export interface TextFormatResourceJsonSchema {
+  type: "json_schema";
+  schema: Record<string, unknown>;
+}
+export const textFormatResourceJsonSchemaFields = ["type", "schema"] as const;
+export interface TextFormatResourceText {
+  type: "text";
+}
+export const textFormatResourceTextFields = ["type"] as const;
+export interface TextParam {
+  format?: TextFormatParam | null;
+  verbosity?: VerbosityParam | null;
+}
+export const textParamFields = ["format", "verbosity"] as const;
+export const textParamRequired = [] as const;
+export interface TextResource {
+  format: TextFormatResource;
+  verbosity: VerbosityResource;
+}
+export const textResourceFields = ["format", "verbosity"] as const;
+export interface TokenUsageResource {
+  input_tokens: number;
+  input_tokens_details: InputTokensDetailsResource;
+  output_tokens: number;
+  output_tokens_details: OutputTokensDetailsResource;
+  total_tokens: number;
+}
+export const tokenUsageResourceFields = ["input_tokens", "input_tokens_details", "output_tokens", "output_tokens_details", "total_tokens"] as const;
+export const turnObjectResourceValues = ["agent.session.turn"] as const;
+export type TurnObjectResource = (typeof turnObjectResourceValues)[number];
+export interface TurnResource {
+  id: string;
+  object: TurnObjectResource;
+  session_id: string;
+  agent_id: string;
+  subagent_id: string | null;
+  status: TurnStatusResource;
+  created_at: number;
+  started_at: number | null;
+  completed_at: number | null;
+  error: SessionTurnErrorResource | null;
+  usage: TokenUsageResource | null;
+}
+export const turnResourceFields = ["id", "object", "session_id", "agent_id", "subagent_id", "status", "created_at", "started_at", "completed_at", "error", "usage"] as const;
+export const turnStatusResourceValues = ["queued", "in_progress", "waiting", "completed", "failed", "cancelled"] as const;
+export type TurnStatusResource = (typeof turnStatusResourceValues)[number];
+export interface UpdateAgentParams {
+  model?: string;
+  reasoning?: ReasoningParam | null;
+  text?: TextParam | null;
+  service_tier?: ServiceTierParam | null;
+  instructions?: string | null;
+  multi_agent?: MultiAgentConfigCurrentParam | null;
+  metadata?: Record<string, string> | null;
+  name?: string | null;
+  tools?: PersistedAgentToolConfigParam[] | null;
+  x_agents_core?: SavedAgentCoreInput | null;
+}
+export const updateAgentParamsFields = ["model", "reasoning", "text", "service_tier", "instructions", "multi_agent", "metadata", "name", "tools", "x_agents_core"] as const;
+export const updateAgentParamsRequired = [] as const;
+export interface UpdateAgentSessionParams {
+  metadata?: Record<string, string> | null;
+}
+export const updateAgentSessionParamsFields = ["metadata"] as const;
+export const updateAgentSessionParamsRequired = [] as const;
+export interface UpdateEnvironmentTemplateParams {
+  name?: string | null;
+  packages?: EnvironmentPackagesParam | null;
+  setup_commands?: SetupCommandParam[] | null;
+  network?: NetworkPolicyParam | null;
+  env?: Record<string, string> | null;
+  capability_directories?: string[] | null;
+  skills?: HostedSkillParam[] | null;
+  plugins?: HostedPluginParam[] | null;
+  files?: HostedEnvironmentFileParam[] | null;
+}
+export const updateEnvironmentTemplateParamsFields = ["name", "packages", "setup_commands", "network", "env", "capability_directories", "skills", "plugins", "files"] as const;
+export const updateEnvironmentTemplateParamsRequired = [] as const;
+export type VaultCredentialAuthResource = VaultCredentialAuthResourceMcpOauth | VaultCredentialAuthResourceStaticBearer;
+export interface VaultCredentialAuthResourceMcpOauth {
+  type: "mcp_oauth";
+  mcp_server_url: string;
+  expires_at: string | null;
+  refresh: McpOauthRefreshResource | null;
+}
+export const vaultCredentialAuthResourceMcpOauthFields = ["type", "mcp_server_url", "expires_at", "refresh"] as const;
+export interface VaultCredentialAuthResourceStaticBearer {
+  type: "static_bearer";
+  mcp_server_url: string;
+}
+export const vaultCredentialAuthResourceStaticBearerFields = ["type", "mcp_server_url"] as const;
+export interface VaultCredentialListResource {
+  object: "list";
+  data: VaultCredentialResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const vaultCredentialListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface VaultCredentialResource {
+  id: string;
+  object: "vault.credential";
+  vault_id: string;
+  name: string;
+  auth: VaultCredentialAuthResource;
+  created_at: number;
+  updated_at: number;
+}
+export const vaultCredentialResourceFields = ["id", "object", "vault_id", "name", "auth", "created_at", "updated_at"] as const;
+export interface VaultListResource {
+  object: "list";
+  data: VaultResource[];
+  first_id: string | null;
+  last_id: string | null;
+  has_more: boolean;
+}
+export const vaultListResourceFields = ["object", "data", "first_id", "last_id", "has_more"] as const;
+export interface VaultResource {
+  id: string;
+  object: "vault";
+  name: string | null;
+  metadata: Record<string, string>;
+  created_at: number;
+}
+export const vaultResourceFields = ["id", "object", "name", "metadata", "created_at"] as const;
+export type VaultStatusFilterParam = VaultStatusParam | VaultStatusParam[];
+export const vaultStatusParamValues = ["active", "archived"] as const;
+export type VaultStatusParam = (typeof vaultStatusParamValues)[number];
+export const verbosityParamValues = ["low", "medium", "high"] as const;
+export type VerbosityParam = (typeof verbosityParamValues)[number];
+export const verbosityResourceValues = ["low", "medium", "high"] as const;
+export type VerbosityResource = (typeof verbosityResourceValues)[number];
+export interface WaitForSubagentsCallItemResource {
+  type: "wait_for_subagents_call";
+  id: string;
+  turn_id: string;
+  status: FunctionCallStatusResource;
+  sender_agent_id: string;
+  recipient_agent_ids: string[];
+}
+export const waitForSubagentsCallItemResourceFields = ["type", "id", "turn_id", "status", "sender_agent_id", "recipient_agent_ids"] as const;
+export type WebSearchActionResource = WebSearchActionResourceSearch | WebSearchActionResourceOpenPage | WebSearchActionResourceFindInPage | WebSearchActionResourceOther;
+export interface WebSearchActionResourceFindInPage {
+  type: "find_in_page";
+  url: string | null;
+  pattern: string | null;
+}
+export const webSearchActionResourceFindInPageFields = ["type", "url", "pattern"] as const;
+export interface WebSearchActionResourceOpenPage {
+  type: "open_page";
+  url: string | null;
+}
+export const webSearchActionResourceOpenPageFields = ["type", "url"] as const;
+export interface WebSearchActionResourceOther {
+  type: "other";
+}
+export const webSearchActionResourceOtherFields = ["type"] as const;
+export interface WebSearchActionResourceSearch {
+  type: "search";
+  query: string | null;
+  queries: string[] | null;
+}
+export const webSearchActionResourceSearchFields = ["type", "query", "queries"] as const;
+export interface WebSearchCallItemResource {
+  type: "web_search_call";
+  id: string;
+  turn_id: string;
+  status: OutputItemStatusResource;
+  action: WebSearchActionResource | null;
+}
+export const webSearchCallItemResourceFields = ["type", "id", "turn_id", "status", "action"] as const;
+export const webSearchContextSizeParamValues = ["low", "medium", "high"] as const;
+export type WebSearchContextSizeParam = (typeof webSearchContextSizeParamValues)[number];
+export const webSearchContextSizeResourceValues = ["low", "medium", "high"] as const;
+export type WebSearchContextSizeResource = (typeof webSearchContextSizeResourceValues)[number];
+export interface WebSearchLocationParam {
+  country?: string | null;
+  region?: string | null;
+  city?: string | null;
+  timezone?: string | null;
+}
+export const webSearchLocationParamFields = ["country", "region", "city", "timezone"] as const;
+export const webSearchLocationParamRequired = [] as const;
+export interface WebSearchLocationResource {
+  country: string | null;
+  region: string | null;
+  city: string | null;
+  timezone: string | null;
+}
+export const webSearchLocationResourceFields = ["country", "region", "city", "timezone"] as const;
+export const webSearchModeParamValues = ["disabled", "cached", "live"] as const;
+export type WebSearchModeParam = (typeof webSearchModeParamValues)[number];
+export const webSearchModeResourceValues = ["disabled", "cached", "live"] as const;
+export type WebSearchModeResource = (typeof webSearchModeResourceValues)[number];
+export type _MisalignmentErrorType = string | "potentially_unintended_data_transfer" | "potentially_unintended_data_access" | "potentially_unintended_destructive_activity" | "other";
+export interface _MisalignmentSteer {
+  message: string;
+}
+export const _MisalignmentSteerFields = ["message"] as const;
+export const agentContentResourceFields = {
+  "output_text": outputTextResourceFields,
+  "encrypted_content": encryptedContentResourceFields,
+} as const;
+export const agentOutputItemResourceFields = {
+  "message": assistantMessageItemResourceFields,
+  "reasoning": reasoningItemResourceFields,
+  "function_call": functionCallItemResourceFields,
+  "mcp_call": mcpCallItemResourceFields,
+  "web_search_call": webSearchCallItemResourceFields,
+  "command_execution": commandExecutionItemResourceFields,
+  "interrupt_subagent_call": interruptSubagentCallItemResourceFields,
+  "create_subagent_call": createSubagentCallItemResourceFields,
+  "send_subagent_input_call": sendSubagentInputCallItemResourceFields,
+  "resume_subagent_call": resumeSubagentCallItemResourceFields,
+  "wait_for_subagents_call": waitForSubagentsCallItemResourceFields,
+  "close_subagent_call": closeSubagentCallItemResourceFields,
+} as const;
+export const agentToolConfigParamFields = {
+  "function": agentToolConfigParamFunctionFields,
+  "tool_search": agentToolConfigParamToolSearchFields,
+  "programmatic_tool_calling": agentToolConfigParamProgrammaticToolCallingFields,
+  "mcp": agentToolConfigParamMcpFields,
+  "web_search": agentToolConfigParamWebSearchFields,
+} as const;
+export const agentToolResourceFields = {
+  "function": agentToolResourceFunctionFields,
+  "programmatic_tool_calling": agentToolResourceProgrammaticToolCallingFields,
+  "mcp": agentToolResourceMcpFields,
+  "web_search": agentToolResourceWebSearchFields,
+} as const;
+export const createMcpOauthTokenEndpointAuthParamFields = {
+  "none": createMcpOauthTokenEndpointAuthParamNoneFields,
+  "client_secret_basic": createMcpOauthTokenEndpointAuthParamClientSecretBasicFields,
+  "client_secret_post": createMcpOauthTokenEndpointAuthParamClientSecretPostFields,
+} as const;
+export const createVaultCredentialAuthParamFields = {
+  "mcp_oauth": createVaultCredentialAuthParamMcpOauthFields,
+  "static_bearer": createVaultCredentialAuthParamStaticBearerFields,
+} as const;
+export const environmentParamFields = {
+  "none": environmentParamNoneFields,
+  "openai_hosted": environmentParamOpenaiHostedFields,
+  "self_hosted": environmentParamSelfHostedFields,
+} as const;
+export const environmentResourceFields = {
+  "none": environmentResourceNoneFields,
+  "openai_hosted": environmentResourceOpenaiHostedFields,
+  "self_hosted": environmentResourceSelfHostedFields,
+} as const;
+export const hostedEnvironmentFileParamFields = {
+  "file_id": hostedEnvironmentFileParamFileIdFields,
+  "inline": hostedEnvironmentFileParamInlineFields,
+} as const;
+export const hostedEnvironmentFileResourceFields = {
+  "file_id": hostedEnvironmentFileResourceFileIdFields,
+  "inline": hostedEnvironmentFileResourceInlineFields,
+} as const;
+export const hostedPluginParamFields = {
+  "inline": hostedPluginParamInlineFields,
+} as const;
+export const hostedPluginResourceFields = {
+  "inline": hostedPluginResourceInlineFields,
+} as const;
+export const hostedSkillParamFields = {
+  "skill_reference": hostedSkillParamSkillReferenceFields,
+  "inline": hostedSkillParamInlineFields,
+} as const;
+export const hostedSkillResourceFields = {
+  "skill_reference": hostedSkillResourceSkillReferenceFields,
+  "inline": hostedSkillResourceInlineFields,
+} as const;
+export const hostedTemplateFileResourceFields = {
+  "file_id": hostedTemplateFileResourceFileIdFields,
+  "inline": hostedTemplateFileResourceInlineFields,
+} as const;
+export const hostedTemplateSkillResourceFields = {
+  "skill_reference": hostedTemplateSkillResourceSkillReferenceFields,
+  "inline": hostedTemplateSkillResourceInlineFields,
+} as const;
+export const inlineCapabilitySourceParamFields = {
+  "base64": inlineCapabilitySourceParamBase64Fields,
+} as const;
+export const inputContentParamFields = {
+  "input_text": inputContentParamInputTextFields,
+  "input_image": inputContentParamInputImageFields,
+} as const;
+export const inputContentResourceFields = {
+  "input_text": inputContentResourceInputTextFields,
+  "input_image": inputContentResourceInputImageFields,
+} as const;
+export const mcpOauthTokenEndpointAuthResourceFields = {
+  "none": mcpOauthTokenEndpointAuthResourceNoneFields,
+  "client_secret_basic": mcpOauthTokenEndpointAuthResourceClientSecretBasicFields,
+  "client_secret_post": mcpOauthTokenEndpointAuthResourceClientSecretPostFields,
+} as const;
+export const mcpTransportConfigParamFields = {
+  "http": mcpTransportConfigParamHttpFields,
+  "stdio": mcpTransportConfigParamStdioFields,
+} as const;
+export const mcpTransportResourceFields = {
+  "http": mcpTransportResourceHttpFields,
+  "stdio": mcpTransportResourceStdioFields,
+} as const;
+export const messageContentResourceFields = {
+  "input_text": messageContentResourceInputTextFields,
+  "input_image": messageContentResourceInputImageFields,
+  "output_text": messageContentResourceOutputTextFields,
+} as const;
+export const persistedAgentToolConfigParamFields = {
+  "function": persistedAgentToolConfigParamFunctionFields,
+  "tool_search": persistedAgentToolConfigParamToolSearchFields,
+  "programmatic_tool_calling": persistedAgentToolConfigParamProgrammaticToolCallingFields,
+  "mcp": persistedAgentToolConfigParamMcpFields,
+  "web_search": persistedAgentToolConfigParamWebSearchFields,
+} as const;
+export const persistedAgentToolResourceFields = {
+  "function": persistedAgentToolResourceFunctionFields,
+  "tool_search": persistedAgentToolResourceToolSearchFields,
+  "programmatic_tool_calling": persistedAgentToolResourceProgrammaticToolCallingFields,
+  "mcp": persistedAgentToolResourceMcpFields,
+  "web_search": persistedAgentToolResourceWebSearchFields,
+} as const;
+export const persistedMcpTransportConfigParamFields = {
+  "http": persistedMcpTransportConfigParamHttpFields,
+  "stdio": persistedMcpTransportConfigParamStdioFields,
+} as const;
+export const persistedMcpTransportResourceFields = {
+  "http": persistedMcpTransportResourceHttpFields,
+  "stdio": persistedMcpTransportResourceStdioFields,
+} as const;
+export const rotateMcpOauthTokenEndpointAuthParamFields = {
+  "client_secret_basic": rotateMcpOauthTokenEndpointAuthParamClientSecretBasicFields,
+  "client_secret_post": rotateMcpOauthTokenEndpointAuthParamClientSecretPostFields,
+} as const;
+export const rotateVaultCredentialAuthParamFields = {
+  "mcp_oauth": rotateVaultCredentialAuthParamMcpOauthFields,
+  "static_bearer": rotateVaultCredentialAuthParamStaticBearerFields,
+} as const;
+export const sessionEventFields = {
+  "error": sessionEventErrorFields,
+  "agent.session.environment.ready": sessionEventAgentSessionEnvironmentReadyFields,
+  "agent.output.command_execution_output.delta": sessionEventAgentOutputCommandExecutionOutputDeltaFields,
+  "agent.session.created": sessionEventAgentSessionCreatedFields,
+  "agent.session.turn.created": sessionEventAgentSessionTurnCreatedFields,
+  "agent.session.turn.in_progress": sessionEventAgentSessionTurnInProgressFields,
+  "agent.session.turn.completed": sessionEventAgentSessionTurnCompletedFields,
+  "agent.session.turn.failed": sessionEventAgentSessionTurnFailedFields,
+  "agent.session.turn.cancelled": sessionEventAgentSessionTurnCancelledFields,
+  "agent.session.turn.item.added": sessionEventAgentSessionTurnItemAddedFields,
+  "agent.session.idle": sessionEventAgentSessionIdleFields,
+  "agent.session.in_progress": sessionEventAgentSessionInProgressFields,
+  "agent.session.requires_action": sessionEventAgentSessionRequiresActionFields,
+  "agent.session.failed": sessionEventAgentSessionFailedFields,
+  "agent.session.environment.pending": sessionEventAgentSessionEnvironmentPendingFields,
+  "agent.session.environment.connected": sessionEventAgentSessionEnvironmentConnectedFields,
+  "agent.session.environment.disconnected": sessionEventAgentSessionEnvironmentDisconnectedFields,
+  "agent.session.environment.failed": sessionEventAgentSessionEnvironmentFailedFields,
+  "agent.session.subagent.created": sessionEventAgentSessionSubagentCreatedFields,
+  "agent.session.subagent.active": sessionEventAgentSessionSubagentActiveFields,
+  "agent.session.subagent.closed": sessionEventAgentSessionSubagentClosedFields,
+  "agent.session.turn.item.done": sessionEventAgentSessionTurnItemDoneFields,
+  "agent.session.turn.content_part.added": sessionEventAgentSessionTurnContentPartAddedFields,
+  "agent.session.turn.content_part.done": sessionEventAgentSessionTurnContentPartDoneFields,
+  "agent.session.turn.output_text.delta": sessionEventAgentSessionTurnOutputTextDeltaFields,
+  "agent.session.turn.output_text.done": sessionEventAgentSessionTurnOutputTextDoneFields,
+  "agent.session.turn.reasoning_summary_part.added": sessionEventAgentSessionTurnReasoningSummaryPartAddedFields,
+  "agent.session.turn.reasoning_summary_part.done": sessionEventAgentSessionTurnReasoningSummaryPartDoneFields,
+  "agent.session.turn.reasoning_summary_text.delta": sessionEventAgentSessionTurnReasoningSummaryTextDeltaFields,
+  "agent.session.turn.reasoning_summary_text.done": sessionEventAgentSessionTurnReasoningSummaryTextDoneFields,
+} as const;
+export const sessionInputParamFields = {
+  "agent.session.input.message": sessionInputParamAgentSessionInputMessageFields,
+  "agent.session.input.cancel": sessionInputParamAgentSessionInputCancelFields,
+  "agent.session.input.tool_result": sessionInputParamAgentSessionInputToolResultFields,
+} as const;
+export const sessionRequiredActionResourceFields = {
+  "function_call": sessionRequiredActionResourceFunctionCallFields,
+  "environment_connection": sessionRequiredActionResourceEnvironmentConnectionFields,
+} as const;
+export const sessionTurnItemResourceFields = {
+  "message": messageItemResourceFields,
+  "reasoning": reasoningItemResourceFields,
+  "function_call": functionCallItemResourceFields,
+  "function_call_output": functionCallOutputItemResourceFields,
+  "agent_message": agentMessageItemResourceFields,
+  "mcp_call": mcpCallItemResourceFields,
+  "web_search_call": webSearchCallItemResourceFields,
+  "command_execution": commandExecutionItemResourceFields,
+  "interrupt_subagent_call": interruptSubagentCallItemResourceFields,
+  "create_subagent_call": createSubagentCallItemResourceFields,
+  "send_subagent_input_call": sendSubagentInputCallItemResourceFields,
+  "resume_subagent_call": resumeSubagentCallItemResourceFields,
+  "wait_for_subagents_call": waitForSubagentsCallItemResourceFields,
+  "close_subagent_call": closeSubagentCallItemResourceFields,
+} as const;
+export const textFormatParamFields = {
+  "text": textFormatParamTextFields,
+  "json_schema": textFormatParamJsonSchemaFields,
+} as const;
+export const textFormatResourceFields = {
+  "text": textFormatResourceTextFields,
+  "json_schema": textFormatResourceJsonSchemaFields,
+} as const;
+export const vaultCredentialAuthResourceFields = {
+  "mcp_oauth": vaultCredentialAuthResourceMcpOauthFields,
+  "static_bearer": vaultCredentialAuthResourceStaticBearerFields,
+} as const;
+export const webSearchActionResourceFields = {
+  "search": webSearchActionResourceSearchFields,
+  "open_page": webSearchActionResourceOpenPageFields,
+  "find_in_page": webSearchActionResourceFindInPageFields,
+  "other": webSearchActionResourceOtherFields,
+} as const;
diff --git a/packages/agents-client/src/history-projection.ts b/packages/agents-client/src/history-projection.ts
index b23ae0a82..aeb75a499 100644
--- a/packages/agents-client/src/history-projection.ts
+++ b/packages/agents-client/src/history-projection.ts
@@ -1,223 +1,133 @@
-import type { AgentTurn, ItemContent, SessionItem, ListPage, PageOptions } from "./types";
-import { exactFields, onlyFields, isRecord, hasOwn, isNonnegativeInteger, sameResourceId } from "./response-projection";
+import type { AgentTurn, ItemContent, SessionItem, ListPage, PageOptions, WebSearchAction } from "./types";
+import { exactFields, isOneOf, isRecord, hasOwn, isNonnegativeInteger, sameResourceId, variantFields } from "./response-projection";
 import { projectTokenUsage } from "./usage-projection";
-
-const turnFields = new Set([
-  "id", "agent_id", "session_id", "object", "status", "created_at", "started_at", "completed_at", "error", "usage", "subagent_id",
-]);
-const turnErrorFields = new Set(["code", "message"]);
-const itemContentTextFields = new Set(["type", "text"]);
-const itemContentImageFields = new Set(["type", "image_url"]);
-const knownItemTypes = new Set([
-  "message", "command_execution", "mcp_call", "function_call", "function_call_output", "web_search_call",
-  "reasoning", "agent_message", "create_subagent_call", "send_subagent_input_call", "resume_subagent_call",
-  "wait_for_subagents_call", "interrupt_subagent_call", "close_subagent_call",
-]);
-const itemStatuses = new Set(["in_progress", "completed", "failed", "incomplete"]);
-const turnStatuses = new Set(["queued", "in_progress", "waiting", "completed", "failed", "cancelled"]);
-
+import {
+  functionCallStatusResourceValues, messageContentResourceFields, messagePhaseResourceValues, outputItemStatusResourceValues,
+  sessionItemListResourceFields, sessionMessageRoleResourceValues, sessionTurnErrorCodeResourceValues, sessionTurnErrorResourceFields,
+  sessionTurnItemResourceFields, summaryTextResourceFields, turnResourceFields, turnStatusResourceValues, webSearchActionResourceFields,
+  encryptedContentResourceFields, type SessionTurnErrorCodeResource,
+} from "./generated/public-api";
 
 export function projectItemContent(value: unknown, invalid: () => never): ItemContent {
-  if (!isRecord(value) || typeof value.type !== "string") return invalid();
-  if (value.type === "input_text" || value.type === "output_text") {
-    if (!exactFields(value, itemContentTextFields) || typeof value.text !== "string") {
-      return invalid();
-    }
-    return { type: value.type, text: value.text };
+  const fields = isRecord(value) ? variantFields(messageContentResourceFields, value.type) : undefined;
+  if (!isRecord(value) || fields === undefined || !exactFields(value, fields)) return invalid();
+  if (value.type === "input_image") {
+    if (typeof value.image_url !== "string") return invalid();
+    return { type: "input_image", image_url: value.image_url };
   }
-  if (
-    value.type !== "input_image" || !exactFields(value, itemContentImageFields) ||
-    typeof value.image_url !== "string"
-  ) return invalid();
-  return { type: "input_image", image_url: value.image_url };
-}
-
-function validOptionalInteger(value: unknown): boolean {
-  return value === undefined || value === null || isNonnegativeInteger(value);
-}
-
-function validOptionalSafeInteger(value: unknown): boolean {
-  return value === undefined || value === null || Number.isSafeInteger(value);
+  if (typeof value.text !== "string") return invalid();
+  return { type: value.type as "input_text" | "output_text", text: value.text };
 }
 
-function projectWebSearchAction(value: unknown, invalid: () => never): SessionItem["action"] {
-  const fields = new Set(["type", "query", "queries", "url", "pattern"]);
+function projectWebSearchAction(value: unknown, invalid: () => never): WebSearchAction {
+  const fields = isRecord(value) ? variantFields(webSearchActionResourceFields, value.type) : undefined;
   if (
-    !isRecord(value) || !onlyFields(value, fields) ||
-    (value.type !== "search" && value.type !== "open_page" && value.type !== "find_in_page" && value.type !== "other") ||
-    !(value.query === undefined || value.query === null || typeof value.query === "string") ||
-    !(value.url === undefined || value.url === null || typeof value.url === "string") ||
-    !(value.pattern === undefined || value.pattern === null || typeof value.pattern === "string") ||
-    !(value.queries === undefined || (Array.isArray(value.queries) && value.queries.every((entry) => typeof entry === "string")))
+    !isRecord(value) || fields === undefined || !exactFields(value, fields) ||
+    ["query", "url", "pattern"].some((field) => hasOwn(value, field) && !nullableString(value[field])) ||
+    !(value.queries === undefined || value.queries === null ||
+      (Array.isArray(value.queries) && value.queries.every((entry) => typeof entry === "string")))
   ) return invalid();
-  return { ...value } as unknown as SessionItem["action"];
+  return { ...value } as unknown as WebSearchAction;
 }
 
-function itemVariantFields(type: string): Set<string> {
-  const common = ["id", "turn_id", "type", "status"];
+// The status enum each Item schema uses; agent_message has no status.
+function validItemStatus(type: unknown, status: unknown): boolean {
   switch (type) {
-    case "message": return new Set([...common, "role", "phase", "content"]);
-    case "command_execution": return new Set([...common, "command", "cwd", "duration_ms", "exit_code", "output"]);
-    case "mcp_call": return new Set([...common, "server_label", "name", "arguments", "output", "error"]);
-    case "function_call": return new Set([...common, "name", "call_id", "arguments"]);
-    case "function_call_output": return new Set([...common, "call_id", "output", "error", "duration_ms"]);
-    case "web_search_call": return new Set([...common, "action"]);
-    case "reasoning": return new Set([...common, "summary"]);
-    case "agent_message": return new Set(["id", "turn_id", "type", "sender_agent_id", "recipient_agent_id", "content"]);
-    case "create_subagent_call": return new Set([...common, "agent_id", "content", "model", "reasoning_effort"]);
-    case "send_subagent_input_call": return new Set([...common, "sender_agent_id", "recipient_agent_id", "content"]);
-    case "wait_for_subagents_call": return new Set([...common, "sender_agent_id", "recipient_agent_ids"]);
-    case "resume_subagent_call":
-    case "interrupt_subagent_call":
-    case "close_subagent_call": return new Set([...common, "sender_agent_id", "recipient_agent_id"]);
-    default: return new Set(common);
+    case "agent_message": return status === undefined;
+    case "reasoning": return status === null || isOneOf(outputItemStatusResourceValues, status);
+    case "message":
+    case "web_search_call": return isOneOf(outputItemStatusResourceValues, status);
+    default: return isOneOf(functionCallStatusResourceValues, status);
   }
 }
 
 export function projectSessionItem(value: unknown, invalid: () => never): SessionItem {
+  const fields = isRecord(value) ? variantFields(sessionTurnItemResourceFields, value.type) : undefined;
   if (
-    !isRecord(value) ||
-    typeof value.id !== "string" || value.id === "" ||
-    typeof value.turn_id !== "string" || value.turn_id === "" ||
-    typeof value.type !== "string" || !knownItemTypes.has(value.type) ||
-    !onlyFields(value, itemVariantFields(value.type))
+    !isRecord(value) || fields === undefined || !exactFields(value, fields) ||
+    !nonemptyString(value.id) || !nonemptyString(value.turn_id) || !validItemStatus(value.type, value.status)
   ) return invalid();
-  if (value.type !== "agent_message" && !(
-    (value.type === "reasoning" && (value.status === undefined || value.status === null)) ||
-    (typeof value.status === "string" && itemStatuses.has(value.status) && !(value.type === "reasoning" && value.status === "failed"))
-  )) return invalid();
 
-  const projected: Record<string, unknown> = {
-    id: value.id,
-    turn_id: value.turn_id,
-    type: value.type,
-    ...(hasOwn(value, "status") ? { status: value.status } : {}),
-  };
+  const item: Record<string, unknown> = { ...value };
   switch (value.type) {
     case "message":
       if (
-        (value.role !== "user" && value.role !== "assistant") || !Array.isArray(value.content) ||
-        !(value.phase === undefined || value.phase === null || value.phase === "commentary" || value.phase === "final_answer")
+        !isOneOf(sessionMessageRoleResourceValues, value.role) || !Array.isArray(value.content) ||
+        !(value.phase === null || isOneOf(messagePhaseResourceValues, value.phase))
       ) return invalid();
-      projected.role = value.role;
-      projected.content = Array.from(value.content, (part) => projectItemContent(part, invalid));
-      // Current Cores send null when there is no phase; older ones omit it.
-      if (value.phase !== undefined) projected.phase = value.phase;
+      item.content = Array.from(value.content, (part) => projectItemContent(part, invalid));
       break;
     case "command_execution":
       if (
-        typeof value.command !== "string" ||
-        !(value.cwd === undefined || value.cwd === null || typeof value.cwd === "string") ||
-        !validOptionalInteger(value.duration_ms) || !validOptionalSafeInteger(value.exit_code)
+        typeof value.command !== "string" || !nullableString(value.cwd) ||
+        !(value.duration_ms === null || isNonnegativeInteger(value.duration_ms)) ||
+        !(value.exit_code === null || Number.isSafeInteger(value.exit_code))
       ) return invalid();
-      projected.command = value.command;
-      for (const field of ["cwd", "duration_ms", "exit_code", "output"] as const) {
-        if (hasOwn(value, field)) projected[field] = value[field];
-      }
       break;
     case "mcp_call":
-      if (
-        typeof value.server_label !== "string" || value.server_label === "" ||
-        typeof value.name !== "string" || value.name === "" ||
-        !hasOwn(value, "arguments") || !hasOwn(value, "output") || !hasOwn(value, "error")
-      ) return invalid();
-      projected.server_label = value.server_label;
-      projected.name = value.name;
-      projected.arguments = value.arguments;
-      projected.output = value.output;
-      projected.error = value.error;
+      if (!nonemptyString(value.server_label) || !nonemptyString(value.name)) return invalid();
       break;
     case "function_call":
-      if (
-        typeof value.call_id !== "string" || value.call_id === "" ||
-        typeof value.name !== "string" || value.name === "" || !hasOwn(value, "arguments")
-      ) return invalid();
-      projected.call_id = value.call_id;
-      projected.name = value.name;
-      projected.arguments = value.arguments;
+      if (!nonemptyString(value.call_id) || !nonemptyString(value.name)) return invalid();
       break;
     case "function_call_output":
-      if (typeof value.call_id !== "string" || value.call_id === "" || !validOptionalInteger(value.duration_ms)) {
-        return invalid();
-      }
-      projected.call_id = value.call_id;
-      for (const field of ["output", "error", "duration_ms"] as const) {
-        if (hasOwn(value, field)) projected[field] = value[field];
-      }
+      if (!nonemptyString(value.call_id)) return invalid();
       break;
     case "web_search_call":
-      // OpenAgentCore omits action when the runtime has not reported one yet.
-      if (hasOwn(value, "action")) projected.action = projectWebSearchAction(value.action, invalid);
+      if (value.action !== null) item.action = projectWebSearchAction(value.action, invalid);
       break;
     case "reasoning":
       if (!Array.isArray(value.summary)) return invalid();
-      projected.summary = value.summary.map((part) => {
-        if (!isRecord(part) || !exactFields(part, new Set(["type", "text"])) || part.type !== "summary_text" || typeof part.text !== "string") return invalid();
+      item.summary = value.summary.map((part) => {
+        if (!isRecord(part) || !exactFields(part, summaryTextResourceFields) || part.type !== "summary_text" || typeof part.text !== "string") return invalid();
         return { type: "summary_text", text: part.text };
       });
       break;
     case "create_subagent_call":
-      if (!nonemptyString(value.agent_id) || !optionalString(value.model) || !optionalString(value.reasoning_effort)) return invalid();
-      projected.agent_id = value.agent_id;
-      projected.content = projectCoordinationContent(value.content, invalid);
-      for (const field of ["model", "reasoning_effort"]) {
-        if (hasOwn(value, field)) projected[field] = value[field];
-      }
-      break;
-    case "agent_message":
-    case "send_subagent_input_call":
-    case "resume_subagent_call":
-    case "interrupt_subagent_call":
-    case "close_subagent_call":
-      if (!nonemptyString(value.sender_agent_id) || !nonemptyString(value.recipient_agent_id)) return invalid();
-      projected.sender_agent_id = value.sender_agent_id;
-      projected.recipient_agent_id = value.recipient_agent_id;
-      if (value.type === "agent_message" || value.type === "send_subagent_input_call") {
-        projected.content = projectCoordinationContent(value.content, invalid);
-      }
+      if (!nonemptyString(value.agent_id) || !nullableString(value.model) || !nullableString(value.reasoning_effort)) return invalid();
+      item.content = projectCoordinationContent(value.content, invalid);
       break;
     case "wait_for_subagents_call":
       if (!nonemptyString(value.sender_agent_id) || !Array.isArray(value.recipient_agent_ids) || !value.recipient_agent_ids.every(nonemptyString)) return invalid();
-      projected.sender_agent_id = value.sender_agent_id;
-      projected.recipient_agent_ids = [...value.recipient_agent_ids];
+      item.recipient_agent_ids = [...value.recipient_agent_ids];
       break;
+    default:
+      // agent_message, send_subagent_input_call and the Subagent control calls.
+      if (!nonemptyString(value.sender_agent_id) || !nonemptyString(value.recipient_agent_id)) return invalid();
+      if (hasOwn(value, "content")) item.content = projectCoordinationContent(value.content, invalid);
   }
-  return projected as unknown as SessionItem;
+  return item as unknown as SessionItem;
 }
 
 export function projectAgentTurn(value: unknown, expectedSessionId: string, invalid: () => never, expectedTurnId?: string): AgentTurn {
   if (
-    !isRecord(value) || !onlyFields(value, turnFields) ||
-    typeof value.id !== "string" || value.id === "" ||
+    !isRecord(value) || !exactFields(value, turnResourceFields) ||
+    !nonemptyString(value.id) ||
     (expectedTurnId !== undefined && !sameResourceId(value.id, expectedTurnId)) ||
-    typeof value.agent_id !== "string" || value.agent_id === "" ||
+    !nonemptyString(value.agent_id) ||
     // A child Turn carries the Session's Agent ID; subagent_id names the child.
-    !(value.subagent_id === undefined || value.subagent_id === null || nonemptyString(value.subagent_id)) ||
+    !(value.subagent_id === null || nonemptyString(value.subagent_id)) ||
     typeof value.session_id !== "string" || !sameResourceId(value.session_id, expectedSessionId) ||
-    value.object !== "agent.session.turn" || typeof value.status !== "string" || !turnStatuses.has(value.status) ||
+    value.object !== "agent.session.turn" || !isOneOf(turnStatusResourceValues, value.status) ||
     !isNonnegativeInteger(value.created_at) ||
     !(value.started_at === null || isNonnegativeInteger(value.started_at)) ||
-    !(value.completed_at === null || isNonnegativeInteger(value.completed_at))
+    !(value.completed_at === null || isNonnegativeInteger(value.completed_at)) ||
+    !(value.error === null || (
+      isRecord(value.error) && exactFields(value.error, sessionTurnErrorResourceFields) &&
+      isOneOf(sessionTurnErrorCodeResourceValues, value.error.code) && typeof value.error.message === "string"
+    ))
   ) return invalid();
-  let error: AgentTurn["error"] = null;
-  if (value.error !== null) {
-    if (
-      !isRecord(value.error) || !exactFields(value.error, turnErrorFields) ||
-      value.error.code !== "internal_error" || typeof value.error.message !== "string"
-    ) return invalid();
-    error = { code: "internal_error", message: value.error.message };
-  }
   return {
     id: value.id,
-    agent_id: value.agent_id,
-    ...(hasOwn(value, "subagent_id") ? { subagent_id: value.subagent_id as string | null } : {}),
-    session_id: value.session_id,
     object: "agent.session.turn",
-    status: value.status as AgentTurn["status"],
+    session_id: value.session_id,
+    agent_id: value.agent_id,
+    subagent_id: value.subagent_id,
+    status: value.status,
     created_at: value.created_at,
     started_at: value.started_at,
     completed_at: value.completed_at,
-    error,
+    error: value.error === null ? null : { code: value.error.code as SessionTurnErrorCodeResource, message: value.error.message as string },
     usage: projectTokenUsage(value.usage, invalid),
   };
 }
@@ -226,8 +136,8 @@ function nonemptyString(value: unknown): value is string {
   return typeof value === "string" && value !== "";
 }
 
-function optionalString(value: unknown): boolean {
-  return value === undefined || value === null || typeof value === "string";
+function nullableString(value: unknown): boolean {
+  return value === null || typeof value === "string";
 }
 
 function projectCoordinationContent(value: unknown, invalid: () => never): ItemContent[] {
@@ -235,33 +145,21 @@ function projectCoordinationContent(value: unknown, invalid: () => never): ItemC
   return value.map((part) => {
     if (!isRecord(part)) return invalid();
     if (part.type === "output_text") return projectItemContent(part, invalid);
-    if (part.type !== "encrypted_content" || !exactFields(part, new Set(["type", "encrypted_content"])) || typeof part.encrypted_content !== "string") return invalid();
+    if (part.type !== "encrypted_content" || !exactFields(part, encryptedContentResourceFields) || typeof part.encrypted_content !== "string") return invalid();
     return { type: "encrypted_content", encrypted_content: part.encrypted_content };
   });
 }
 
-export function validateHistoryPageOptions(options?: PageOptions): void {
-  if (options?.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100)) {
-    throw new TypeError("History list limit must be an integer from 1 through 100.");
-  }
-  if (options?.order !== undefined && options.order !== "asc" && options.order !== "desc") {
-    throw new TypeError("History list order must be asc or desc.");
-  }
-  if (options?.after !== undefined && !nonemptyString(options.after)) {
-    throw new TypeError("History list cursor must be a nonempty resource ID.");
-  }
-}
-
 export function projectHistoryPage<T extends { id: string }>(
   value: unknown,
   options: PageOptions | undefined,
   project: (entry: unknown) => T,
   invalid: () => never,
 ): ListPage<T> {
-  if (!isRecord(value) || !onlyFields(value, new Set(["data", "has_more", "object", "first_id", "last_id"])) ||
+  // Item and Turn lists share one list envelope.
+  if (!isRecord(value) || !exactFields(value, sessionItemListResourceFields) || value.object !== "list" ||
     !Array.isArray(value.data) || typeof value.has_more !== "boolean" ||
-    value.data.length > (options?.limit ?? 20) || (value.has_more && value.data.length === 0) ||
-    (hasOwn(value, "object") && value.object !== "list")
+    value.data.length > (options?.limit ?? 20) || (value.has_more && value.data.length === 0)
   ) return invalid();
   const data = value.data.map(project);
   if (data.some((entry, index) =>
@@ -270,11 +168,6 @@ export function projectHistoryPage<T extends { id: string }>(
   )) return invalid();
   const first = data[0]?.id ?? null;
   const last = data[data.length - 1]?.id ?? null;
-  if ((hasOwn(value, "first_id") && value.first_id !== first) || (hasOwn(value, "last_id") && value.last_id !== last)) return invalid();
-  return {
-    data, has_more: value.has_more,
-    ...(hasOwn(value, "object") ? { object: "list" as const } : {}),
-    ...(hasOwn(value, "first_id") ? { first_id: first } : {}),
-    ...(hasOwn(value, "last_id") ? { last_id: last } : {}),
-  };
+  if (value.first_id !== first || value.last_id !== last) return invalid();
+  return { object: "list", data, has_more: value.has_more, first_id: first, last_id: last };
 }
diff --git a/packages/agents-client/src/history-recovery.test.ts b/packages/agents-client/src/history-recovery.test.ts
index c7c95ddf9..a63d5f438 100644
--- a/packages/agents-client/src/history-recovery.test.ts
+++ b/packages/agents-client/src/history-recovery.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import { OpenAIAgentsClient } from "./client";
-import type { AgentTurn, PageOptions, SessionEvent } from "./types";
+import type { AgentTurn, SessionEvent } from "./types";
 
 const usage = {
   input_tokens: 7226, output_tokens: 7, total_tokens: 7233,
@@ -22,7 +22,7 @@ function session() {
     environment: { type: "none" },
     agent: {
       id: "root", model: "model", name: null, instructions: null,
-      multi_agent: { enabled: true, max_concurrent_subagents: null }, reasoning: {},
+      multi_agent: { enabled: true, max_concurrent_subagents: null }, reasoning: { effort: null, summary: null },
       service_tier: "auto", text: { format: { type: "text" }, verbosity: "medium" }, tools: [],
     },
   };
@@ -32,6 +32,12 @@ function json(value: unknown) {
   return new Response(JSON.stringify(value), { headers: { "Content-Type": "application/json" } });
 }
 
+function page(data: Record<string, unknown>[], fields: Record<string, unknown> = {}) {
+  return {
+    object: "list", data, first_id: data[0]?.id ?? null, last_id: data[data.length - 1]?.id ?? null, has_more: false, ...fields,
+  };
+}
+
 function sse(events: unknown[]) {
   return new Response(events.map((event) => `data: ${JSON.stringify(event)}\n\n`).join(""), {
     headers: { "Content-Type": "text/event-stream" },
@@ -39,7 +45,8 @@ function sse(events: unknown[]) {
 }
 
 function turnEvent(value = turn(), type = "agent.session.turn.completed") {
-  return { type, event_id: "event", session_id: "session", turn_id: value.id, turn: value };
+  const terminal = /\.(completed|failed|cancelled)$/.test(type) ? { usage: value.usage } : {};
+  return { type, event_id: "event", session_id: "session", turn_id: value.id, turn: value, ...terminal };
 }
 
 function itemEvent(item: Record<string, unknown>) {
@@ -70,7 +77,7 @@ describe("history and live event projections", () => {
     const value = turn({ agent_id: "root", subagent_id: subagentId, usage });
     const client = new OpenAIAgentsClient({ fetch: vi.fn()
       .mockResolvedValueOnce(json(value))
-      .mockResolvedValueOnce(json({ data: [value], has_more: false }))
+      .mockResolvedValueOnce(json(page([value])))
       .mockResolvedValueOnce(sse([turnEvent(value)])) });
     expect(await client.retrieveTurn("session", "turn")).toEqual(value);
     expect((await client.listTurns("session")).data).toEqual([value]);
@@ -79,36 +86,6 @@ describe("history and live event projections", () => {
     expect(received[0]?.turn).toEqual(value);
   });
 
-  it("accepts the pinned optional subagent_id omission without inventing an identity", async () => {
-    const { subagent_id: _omitted, ...value } = turn();
-    const client = new OpenAIAgentsClient({ fetch: async () => json(value) });
-    expect(await client.retrieveTurn("session", "turn")).toEqual(value);
-  });
-
-  it("accepts the official child Turn shape and the earlier child-owned agent_id", async () => {
-    for (const value of [turn({ agent_id: "root", subagent_id: "child" }), turn({ agent_id: "child", subagent_id: "child" })]) {
-      const client = new OpenAIAgentsClient({ fetch: vi.fn()
-        .mockResolvedValueOnce(json(value))
-        .mockResolvedValueOnce(json({ object: "list", data: [value], first_id: "turn", last_id: "turn", has_more: false })) });
-      expect(await client.retrieveTurn("session", "turn")).toEqual(value);
-      expect((await client.listTurns("session")).data).toEqual([value]);
-    }
-  });
-
-  // Earlier Core releases streamed child Turns; current Core streams root work only.
-  it("retains completed child snapshots first observed in an earlier creation stream", async () => {
-    const value = turn({ agent_id: "root", subagent_id: "child" });
-    const created = { type: "agent.session.created", event_id: "created", session: session() };
-    const client = new OpenAIAgentsClient({ fetch: async () => sse([
-      created, turnEvent(value, "agent.session.turn.created"), turnEvent(value),
-    ]) });
-    const received: SessionEvent[] = [];
-    await client.createSessionStream({ environment: { type: "none" } }, "key", {
-      onSession: () => undefined, onEvent: (event) => received.push(event),
-    });
-    expect(received.map((event) => event.turn).filter(Boolean)).toEqual([value, value]);
-  });
-
   it("does not weaken root creation snapshots or immutable root identity", async () => {
     for (const value of [turn(), turn({ status: "queued", agent_id: "other" })]) {
       const client = new OpenAIAgentsClient({ fetch: async () => sse([
@@ -123,7 +100,7 @@ describe("history and live event projections", () => {
 
   it("projects supported coordination/reasoning Items identically through history and SSE", async () => {
     const client = new OpenAIAgentsClient({ fetch: vi.fn()
-      .mockResolvedValueOnce(json({ data: items, has_more: false }))
+      .mockResolvedValueOnce(json(page(items)))
       .mockResolvedValueOnce(sse(items.map(itemEvent))) });
     const saved = (await client.listItems("session")).data;
     const live: SessionEvent[] = [];
@@ -145,7 +122,7 @@ describe("history and live event projections", () => {
   ])("rejects malformed or private Item fields in both paths: $type", async (item) => {
     const onEvent = vi.fn();
     const client = new OpenAIAgentsClient({ fetch: vi.fn()
-      .mockResolvedValueOnce(json({ data: [item], has_more: false }))
+      .mockResolvedValueOnce(json(page([item])))
       .mockResolvedValueOnce(sse([itemEvent(item)])) });
     await expect(client.listItems("session")).rejects.toMatchObject({ code: "invalid_history_resource" });
     await expect(client.streamEvents("session", { onEvent })).rejects.toMatchObject({ code: "invalid_stream_event" });
@@ -156,6 +133,7 @@ describe("history and live event projections", () => {
     turn({ session_id: "foreign" }), turn({ id: "other" }),
     turn({ agent_id: "", subagent_id: "child" }), turn({ subagent_id: "" }), turn({ subagent_id: 1 }),
     turn({ usage: { input_tokens: 1 } }), turn({ native_session_id: "private" }),
+    (({ subagent_id: _omitted, ...value }) => value)(turn()),
   ])("rejects malformed or mismatched Turn retrieval", async (value) => {
     const client = new OpenAIAgentsClient({ fetch: async () => json(value) });
     await expect(client.retrieveTurn("session", "turn")).rejects.toMatchObject({ code: "invalid_history_resource" });
@@ -173,7 +151,7 @@ describe("history and live event projections", () => {
     const completed = turn();
     const measured = turn({ usage });
     const requests: string[] = [];
-    const responses = [sse([turnEvent(completed)]), sse([turnEvent(measured)]), json(measured), json({ data: [measured], has_more: false })];
+    const responses = [sse([turnEvent(completed)]), sse([turnEvent(measured)]), json(measured), json(page([measured]))];
     const client = new OpenAIAgentsClient({ fetch: async (input, init) => {
       requests.push(String(input));
       expect(new Headers(init?.headers).has("Last-Event-ID")).toBe(false);
@@ -197,9 +175,9 @@ describe("history and live event projections", () => {
 describe("history pagination", () => {
   it.each(["asc", "desc"] as const)("recovers every saved Item across %s pages without changing snapshots", async (order) => {
     const snapshots = [
-      { id: "input", turn_id: "turn", type: "message", status: "completed", role: "user", content: [{ type: "input_text", text: "Question" }] },
+      { id: "input", turn_id: "turn", type: "message", status: "completed", role: "user", phase: null, content: [{ type: "input_text", text: "Question" }] },
       { id: "answer", turn_id: "turn", type: "message", status: "incomplete", role: "assistant", phase: "commentary", content: [{ type: "output_text", text: "Retained partial answer" }] },
-      { id: "command", turn_id: "turn", type: "command_execution", status: "incomplete", command: "work", output: "Retained output", exit_code: null },
+      { id: "command", turn_id: "turn", type: "command_execution", status: "incomplete", command: "work", cwd: null, output: "Retained output", exit_code: null, duration_ms: null },
     ];
     const expected = order === "asc" ? snapshots : [...snapshots].reverse();
     const client = new OpenAIAgentsClient({ fetch: async (input) => {
@@ -207,7 +185,7 @@ describe("history pagination", () => {
       expect(query.get("order")).toBe(order);
       const after = query.get("after");
       const index = after === null ? 0 : expected.findIndex((item) => item.id === after) + 1;
-      return json({ data: expected.slice(index, index + 1), has_more: index + 1 < expected.length });
+      return json(page(expected.slice(index, index + 1), { has_more: index + 1 < expected.length }));
     } });
     const recovered = [];
     let after: string | undefined;
@@ -220,7 +198,7 @@ describe("history pagination", () => {
     expect(recovered).toEqual(expected);
   });
 
-  it.each(["asc", "desc"] as const)("keeps the %s cursor and optional page metadata", async (order) => {
+  it.each(["asc", "desc"] as const)("keeps the %s cursor and page metadata", async (order) => {
     const calls: string[] = [];
     const client = new OpenAIAgentsClient({ fetch: async (input) => {
       calls.push(String(input));
@@ -233,13 +211,13 @@ describe("history pagination", () => {
   });
 
   it.each([
-    {}, { data: [], has_more: true }, { data: [], has_more: "false" },
-    { data: [turn(), turn()], has_more: false },
-    { data: [turn()], has_more: false, first_id: "wrong" },
-    { data: [turn()], has_more: false, last_id: null },
-    { data: [], has_more: false, object: "turn.list" },
-    { data: [turn({ session_id: "foreign" })], has_more: false },
-    { data: [turn()], has_more: false, internal_cursor: "private" },
+    {}, page([], { has_more: true }), page([], { has_more: "false" }),
+    page([turn(), turn()]),
+    page([turn()], { first_id: "wrong" }),
+    page([turn()], { last_id: null }),
+    page([], { object: "turn.list" }),
+    page([turn({ session_id: "foreign" })]),
+    page([turn()], { internal_cursor: "private" }),
   ])("rejects malformed Turn pages", async (page) => {
     const client = new OpenAIAgentsClient({ fetch: async () => json(page) });
     await expect(client.listTurns("session")).rejects.toMatchObject({ code: "invalid_history_resource" });
@@ -247,19 +225,11 @@ describe("history pagination", () => {
 
   it("rejects cursor repetition, overfull pages and invalid Item envelopes", async () => {
     const client = new OpenAIAgentsClient({ fetch: vi.fn()
-      .mockResolvedValueOnce(json({ data: [turn()], has_more: true }))
-      .mockResolvedValueOnce(json({ data: [turn(), turn({ id: "turn-2" })], has_more: false }))
-      .mockResolvedValueOnce(json({ data: [items[0]], has_more: false, last_id: "other" })) });
+      .mockResolvedValueOnce(json(page([turn()], { has_more: true })))
+      .mockResolvedValueOnce(json(page([turn(), turn({ id: "turn-2" })])))
+      .mockResolvedValueOnce(json(page([items[0]!], { last_id: "other" }))) });
     await expect(client.listTurns("session", { after: "turn" })).rejects.toMatchObject({ code: "invalid_history_resource" });
     await expect(client.listTurns("session", { limit: 1 })).rejects.toMatchObject({ code: "invalid_history_resource" });
     await expect(client.listItems("session")).rejects.toMatchObject({ code: "invalid_history_resource" });
   });
-
-  it.each([{ limit: 0 }, { limit: 101 }, { limit: 1.5 }, { order: "newest" }, { after: "" }])("rejects invalid options before HTTP", async (options) => {
-    const fetch = vi.fn();
-    const client = new OpenAIAgentsClient({ fetch });
-    await expect(client.listItems("session", options as PageOptions)).rejects.toBeInstanceOf(TypeError);
-    await expect(client.listTurns("session", options as PageOptions)).rejects.toBeInstanceOf(TypeError);
-    expect(fetch).not.toHaveBeenCalled();
-  });
 });
diff --git a/packages/agents-client/src/index.ts b/packages/agents-client/src/index.ts
index 669bdcd4b..18711e960 100644
--- a/packages/agents-client/src/index.ts
+++ b/packages/agents-client/src/index.ts
@@ -10,7 +10,7 @@ export * from "./core-metrics";
 export type { CoreClientOptions } from "./core-request";
 export { isEnvironmentTemplateName, isRecognizedEnvironmentTemplate } from "./environment-template-projection";
 export { isOpenAIHostedSessionEnvironment } from "./session-environment-projection";
-export { compareSkillVersionNumbers, isSkillId, isSkillUploadPath, isSkillVersionId, isSkillVersionNumber, maxSkillUploadFiles } from "./skill-projection";
+export { compareSkillVersionNumbers, isSkillId, isSkillUploadPath, isSkillVersionId, isSkillVersionNumber } from "./skill-projection";
 export { AdminClient } from "./admin-client";
 // Skill and SkillVersion come from ./types; the admin projections use the same shapes.
 export type { AdminClientOptions, AdminProject, CreateAdminProjectInput, RenameAdminProjectInput, AdminAPIKey, AdminIssuedAPIKey, IssueAdminAPIKeyInput, AdminPage, AdminDeleted, SessionArtifact, AdminContent, AdminResourceType, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperation, AdminWriteOperationOptions, AdminWriteOperationPage, AdminSummaryOptions, AdminSummaryEntry, AdminSummary, AdminRuntimeObservation, AdminAuditOptions, AdminAuditEntry, AdminAuditPage, ExecutorCredential, ExecutorConnection, ExecutorCredentialList, IssueExecutorCredentialInput, IssuedExecutorCredential, CoreInstallation, CoreInstallationConfiguration, CoreInstallationSetting, CoreAddressBindings } from "./admin-types";
diff --git a/packages/agents-client/src/protocol-types.test.ts b/packages/agents-client/src/protocol-types.test.ts
index 7756b9ce1..39cc30384 100644
--- a/packages/agents-client/src/protocol-types.test.ts
+++ b/packages/agents-client/src/protocol-types.test.ts
@@ -122,7 +122,7 @@ describe("Parsar dadf64a7 ordered Session input batch", () => {
       "agent.session.input.cancel",
       "agent.session.input.tool_result",
     ]);
-    expect(message.input.map((input) => input.content.map((part) => part.text).join(""))).toEqual([
+    expect(message.input.map((input) => input.content.map((part) => ("text" in part ? part.text : "")).join(""))).toEqual([
       "First message",
       "Second message",
     ]);
@@ -299,7 +299,7 @@ describe("Parsar 182d333d Vault Credentials and Session attachments", () => {
   });
 
   it("pins the owning Vault attachment on the public Session resource", () => {
-    const session = vaultCredentials182d.session as AgentSession;
+    const session = vaultCredentials182d.session as unknown as AgentSession;
     expect(session.vault_ids).toEqual([vaultCredentials182d.vault_list.data[0]?.id]);
     expect(session.environment).toEqual({ type: "none" });
   });
diff --git a/packages/agents-client/src/response-projection.ts b/packages/agents-client/src/response-projection.ts
index 35bd50a32..0a1f6c7fc 100644
--- a/packages/agents-client/src/response-projection.ts
+++ b/packages/agents-client/src/response-projection.ts
@@ -1,20 +1,41 @@
 const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const nilUuid = "00000000-0000-0000-0000-000000000000";
 
-export function exactFields(value: Record<string, unknown>, fields: Set<string>): boolean {
+/** Generated schema field names, or a Set the client defines. */
+export type FieldNames = readonly string[] | ReadonlySet<string>;
+
+function hasField(fields: FieldNames, key: string): boolean {
+  return "has" in fields ? fields.has(key) : fields.includes(key);
+}
+
+export function exactFields(value: object, fields: FieldNames): boolean {
   const keys = Object.keys(value);
-  return keys.length === fields.size && keys.every((key) => fields.has(key));
+  return keys.length === ("size" in fields ? fields.size : fields.length) && keys.every((key) => hasField(fields, key));
+}
+
+export function onlyFields(value: object, fields: FieldNames): boolean {
+  return Object.keys(value).every((key) => hasField(fields, key));
+}
+
+/** Only the schema's fields, with every required one present. */
+export function schemaFields(value: object, fields: FieldNames, required: readonly string[]): boolean {
+  return onlyFields(value, fields) && required.every((field) => hasOwn(value, field));
+}
+
+/** The field names of a generated union variant, or undefined for a tag the schema does not define. */
+export function variantFields(variants: Readonly<Record<string, readonly string[]>>, tag: unknown): readonly string[] | undefined {
+  return typeof tag === "string" && Object.prototype.hasOwnProperty.call(variants, tag) ? variants[tag] : undefined;
 }
 
-export function onlyFields(value: Record<string, unknown>, fields: Set<string>): boolean {
-  return Object.keys(value).every((key) => fields.has(key));
+export function isOneOf<T extends string>(values: readonly T[], value: unknown): value is T {
+  return (values as readonly unknown[]).includes(value);
 }
 
 export function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
-export function hasOwn(value: Record<string, unknown>, field: string): boolean {
+export function hasOwn(value: object, field: string): boolean {
   return Object.prototype.hasOwnProperty.call(value, field);
 }
 
diff --git a/packages/agents-client/src/session-environment-projection.ts b/packages/agents-client/src/session-environment-projection.ts
index 33c06bfd2..a1577f81d 100644
--- a/packages/agents-client/src/session-environment-projection.ts
+++ b/packages/agents-client/src/session-environment-projection.ts
@@ -1,12 +1,7 @@
 import { exactFields, isRecord } from "./response-projection";
+import { environmentPackagesResourceFields, environmentResourceOpenaiHostedFields, networkPolicyResourceFields } from "./generated/public-api";
 import type { OpenAIHostedAgentEnvironment } from "./types";
 
-const hostedSessionEnvironmentFields = new Set([
-  "type", "id", "capability_directories", "network", "packages", "files", "plugins", "skills",
-]);
-const environmentNetworkFields = new Set(["access", "allowed_domains"]);
-const environmentPackagesFields = new Set(["npm", "python", "system"]);
-
 function strings(list: unknown): list is string[] {
   return Array.isArray(list) && list.every((entry) => typeof entry === "string");
 }
@@ -27,14 +22,14 @@ export function projectOpenAIHostedSessionEnvironment(value: unknown): OpenAIHos
   const network = value.network;
   const packages = value.packages;
   if (
-    !exactFields(value, hostedSessionEnvironmentFields) ||
+    !exactFields(value, environmentResourceOpenaiHostedFields) ||
     typeof value.id !== "string" || value.id.trim() === "" ||
     !strings(value.capability_directories) ||
-    !isRecord(network) || !exactFields(network, environmentNetworkFields) ||
+    !isRecord(network) || !exactFields(network, networkPolicyResourceFields) ||
     !strings(network.allowed_domains) ||
     !(((network.access === "enabled" || network.access === "disabled") && network.allowed_domains.length === 0) ||
       (network.access === "restricted" && network.allowed_domains.length > 0)) ||
-    !isRecord(packages) || !exactFields(packages, environmentPackagesFields) ||
+    !isRecord(packages) || !exactFields(packages, environmentPackagesResourceFields) ||
     !strings(packages.npm) || !strings(packages.python) || !strings(packages.system) ||
     !records(value.files) || !records(value.plugins) || !records(value.skills)
   ) return null;
diff --git a/packages/agents-client/src/skill-projection.ts b/packages/agents-client/src/skill-projection.ts
index ed44cb0c1..c2e745e0e 100644
--- a/packages/agents-client/src/skill-projection.ts
+++ b/packages/agents-client/src/skill-projection.ts
@@ -9,16 +9,13 @@ import type {
   SkillVersionDeleted,
   SkillVersionList,
 } from "./types";
-import { exactFields, hasOwn, isNonnegativeInteger, isRecord, onlyFields } from "./response-projection";
+import { exactFields, isNonnegativeInteger, isRecord } from "./response-projection";
+import {
+  deletedSkillResourceFields, deletedSkillVersionResourceFields, skillListResourceFields, skillResourceFields, skillVersionResourceFields,
+} from "./generated/public-api";
 
 type Invalid = (message: string) => never;
 
-const skillFields = new Set(["id", "object", "created_at", "name", "description", "default_version", "latest_version"]);
-const skillVersionFields = new Set(["id", "object", "created_at", "skill_id", "version", "name", "description"]);
-const skillListFields = new Set(["object", "data", "has_more", "first_id", "last_id"]);
-const skillDeletedFields = new Set(["id", "object", "deleted"]);
-const skillVersionDeletedFields = new Set(["id", "object", "deleted", "version"]);
-
 const skillIdPattern = /^skill_[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 const skillVersionIdPattern = /^skillver_[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 // Version numbers are positive decimal strings without leading zeros ("1", "2").
@@ -27,17 +24,9 @@ const skillVersionNumberPattern = /^[1-9][0-9]{0,18}$/;
 const controlCharacterPattern = /[\u0000-\u001f\u007f-\u009f]/;
 const loneSurrogatePattern = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
 
-/** Core accepts at most 500 folder files per upload. */
-export const maxSkillUploadFiles = 500;
-/** A generous bound for one downloaded bundle; Core stores at most 5 MiB per version. */
+/** Bounds the download buffer a Content-Length header can make the client allocate; Core stores at most 5 MiB per version. */
 export const maxSkillContentBytes = 64 * 1024 * 1024;
 const defaultSkillPageLimit = 20;
-const maxUploadFilenameBytes = 1024;
-const maxUploadPathBytes = 4096;
-
-function utf8Length(value: string): number {
-  return new TextEncoder().encode(value).length;
-}
 
 export function isSkillId(value: unknown): value is string {
   return typeof value === "string" && skillIdPattern.test(value);
@@ -64,7 +53,7 @@ export function compareSkillVersionNumbers(left: string, right: string): number
  */
 export function isSkillUploadPath(value: unknown): value is string {
   if (typeof value !== "string" || value.length === 0) return false;
-  if (utf8Length(value) > maxUploadPathBytes || loneSurrogatePattern.test(value)) return false;
+  if (loneSurrogatePattern.test(value)) return false;
   if (value.includes("\\") || controlCharacterPattern.test(value)) return false;
   const segments = value.split("/");
   if (segments.length < 2) return false;
@@ -72,7 +61,7 @@ export function isSkillUploadPath(value: unknown): value is string {
 }
 
 function validZipFilename(value: unknown): value is string {
-  if (typeof value !== "string" || value.length === 0 || utf8Length(value) > maxUploadFilenameBytes) return false;
+  if (typeof value !== "string" || value.length === 0) return false;
   return !loneSurrogatePattern.test(value) && !controlCharacterPattern.test(value) && !/[\\/]/.test(value);
 }
 
@@ -93,12 +82,6 @@ export function validateSkillListOptions(
   if (options?.after !== undefined && !validCursor(options.after)) {
     throw new TypeError(`${label} list cursor is not a valid resource ID.`);
   }
-  if (options?.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 0 || options.limit > 100)) {
-    throw new TypeError(`${label} list limit must be an integer from 0 through 100.`);
-  }
-  if (options?.order !== undefined && options.order !== "asc" && options.order !== "desc") {
-    throw new TypeError(`${label} list order must be asc or desc.`);
-  }
 }
 
 /**
@@ -116,8 +99,8 @@ export function skillUploadBody(input: SkillUploadInput, setDefault?: boolean):
     }
     body.append("files", input.file, input.filename);
   } else if (isRecord(input) && input.kind === "directory") {
-    if (!Array.isArray(input.files) || input.files.length === 0 || input.files.length > maxSkillUploadFiles) {
-      throw new TypeError(`A Skill folder upload requires 1 through ${maxSkillUploadFiles} files.`);
+    if (!Array.isArray(input.files) || input.files.length === 0) {
+      throw new TypeError("A Skill folder upload requires at least one file.");
     }
     const paths = new Set<string>();
     for (const entry of input.files) {
@@ -137,7 +120,7 @@ export function skillUploadBody(input: SkillUploadInput, setDefault?: boolean):
 
 export function projectSkill(value: unknown, invalid: Invalid, expectedId?: string): Skill {
   const message = "OpenAgentCore returned an invalid Skill.";
-  if (!isRecord(value) || !exactFields(value, skillFields)) return invalid(message);
+  if (!isRecord(value) || !exactFields(value, skillResourceFields)) return invalid(message);
   if (
     !isSkillId(value.id) || (expectedId !== undefined && value.id !== expectedId) ||
     value.object !== "skill" ||
@@ -165,7 +148,7 @@ export function projectSkillVersion(
   expectedVersion?: string,
 ): SkillVersion {
   const message = "OpenAgentCore returned an invalid Skill version.";
-  if (!isRecord(value) || !exactFields(value, skillVersionFields)) return invalid(message);
+  if (!isRecord(value) || !exactFields(value, skillVersionResourceFields)) return invalid(message);
   if (
     !isSkillVersionId(value.id) ||
     value.object !== "skill.version" ||
@@ -195,7 +178,7 @@ function projectSkillPage<T extends { id: string }>(
   message: string,
 ): { object: "list"; data: T[]; has_more: boolean; first_id: string | null; last_id: string | null } {
   if (
-    !isRecord(value) || !onlyFields(value, skillListFields) ||
+    !isRecord(value) || !exactFields(value, skillListResourceFields) ||
     value.object !== "list" || !Array.isArray(value.data) || typeof value.has_more !== "boolean"
   ) return invalid(message);
   const limit = options?.limit ?? defaultSkillPageLimit;
@@ -206,8 +189,7 @@ function projectSkillPage<T extends { id: string }>(
   const lastId = data[data.length - 1]?.id ?? null;
   if (
     new Set(data.map((entry) => entry.id)).size !== data.length ||
-    (hasOwn(value, "first_id") && value.first_id !== firstId) ||
-    (hasOwn(value, "last_id") && value.last_id !== lastId) ||
+    value.first_id !== firstId || value.last_id !== lastId ||
     // Limit 0 returns an empty page whose has_more reports whether entries follow.
     (value.has_more && data.length === 0 && limit !== 0) ||
     data.some((entry, index) => index > 0 && !inOrder(data[index - 1]!, entry, order))
@@ -248,7 +230,7 @@ export function projectSkillVersionList(
 
 export function projectSkillDeleted(value: unknown, invalid: Invalid, skillId: string): SkillDeleted {
   if (
-    !isRecord(value) || !exactFields(value, skillDeletedFields) ||
+    !isRecord(value) || !exactFields(value, deletedSkillResourceFields) ||
     value.id !== skillId || value.object !== "skill.deleted" || value.deleted !== true
   ) return invalid("OpenAgentCore returned an invalid Skill deletion receipt.");
   return { id: skillId, object: "skill.deleted", deleted: true };
@@ -256,7 +238,7 @@ export function projectSkillDeleted(value: unknown, invalid: Invalid, skillId: s
 
 export function projectSkillVersionDeleted(value: unknown, invalid: Invalid, version: string): SkillVersionDeleted {
   if (
-    !isRecord(value) || !exactFields(value, skillVersionDeletedFields) ||
+    !isRecord(value) || !exactFields(value, deletedSkillVersionResourceFields) ||
     !isSkillVersionId(value.id) || value.object !== "skill.version.deleted" ||
     value.deleted !== true || value.version !== version
   ) return invalid("OpenAgentCore returned an invalid Skill version deletion receipt.");
diff --git a/packages/agents-client/src/skills.test.ts b/packages/agents-client/src/skills.test.ts
index 0d70902e9..7fb81620b 100644
--- a/packages/agents-client/src/skills.test.ts
+++ b/packages/agents-client/src/skills.test.ts
@@ -171,13 +171,13 @@ describe("Skill response validation", () => {
       json({ ...list, object: "page" }),
       json({ ...list, next: null }),
       json(list),
-      json({ object: "list", data: [], has_more: true }),
+      json({ object: "list", data: [], first_id: null, last_id: null, has_more: true }),
     );
     for (let index = 0; index < 6; index += 1) {
       await expect(client.listSkillVersions(skillId)).rejects.toMatchObject({ code: "invalid_skill_resource" });
     }
     await expect(client.listSkillVersions(skillId, { limit: 1 })).rejects.toMatchObject({ code: "invalid_skill_resource" });
-    // Limit 0 reports only whether entries follow; first_id/last_id are optional.
+    // Limit 0 reports only whether entries follow.
     await expect(client.listSkillVersions(skillId, { limit: 0 })).resolves.toMatchObject({ data: [], has_more: true, first_id: null });
   });
 
@@ -202,10 +202,6 @@ describe("Skill response validation", () => {
 describe("Skill request validation", () => {
   it("rejects invalid query parameters and identifiers before sending", async () => {
     const { client, calls } = clientFor();
-    await expect(client.listSkills({ limit: 101 })).rejects.toThrow(TypeError);
-    await expect(client.listSkills({ limit: -1 })).rejects.toThrow(TypeError);
-    await expect(client.listSkills({ limit: 1.5 })).rejects.toThrow(TypeError);
-    await expect(client.listSkills({ order: "" as "asc" })).rejects.toThrow("asc or desc");
     await expect(client.listSkills({ after: "skillver_1" })).rejects.toThrow("cursor");
     await expect(client.listSkillVersions(skillId, { after: "2" })).rejects.toThrow("cursor");
     await expect(client.listSkillVersions(skillId, { after: skillId })).rejects.toThrow("cursor");
@@ -242,9 +238,7 @@ describe("Skill request validation", () => {
   it("rejects unsafe folder uploads before sending", async () => {
     const { client, calls } = clientFor();
     const file = new Blob(["x"]);
-    const tooMany = Array.from({ length: 501 }, (_, index) => ({ path: `report/${index}.txt`, file }));
     await expect(client.uploadSkill({ kind: "directory", files: [] })).rejects.toThrow(TypeError);
-    await expect(client.uploadSkill({ kind: "directory", files: tooMany })).rejects.toThrow("500");
     await expect(client.uploadSkill({ kind: "directory", files: [{ path: "report/../x", file }] })).rejects.toThrow(TypeError);
     await expect(client.uploadSkill({ kind: "directory", files: [{ path: "report\\SKILL.md", file }] })).rejects.toThrow(TypeError);
     await expect(client.uploadSkill({
diff --git a/packages/agents-client/src/source-files-list.test.ts b/packages/agents-client/src/source-files-list.test.ts
index 691d0c25f..7c52c57b8 100644
--- a/packages/agents-client/src/source-files-list.test.ts
+++ b/packages/agents-client/src/source-files-list.test.ts
@@ -96,17 +96,10 @@ describe("Files list", () => {
     await expect(client.listSourceFiles({ limit: 2 })).rejects.toBeInstanceOf(AgentCoreError);
   });
 
-  it.each([
-    [{ limit: 0 }],
-    [{ limit: 10001 }],
-    [{ limit: 1.5 }],
-    [{ order: "newest" }],
-    [{ after: "notes.txt" }],
-    [{ purpose: "assistants" }],
-  ])("refuses %j before any request", async (options) => {
+  it("refuses a cursor that is not a File ID before any request", async () => {
     const { client, calls } = recordingClient(responses.list_empty);
 
-    await expect(client.listSourceFiles(options as never)).rejects.toBeInstanceOf(TypeError);
+    await expect(client.listSourceFiles({ after: "notes.txt" })).rejects.toBeInstanceOf(TypeError);
     expect(calls).toHaveLength(0);
   });
 
diff --git a/packages/agents-client/src/types.ts b/packages/agents-client/src/types.ts
index 9594d5b11..56a9b0f89 100644
--- a/packages/agents-client/src/types.ts
+++ b/packages/agents-client/src/types.ts
@@ -1,14 +1,38 @@
 import type { CoreHarnessKind, ModelProviderProtocol } from "./harness-catalog";
-export type PageOrder = "asc" | "desc";
-
+import type {
+  AgentsCore, CreateVaultCredentialAuthParamStaticBearer, CreateVaultCredentialParams, CreateVaultParams,
+  DeletedAgentResource, DeletedEnvironmentTemplateResource, DeletedSessionResource, DeletedSkillResource,
+  DeletedSkillVersionResource, DeletedVaultCredentialResource, DeletedVaultResource, DeleteFileResponse,
+  EnvironmentFileListResource, EnvironmentFileResource, EnvironmentPackagesResource, EnvironmentParamNone,
+  EnvironmentParamSelfHosted, EnvironmentResourceSelfHosted, EnvironmentStatusResource, FunctionCallStatusResource,
+  HostedEnvironmentFileParam, InputContentParam, InputContentParamInputText, InputMessageParam, ListOrderParam,
+  McpOauthRefreshResource, MultiAgentConfigCurrentParam, MultiAgentConfigResource, NetworkAccessResource,
+  NetworkPolicyResource, PersistedAgentToolConfigParamFunction, PersistedAgentToolConfigParamProgrammaticToolCalling,
+  PersistedAgentToolConfigParamToolSearch, PersistedAgentToolConfigParamWebSearch, ReasoningEffortResource,
+  ReasoningParam, ReasoningResource, ReasoningSummaryResource, RotateVaultCredentialAuthParamStaticBearer,
+  RotateVaultCredentialParams, ServiceTierResource, SessionEnvironmentStateResource, SessionEnvironmentStatusResource,
+  SessionErrorResource, SessionInputParam, SessionInputParamAgentSessionInputCancel,
+  SessionInputParamAgentSessionInputMessage, SessionInputParamAgentSessionInputToolResult,
+  SessionRequiredActionResource, SessionRequiredActionResourceEnvironmentConnection,
+  SessionRequiredActionResourceFunctionCall, SessionStatusResource, SkillResource, SkillVersionResource,
+  TextFormatResource, TextParam, TextResource, TokenUsageResource, TurnResource, TurnStatusResource,
+  VaultCredentialAuthResourceMcpOauth, VaultCredentialAuthResourceStaticBearer, VaultCredentialResource,
+  VaultResource, VaultStatusParam, WebSearchLocationParam,
+} from "./generated/public-api";
+
+// Generated types keep their schema names in ./generated/public-api; these are the client's names for them.
+export type PageOrder = ListOrderParam;
+
+/** The one cursor-list envelope; the schema repeats it for each resource. */
 export interface ListPage<T> {
+  object: "list";
   data: T[];
+  first_id: string | null;
+  last_id: string | null;
   has_more: boolean;
-  object?: "list";
-  first_id?: string | null;
-  last_id?: string | null;
 }
 
+// Call options carry query parameters and a cancellation signal; they are not wire types.
 export interface PageOptions extends ReadOptions {
   after?: string;
   limit?: number;
@@ -19,41 +43,16 @@ export interface ReadOptions {
   signal?: AbortSignal;
 }
 
-export type AgentTextFormat =
-  | { type: "text" }
-  | { type: "json_schema"; schema: Record<string, unknown> };
-
-export interface AgentTextConfig {
-  format: AgentTextFormat;
-  verbosity: "low" | "medium" | "high";
-}
-
-export interface AgentTextInput {
-  format?: AgentTextConfig["format"] | null;
-  verbosity?: AgentTextConfig["verbosity"] | null;
-}
+export type AgentTextFormat = TextFormatResource;
+export type AgentTextConfig = TextResource;
+export type AgentTextInput = TextParam;
+export type AgentServiceTier = ServiceTierResource;
+export type AgentReasoningEffort = ReasoningEffortResource;
+export type AgentReasoningSummary = ReasoningSummaryResource;
+export type AgentReasoning = ReasoningParam;
+export type MultiAgentInput = MultiAgentConfigCurrentParam;
 
-export type AgentServiceTier = "auto" | "default" | "flex" | "priority" | "fast";
-export type AgentReasoningEffort = "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
-export type AgentReasoningSummary = "concise" | "detailed" | "auto";
-
-export interface AgentReasoning {
-  effort?: AgentReasoningEffort | null;
-  summary?: AgentReasoningSummary | null;
-}
-
-export interface MultiAgentInput {
-  enabled: boolean;
-  max_concurrent_subagents?: number | null;
-}
-
-export interface FunctionToolInput {
-  type: "function";
-  name: string;
-  description: string;
-  parameters: Record<string, unknown>;
-  defer_loading?: boolean;
-}
+export type FunctionToolInput = PersistedAgentToolConfigParamFunction;
 
 /** The service-origin HTTP MCP profile accepted by current Core. */
 export interface ServiceHttpMcpToolInput {
@@ -77,128 +76,66 @@ export type AnonymousHttpMcpToolInput = Omit<ServiceHttpMcpToolInput, "credentia
   credential_id?: null;
 };
 
-export interface ToolSearchInput {
-  type: "tool_search";
-}
+export type ToolSearchInput = PersistedAgentToolConfigParamToolSearch;
 
-export interface ProgrammaticToolCallingInput {
-  type: "programmatic_tool_calling";
-  enabled?: boolean;
-}
+export type ProgrammaticToolCallingInput = PersistedAgentToolConfigParamProgrammaticToolCalling;
 
-export interface WebSearchLocationInput {
-  city?: string | null;
-  country?: string | null;
-  region?: string | null;
-  timezone?: string | null;
-}
+export type WebSearchLocationInput = WebSearchLocationParam;
 
 /**
  * Saved Agents keep every pinned mode; omitted or null `mode` is saved as `live`
  * and omitted or null `context_size` as `medium`. Session admission executes only
  * `disabled` and rejects the other modes unless the Session replaces its tools.
  */
-export interface WebSearchToolInput {
-  type: "web_search";
-  mode?: "disabled" | "cached" | "live" | null;
-  context_size?: "low" | "medium" | "high" | null;
-  /** null and [] are saved distinctly. */
-  allowed_domains?: string[] | null;
-  /** A saved location includes all four keys, with null for omitted ones. */
-  location?: WebSearchLocationInput | null;
-}
+export type WebSearchToolInput = PersistedAgentToolConfigParamWebSearch;
 
+// The tool profiles Core saves, narrowed from the schema's tool params.
 export type SavedAgentToolInput =
   | FunctionToolInput
   | ServiceHttpMcpToolInput
   | ToolSearchInput
   | ProgrammaticToolCallingInput
   | WebSearchToolInput;
+// Session function tools load eagerly.
 export type SessionFunctionToolInput = Omit<FunctionToolInput, "defer_loading"> & { defer_loading?: false };
 export type ConfigurableAgentToolInput = SessionFunctionToolInput | ServiceHttpMcpToolInput;
 
-export type VaultStatus = "active" | "archived";
+export type VaultStatus = VaultStatusParam;
 
 export interface VaultListOptions extends PageOptions {
   status?: VaultStatus | VaultStatus[];
 }
 
-export interface Vault {
-  id: string;
-  object: "vault";
-  created_at: number;
-  name: string | null;
-  metadata: Record<string, string>;
-}
+export type Vault = VaultResource;
 
-export interface VaultList extends ListPage<Vault> {
-  object: "list";
-  first_id: string | null;
-  last_id: string | null;
-}
+export type VaultList = ListPage<Vault>;
 
-export interface CreateVaultInput {
-  name?: string;
-  metadata?: Record<string, string> | null;
-}
+export type CreateVaultInput = CreateVaultParams;
 
-export interface VaultDeleted {
-  id: string;
-  object: "vault.deleted";
-  deleted: true;
-}
+export type VaultDeleted = DeletedVaultResource;
 
-export interface StaticBearerCredentialAuth {
-  type: "static_bearer";
-  mcp_server_url: string;
-}
+export type StaticBearerCredentialAuth = VaultCredentialAuthResourceStaticBearer;
 
-export interface McpOAuthRefreshMetadata {
-  client_id: string;
-  token_endpoint: string;
-  token_endpoint_auth: { type: "none" | "client_secret_basic" | "client_secret_post" };
-  resource: string | null;
-  scope: string | null;
-}
+export type McpOAuthRefreshMetadata = McpOauthRefreshResource;
 
-export interface McpOAuthCredentialAuth {
-  type: "mcp_oauth";
-  mcp_server_url: string;
-  expires_at: string | null;
-  refresh: McpOAuthRefreshMetadata | null;
-}
+export type McpOAuthCredentialAuth = VaultCredentialAuthResourceMcpOauth;
 
-export interface VaultCredential {
-  id: string;
-  vault_id: string;
-  name: string;
-  object: "vault.credential";
-  auth: StaticBearerCredentialAuth | McpOAuthCredentialAuth;
-  created_at: number;
-  updated_at: number;
-}
+export type VaultCredential = VaultCredentialResource;
 
-export interface VaultCredentialList extends ListPage<VaultCredential> {
-  object: "list";
-  first_id: string | null;
-  last_id: string | null;
-}
+export type VaultCredentialList = ListPage<VaultCredential>;
 
-export interface CreateVaultCredentialInput {
-  name: string;
-  auth: StaticBearerCredentialAuth & { token: string };
-}
+// The client writes static bearer Credentials only; it never writes MCP OAuth Credentials.
+export type CreateVaultCredentialInput = Omit<CreateVaultCredentialParams, "auth"> & {
+  auth: CreateVaultCredentialAuthParamStaticBearer;
+};
 
-export interface ReplaceVaultCredentialTokenInput {
-  auth: { type: "static_bearer"; token: string };
-}
+export type ReplaceVaultCredentialTokenInput = Omit<RotateVaultCredentialParams, "auth"> & {
+  auth: RotateVaultCredentialAuthParamStaticBearer;
+};
 
-export interface VaultCredentialDeleted {
-  id: string;
-  object: "vault.credential.deleted";
-  deleted: true;
-}
+export type VaultCredentialDeleted = DeletedVaultCredentialResource;
 
+/** The Agent resource with the client's SavedAgentCore view; Agent responses are not checked, so tools stay opaque. */
 export interface SavedAgent {
   id: string;
   object: "agent";
@@ -207,11 +144,8 @@ export interface SavedAgent {
   name: string | null;
   instructions: string | null;
   metadata: Record<string, string>;
-  multi_agent: {
-    enabled: boolean;
-    max_concurrent_subagents: number | null;
-  };
-  reasoning: AgentReasoning;
+  multi_agent: MultiAgentConfigResource;
+  reasoning: ReasoningResource;
   service_tier: AgentServiceTier;
   text: AgentTextConfig;
   tools: unknown[];
@@ -219,6 +153,7 @@ export interface SavedAgent {
   updated_at: number;
 }
 
+/** Agent params narrowed to the tool profiles and extension inputs the client sends. */
 export interface CreateAgentInput {
   x_agents_core?: SavedAgentCoreInput | null;
   model: string;
@@ -234,6 +169,7 @@ export interface CreateAgentInput {
 
 export type UpdateAgentInput = Partial<CreateAgentInput>;
 
+/** Session Agent params narrowed to the tools a Session may configure. */
 export interface InlineAgentInput {
   x_agents_core?: AgentsCoreSelection | null;
   model?: string;
@@ -245,6 +181,7 @@ export interface InlineAgentInput {
   multi_agent?: MultiAgentInput | null;
 }
 
+/** The Session's frozen Agent: the saved Agent without its resource metadata. */
 export type AgentSnapshot = Omit<SavedAgent, "object" | "metadata" | "created_at" | "updated_at" | "x_agents_core"> & {
   x_agents_core?: AgentsCoreSelection | null;
 };
@@ -253,18 +190,13 @@ declare const unknownEnvironmentType: unique symbol;
 declare const unknownItemType: unique symbol;
 declare const unknownSessionEventType: unique symbol;
 
-export interface NoneAgentEnvironment {
-  type: "none";
-}
+export type NoneAgentEnvironment = EnvironmentParamNone;
 
-export interface SelfHostedAgentEnvironmentInput {
-  type: "self_hosted";
-  workspace_directory: string;
-  capability_directories?: string[] | null;
-}
+export type SelfHostedAgentEnvironmentInput = EnvironmentParamSelfHosted;
 
 export type OpenAIHostedNetworkAccess = "enabled" | "disabled";
 
+/** Narrowed to the network mode and Template reference of the schema's hosted fields. */
 export interface OpenAIHostedAgentEnvironmentInput {
   type: "openai_hosted";
   /** Omitted or null defaults to enabled in the pinned basic Core profile. */
@@ -283,30 +215,17 @@ export type AgentEnvironmentInput =
   | SelfHostedAgentEnvironmentInput
   | OpenAIHostedAgentEnvironmentInput;
 
-export interface SelfHostedAgentEnvironment {
-  type: "self_hosted";
-  id: string;
-  remote_url: string;
-  workspace_directory: string;
-  capability_directories: string[];
-}
+export type SelfHostedAgentEnvironment = EnvironmentResourceSelfHosted;
 
-export interface AgentEnvironmentPackages {
-  npm: string[];
-  python: string[];
-  system: string[];
-}
+export type AgentEnvironmentPackages = EnvironmentPackagesResource;
 
 /**
  * Network policy of a hosted Environment or Template. `restricted` carries the
  * exact hostnames in Core's spelling and order; the other modes carry none.
  */
-export type EnvironmentNetworkAccess = "enabled" | "disabled" | "restricted";
+export type EnvironmentNetworkAccess = NetworkAccessResource;
 
-export interface EnvironmentNetworkPolicy {
-  access: EnvironmentNetworkAccess;
-  allowed_domains: string[];
-}
+export type EnvironmentNetworkPolicy = NetworkPolicyResource;
 
 /**
  * Safe output of a managed Session Environment. A basic profile has only empty
@@ -325,6 +244,7 @@ export interface OpenAIHostedAgentEnvironment {
   skills: Record<string, unknown>[];
 }
 
+// A Session Environment type this client does not know stays readable instead of failing the Session.
 export type UnknownEnvironmentType = string & { readonly [unknownEnvironmentType]: true };
 
 export interface UnknownAgentEnvironment {
@@ -338,8 +258,9 @@ export type AgentEnvironment =
   | OpenAIHostedAgentEnvironment
   | UnknownAgentEnvironment;
 
-export type EnvironmentResourceStatus = "pending" | "connected" | "disconnected" | "expired" | "failed";
+export type EnvironmentResourceStatus = EnvironmentStatusResource;
 
+// The Environment resource split by type; hosted lists are always empty.
 export interface SelfHostedAgentEnvironmentResource {
   id: string;
   object: "agent.environment";
@@ -441,19 +362,9 @@ export interface UnrecognizedEnvironmentTemplate
 
 export type EnvironmentTemplateResource = EnvironmentTemplate | UnrecognizedEnvironmentTemplate;
 
-export interface EnvironmentTemplateList {
-  object: "list";
-  data: EnvironmentTemplateResource[];
-  has_more: boolean;
-  first_id: string | null;
-  last_id: string | null;
-}
+export type EnvironmentTemplateList = ListPage<EnvironmentTemplateResource>;
 
-export interface EnvironmentTemplateDeleted {
-  id: string;
-  object: "agent.environment.template.deleted";
-  deleted: true;
-}
+export type EnvironmentTemplateDeleted = DeletedEnvironmentTemplateResource;
 
 /** A Template network write. Core validates restricted hostnames. */
 export type EnvironmentTemplateNetworkInput =
@@ -473,20 +384,10 @@ export interface CreateEnvironmentTemplateInput {
  */
 export type UpdateEnvironmentTemplateInput = CreateEnvironmentTemplateInput;
 
-export interface EnvironmentFile {
-  environment_id: string;
-  object: "agent.environment.file";
-  path: string;
-  size_bytes: number;
-}
+export type EnvironmentFile = EnvironmentFileResource;
 
 /** Official token page: has_more is true exactly when next carries a token. */
-export interface EnvironmentFileList {
-  object: "page";
-  data: EnvironmentFile[];
-  next: string | null;
-  has_more: boolean;
-}
+export type EnvironmentFileList = EnvironmentFileListResource;
 
 export interface EnvironmentFileListOptions extends ReadOptions {
   limit?: number;
@@ -496,10 +397,9 @@ export interface EnvironmentFileListOptions extends ReadOptions {
   path?: string;
 }
 
-export type EnvironmentFileCreateInput =
-  | { type: "inline"; data: string; path: string }
-  | { type: "file_id"; file_id: string; path: string };
+export type EnvironmentFileCreateInput = HostedEnvironmentFileParam;
 
+/** Narrowed to user_data Files; the pinned File schema types expires_at and status_details as optional, but Core sends null. */
 export interface SourceFile {
   id: string;
   object: "file";
@@ -513,11 +413,7 @@ export interface SourceFile {
   unrecognized?: undefined;
 }
 
-export interface SourceFileDeleted {
-  id: string;
-  object: "file";
-  deleted: true;
-}
+export type SourceFileDeleted = DeleteFileResponse;
 
 /** Files list query. Core accepts limits of 1–10000 (default 10000) and orders newest first by default. */
 export interface SourceFileListOptions extends ReadOptions {
@@ -539,14 +435,9 @@ export interface UnrecognizedSourceFile {
 
 export type SourceFileListEntry = SourceFile | UnrecognizedSourceFile;
 
-export interface SourceFileList {
-  object: "list";
-  data: SourceFileListEntry[];
-  has_more: boolean;
-  first_id: string | null;
-  last_id: string | null;
-}
+export type SourceFileList = ListPage<SourceFileListEntry>;
 
+// Binary and multipart shapes the JSON schema does not describe.
 export interface SourceFileContent {
   data: Uint8Array;
   bytes: number;
@@ -563,56 +454,24 @@ export interface SourceFileUploadInput {
  * A project-owned Skill. Top-level name and description follow the default
  * version; version numbers are positive integer strings that Core never reuses.
  */
-export interface Skill {
-  id: string;
-  object: "skill";
-  created_at: number;
-  name: string;
-  description: string;
-  default_version: string;
-  latest_version: string;
-}
+export type Skill = SkillResource;
 
-export interface SkillList extends ListPage<Skill> {
-  object: "list";
-  first_id: string | null;
-  last_id: string | null;
-}
+export type SkillList = ListPage<Skill>;
 
 /** One immutable uploaded version of a Skill. */
-export interface SkillVersion {
-  id: string;
-  object: "skill.version";
-  skill_id: string;
-  version: string;
-  name: string;
-  description: string;
-  created_at: number;
-}
+export type SkillVersion = SkillVersionResource;
 
-export interface SkillVersionList extends ListPage<SkillVersion> {
-  object: "list";
-  first_id: string | null;
-  last_id: string | null;
-}
+export type SkillVersionList = ListPage<SkillVersion>;
 
-export interface SkillDeleted {
-  id: string;
-  object: "skill.deleted";
-  deleted: true;
-}
+export type SkillDeleted = DeletedSkillResource;
 
 /** Deleting the only remaining version also deletes its Skill. */
-export interface SkillVersionDeleted {
-  id: string;
-  object: "skill.version.deleted";
-  deleted: true;
-  version: string;
-}
+export type SkillVersionDeleted = DeletedSkillVersionResource;
 
 /** Skill lists accept 0 through 100 entries; `after` is a Skill ID, or a version resource ID for version lists. */
 export type SkillListOptions = PageOptions;
 
+// Multipart upload and download shapes the JSON schema does not describe.
 export interface SkillDirectoryFile {
   /** Relative path inside one top-level folder, for example `report/SKILL.md`. */
   path: string;
@@ -637,35 +496,17 @@ export interface SkillContent {
   content_disposition: string;
 }
 
-export type SessionStatus = "idle" | "in_progress" | "requires_action" | "failed";
+export type SessionStatus = SessionStatusResource;
 
-export interface FunctionCallAction {
-  type: "function_call";
-  call_id: string;
-  turn_id: string;
-  name: string;
-  arguments: unknown;
-}
+export type FunctionCallAction = SessionRequiredActionResourceFunctionCall;
 
-export interface EnvironmentConnectionAction {
-  type: "environment_connection";
-  environment_id: string;
-}
+export type EnvironmentConnectionAction = SessionRequiredActionResourceEnvironmentConnection;
 
-export type RequiredAction = FunctionCallAction | EnvironmentConnectionAction;
+export type RequiredAction = SessionRequiredActionResource;
 
-export interface TokenUsage {
-  input_tokens: number;
-  output_tokens: number;
-  total_tokens: number;
-  input_tokens_details: {
-    cached_tokens: number;
-  };
-  output_tokens_details: {
-    reasoning_tokens: number;
-  };
-}
+export type TokenUsage = TokenUsageResource;
 
+/** The installation fields the projection guarantees; the extension schema marks them all optional. */
 export interface EnvironmentInstallation {
   status: "available" | "unavailable";
   version: string;
@@ -674,6 +515,7 @@ export interface EnvironmentInstallation {
   message?: string;
 }
 
+/** The Session resource composed with the client's Agent snapshot, Environment and installation projections. */
 export interface AgentSession {
   x_agents_core?: { installation: EnvironmentInstallation };
   id: string;
@@ -704,6 +546,7 @@ export interface EnvironmentCapabilityArchiveInput {
   source: { type: "base64"; media_type: "application/zip"; data: string };
 }
 
+// The extension schema types environment preparation as an open object.
 export interface EnvironmentPreparationInput {
   environment_template_id?: string;
   env?: Record<string, string> | null;
@@ -715,6 +558,7 @@ export interface EnvironmentPreparationInput {
   capability_directories?: string[] | null;
 }
 
+/** Session params composed with the client's Agent, Environment and extension inputs. */
 export interface CreateSessionInput {
   x_agents_core?: { model_provider?: ModelProviderInput | null; harness_config?: HarnessConfig; environment?: EnvironmentPreparationInput };
   agent_id?: string;
@@ -728,19 +572,13 @@ export interface CreateSessionInput {
   vault_ids?: string[];
 }
 
-export interface InputTextContent {
-  type: "input_text";
-  text: string;
-}
+export type InputTextContent = InputContentParamInputText;
 
-export interface InputMessage {
-  type?: "message";
-  role: "user";
-  content: InputTextContent[];
-}
+export type InputMessage = InputMessageParam;
 
-export type ItemStatus = "in_progress" | "completed" | "failed" | "incomplete";
+export type ItemStatus = FunctionCallStatusResource;
 
+/** Every content part an Item can hold, merged so Web reads one shape. */
 export interface ItemContent {
   type: "input_text" | "output_text" | "input_image" | "encrypted_content";
   text?: string | null;
@@ -766,13 +604,14 @@ export type KnownSessionItemType =
 
 export type UnknownSessionItemType = string & { readonly [unknownItemType]: true };
 
+/** Every Item variant's fields merged into one shape, so Web reads them without narrowing on type. */
 export interface SessionItemBase {
   id: string;
   turn_id: string;
-  /** Inter-agent messages have no status; reasoning may have an unknown status. */
+  /** Inter-agent messages have no status; reasoning may have a null status. */
   status?: ItemStatus | null;
   role?: "user" | "assistant";
-  /** Null on user messages and when the harness reports none; older Cores omit it. */
+  /** Null on user messages and when the harness reports none. */
   phase?: "commentary" | "final_answer" | null;
   content?: ItemContent[];
   command?: string;
@@ -785,7 +624,7 @@ export interface SessionItemBase {
   arguments?: unknown;
   output?: unknown;
   error?: unknown;
-  action?: WebSearchAction;
+  action?: WebSearchAction | null;
   agent_id?: string;
   sender_agent_id?: string;
   recipient_agent_id?: string;
@@ -806,52 +645,26 @@ export interface UnknownSessionItem extends SessionItemBase {
 
 export type SessionItem = KnownSessionItem | UnknownSessionItem;
 
+/** The web search action variants merged into one shape, as on SessionItem. */
 export interface WebSearchAction {
   type: "search" | "open_page" | "find_in_page" | "other";
   query?: string | null;
-  queries?: string[];
+  queries?: string[] | null;
   url?: string | null;
   pattern?: string | null;
 }
 
-export type TurnStatus = "queued" | "in_progress" | "waiting" | "completed" | "failed" | "cancelled";
+export type TurnStatus = TurnStatusResource;
 
-export interface AgentTurn {
-  id: string;
-  /**
-   * The Session's Agent ID, for root and Subagent Turns alike. Older Core
-   * releases sent the Subagent's own ID here for Subagent Turns.
-   */
-  agent_id: string;
-  /** Set on Subagent Turns, which are read through the Subagent routes. */
-  subagent_id?: string | null;
-  session_id: string;
-  object: "agent.session.turn";
-  status: TurnStatus;
-  created_at: number;
-  started_at: number | null;
-  completed_at: number | null;
-  error: { code: "internal_error"; message: string } | null;
-  usage: TokenUsage | null;
-}
+export type AgentTurn = TurnResource;
 
-export interface StreamError {
-  code: string;
-  type: string;
-  message: string;
-  /** Present on Session error events (null when unset); Environment state errors and older or interruption frames omit it. */
-  param?: string | null;
-}
+export type StreamError = SessionErrorResource;
 
-export type SessionEnvironmentStatus = "pending" | "ready" | "connected" | "disconnected" | "failed";
+export type SessionEnvironmentStatus = SessionEnvironmentStatusResource;
 
-export interface SessionEnvironmentState {
-  id: string;
-  type: string;
-  status: SessionEnvironmentStatus;
-  error: StreamError | null;
-}
+export type SessionEnvironmentState = SessionEnvironmentStateResource;
 
+/** Every projected event's fields merged into one shape, as on SessionItem. */
 export interface SessionEventBase {
   event_id: string;
   session_id?: string;
@@ -860,7 +673,7 @@ export interface SessionEventBase {
   turn?: AgentTurn;
   item?: SessionItem;
   item_id?: string;
-  /** Null on Item events for input Items; older Cores omit it. */
+  /** Null on Item events for input Items. */
   output_index?: number | null;
   content_index?: number;
   part?: ItemContent;
@@ -874,9 +687,11 @@ export interface SessionEventBase {
   usage?: TokenUsage | null;
 }
 
+/** Environment events happen outside any Turn, so their turn_id is null. */
 export type AgentSessionEnvironmentEvent = {
-  [Status in SessionEnvironmentStatus]: SessionEventBase & {
+  [Status in SessionEnvironmentStatus]: Omit<SessionEventBase, "turn_id"> & {
     type: `agent.session.environment.${Status}`;
+    turn_id: null;
     environment: SessionEnvironmentState & { status: Status };
   };
 }[SessionEnvironmentStatus];
@@ -889,7 +704,6 @@ export type KnownSessionEventType =
   | "agent.session.failed"
   | "agent.session.turn.created"
   | "agent.session.turn.in_progress"
-  | "agent.session.turn.waiting"
   | "agent.session.turn.completed"
   | "agent.session.turn.failed"
   | "agent.session.turn.cancelled"
@@ -926,18 +740,11 @@ export interface AgentSessionErrorEvent extends SessionEventBase {
 
 export type SessionEvent = AgentSessionEnvironmentEvent | AgentSessionErrorEvent | KnownSessionEvent | UnknownSessionEvent;
 
-export interface AgentDeleted {
-  id: string;
-  object: "agent.deleted";
-  deleted: true;
-}
+export type AgentDeleted = DeletedAgentResource;
 
-export interface SessionDeleted {
-  id: string;
-  object: "agent.session.deleted";
-  deleted: true;
-}
+export type SessionDeleted = DeletedSessionResource;
 
+/** submitFunctionResult's input, which the client encodes as a tool_result event. */
 export interface FunctionResultInput {
   callId: string;
   turnId: string;
@@ -946,37 +753,17 @@ export interface FunctionResultInput {
   error?: string | null;
 }
 
-export type FunctionResultContent =
-  | { type: "input_text"; text: string }
-  | { type: "input_image"; image_url: string };
+export type FunctionResultContent = InputContentParam;
 
-/** Exact public wire shape for an ordered user-message input event. */
-export interface SessionMessageInputEvent {
-  type: "agent.session.input.message";
-  input: InputMessage[];
-}
+export type SessionMessageInputEvent = SessionInputParamAgentSessionInputMessage;
 
-/** Exact public wire shape for a cancellation input event. */
-export interface SessionCancelInputEvent {
-  type: "agent.session.input.cancel";
-}
+export type SessionCancelInputEvent = SessionInputParamAgentSessionInputCancel;
 
-/** Exact public wire shape for a Function result input event. */
-export interface SessionToolResultInputEvent {
-  type: "agent.session.input.tool_result";
-  call_id: string;
-  turn_id: string;
-  success: boolean;
-  output?: string | FunctionResultContent[] | null;
-  error?: string | null;
-}
+export type SessionToolResultInputEvent = SessionInputParamAgentSessionInputToolResult;
 
-/** The three input event variants accepted by the current public Core endpoint. */
-export type SessionInputEvent =
-  | SessionMessageInputEvent
-  | SessionCancelInputEvent
-  | SessionToolResultInputEvent;
+export type SessionInputEvent = SessionInputParam;
 
+// Callbacks for the event stream readers.
 export interface StreamOptions {
   signal?: AbortSignal;
   /** Called once the authenticated streaming response has been accepted. */
@@ -1266,10 +1053,7 @@ export interface SavedAgentCore {
   harness_config?: HarnessConfig;
 }
 
-export interface AgentsCoreSelection {
-  harness?: CoreHarnessKind;
-  harness_config?: HarnessConfig;
-}
+export type AgentsCoreSelection = AgentsCore;
 
 export type ExecutionConfigurationSource = "session" | "agent" | "deployment" | "unknown";
 
diff --git a/packages/agents-client/src/usage-projection.ts b/packages/agents-client/src/usage-projection.ts
index e41985922..3e9dd38e5 100644
--- a/packages/agents-client/src/usage-projection.ts
+++ b/packages/agents-client/src/usage-projection.ts
@@ -1,24 +1,19 @@
 import type { AgentSession } from "./types";
 import { isRecord, exactFields, isNonnegativeInteger } from "./response-projection";
-
-const tokenUsageFields = new Set([
-  "input_tokens", "output_tokens", "total_tokens", "input_tokens_details", "output_tokens_details",
-]);
-const inputTokenDetailsFields = new Set(["cached_tokens"]);
-const outputTokenDetailsFields = new Set(["reasoning_tokens"]);
+import { inputTokensDetailsResourceFields, outputTokensDetailsResourceFields, tokenUsageResourceFields } from "./generated/public-api";
 
 export function projectTokenUsage(value: unknown, invalid: () => never): AgentSession["usage"] {
   if (value === null) return null;
-  if (!isRecord(value) || !exactFields(value, tokenUsageFields)) return invalid();
+  if (!isRecord(value) || !exactFields(value, tokenUsageResourceFields)) return invalid();
   const inputDetails = value.input_tokens_details;
   const outputDetails = value.output_tokens_details;
   if (
     !isNonnegativeInteger(value.input_tokens) ||
     !isNonnegativeInteger(value.output_tokens) ||
     !isNonnegativeInteger(value.total_tokens) ||
-    !isRecord(inputDetails) || !exactFields(inputDetails, inputTokenDetailsFields) ||
+    !isRecord(inputDetails) || !exactFields(inputDetails, inputTokensDetailsResourceFields) ||
     !isNonnegativeInteger(inputDetails.cached_tokens) ||
-    !isRecord(outputDetails) || !exactFields(outputDetails, outputTokenDetailsFields) ||
+    !isRecord(outputDetails) || !exactFields(outputDetails, outputTokensDetailsResourceFields) ||
     !isNonnegativeInteger(outputDetails.reasoning_tokens)
   ) return invalid();
   return {
diff --git a/packages/agents-client/src/vault-credential-auth.ts b/packages/agents-client/src/vault-credential-auth.ts
index 62ec5da3d..76120213a 100644
--- a/packages/agents-client/src/vault-credential-auth.ts
+++ b/packages/agents-client/src/vault-credential-auth.ts
@@ -1,7 +1,9 @@
 import type { McpOAuthRefreshMetadata, VaultCredential } from "./types";
-
-const oauthFields = new Set(["type", "mcp_server_url", "expires_at", "refresh"]);
-const refreshFields = new Set(["client_id", "token_endpoint", "token_endpoint_auth", "resource", "scope"]);
+import { exactFields, isRecord, variantFields } from "./response-projection";
+import {
+  mcpOauthRefreshResourceFields, mcpOauthTokenEndpointAuthResourceFields, vaultCredentialAuthResourceMcpOauthFields,
+  vaultCredentialAuthResourceStaticBearerFields,
+} from "./generated/public-api";
 
 export function validCredentialURL(value: unknown): value is string {
   if (
@@ -19,12 +21,11 @@ export function validCredentialURL(value: unknown): value is string {
 // Each level is projected explicitly; unexpected fields may contain secrets.
 export function projectVaultCredentialAuth(value: Record<string, unknown>): VaultCredential["auth"] | null {
   if (!validCredentialURL(value.mcp_server_url)) return null;
-  const fields = Object.keys(value);
-  if (value.type === "static_bearer" && fields.length === 2) {
+  if (value.type === "static_bearer" && exactFields(value, vaultCredentialAuthResourceStaticBearerFields)) {
     return { type: "static_bearer", mcp_server_url: value.mcp_server_url };
   }
   if (
-    value.type !== "mcp_oauth" || fields.length !== oauthFields.size || !fields.every((field) => oauthFields.has(field)) ||
+    value.type !== "mcp_oauth" || !exactFields(value, vaultCredentialAuthResourceMcpOauthFields) ||
     !(value.expires_at === null || typeof value.expires_at === "string")
   ) return null;
   const refresh = value.refresh === null ? null : projectOAuthRefresh(value.refresh);
@@ -38,25 +39,22 @@ export function projectVaultCredentialAuth(value: Record<string, unknown>): Vaul
 }
 
 function projectOAuthRefresh(value: unknown): McpOAuthRefreshMetadata | null {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-  const refresh = value as Record<string, unknown>;
-  const fields = Object.keys(refresh);
+  if (!isRecord(value)) return null;
+  const refresh = value;
   if (
-    fields.length !== refreshFields.size || !fields.every((field) => refreshFields.has(field)) ||
+    !exactFields(refresh, mcpOauthRefreshResourceFields) ||
     typeof refresh.client_id !== "string" || !validCredentialURL(refresh.token_endpoint) ||
     !(refresh.resource === null || typeof refresh.resource === "string") ||
     !(refresh.scope === null || typeof refresh.scope === "string") ||
     refresh.token_endpoint_auth === null || typeof refresh.token_endpoint_auth !== "object" || Array.isArray(refresh.token_endpoint_auth)
   ) return null;
   const auth = refresh.token_endpoint_auth as Record<string, unknown>;
-  if (
-    Object.keys(auth).length !== 1 ||
-    (auth.type !== "none" && auth.type !== "client_secret_basic" && auth.type !== "client_secret_post")
-  ) return null;
+  const authFields = variantFields(mcpOauthTokenEndpointAuthResourceFields, auth.type);
+  if (!authFields || !exactFields(auth, authFields)) return null;
   return {
     client_id: refresh.client_id,
     token_endpoint: refresh.token_endpoint,
-    token_endpoint_auth: { type: auth.type },
+    token_endpoint_auth: { type: auth.type as McpOAuthRefreshMetadata["token_endpoint_auth"]["type"] },
     resource: refresh.resource,
     scope: refresh.scope,
   };
diff --git a/scripts/generate-public-api.py b/scripts/generate-public-api.py
index f469e0f9b..f6b778cab 100644
--- a/scripts/generate-public-api.py
+++ b/scripts/generate-public-api.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Project the pinned OpenAPI into Core's public contract and Go wire types."""
+"""Project the pinned OpenAPI into Core's public contract, Go wire types and TypeScript client types."""
 import argparse
 import copy
 import hashlib
@@ -11,6 +11,7 @@
 ROOT = Path(__file__).resolve().parents[1]
 CONTRACT = ROOT / 'contracts/agents-api'
 SHAPES = ROOT / 'services/core/internal/api/official_shapes.gen.go'
+CLIENT_TYPES = ROOT / 'packages/agents-client/src/generated/public-api.ts'
 # Agent configuration request bodies checked by Core's shape walker.
 REQUEST_SHAPES = ('CreateAgentParams', 'UpdateAgentParams', 'SessionAgentConfigParam')
 HTTP_METHODS = {'get', 'post', 'put', 'patch', 'delete', 'head', 'options'}
@@ -308,6 +309,78 @@ def convert(value):
     return doc
 
 
+def ts_name(name):
+    return re.sub(r'\W', '', name.split('/')[-1].split('.')[-1])
+
+
+def ts_const(name, suffix):
+    name = ts_name(name)
+    return name[0].lower() + name[1:] + suffix
+
+
+def ts_group(typ):
+    return f'({typ})' if ' | ' in typ or ' & ' in typ else typ
+
+
+def ts_type(schema):
+    """Map an OpenAPI 3.1 or Swagger 2.0 schema (x-nullable, any ref prefix) onto a TypeScript type."""
+    if schema.get('x-nullable'):
+        return ts_type({k: v for k, v in schema.items() if k != 'x-nullable'}) + ' | null'
+    if '$ref' in schema:
+        return ts_name(schema['$ref'])
+    for keyword in ('oneOf', 'anyOf'):
+        if keyword in schema:
+            return ' | '.join(dict.fromkeys(ts_type(v) for v in schema[keyword]))
+    if 'allOf' in schema:
+        return ' & '.join(dict.fromkeys(ts_group(ts_type(v)) for v in schema['allOf']))
+    kind = schema.get('type')
+    if 'enum' in schema:
+        values = schema['enum'] + ([None] if isinstance(kind, list) and 'null' in kind and None not in schema['enum'] else [])
+        return ' | '.join(json.dumps(v) for v in values)
+    if isinstance(kind, list):
+        return ' | '.join(ts_type({**schema, 'type': k}) for k in kind)
+    if kind == 'array':
+        return ts_group(ts_type(schema['items'])) + '[]'
+    if 'properties' in schema:
+        required = schema.get('required', [])
+        return '{ ' + ' '.join(f'{k}{"" if k in required else "?"}: {ts_type(v)};' for k, v in schema['properties'].items()) + ' }'
+    if kind == 'object':
+        extra = schema.get('additionalProperties')
+        return f'Record<string, {ts_type(extra) if isinstance(extra, dict) and extra else "unknown"}>'
+    return {'string': 'string', 'integer': 'number', 'number': 'number', 'boolean': 'boolean', 'null': 'null'}.get(kind, 'unknown')
+
+
+def ts_module(schemas, source):
+    """Project parsed schemas (OpenAPI components.schemas or Swagger definitions) onto TypeScript.
+
+    Each enum X gets xValues; each object X gets xFields, plus xRequired when some
+    fields are optional; each discriminated union X maps its tags to the variants'
+    field names in xFields.
+    """
+    if len({ts_name(name) for name in schemas}) != len(schemas):
+        raise ValueError('TypeScript names collide')
+    lines = [f'// Code generated by scripts/generate-public-api.py from {source}; DO NOT EDIT.', '']
+    unions = []
+    for name, schema in sorted(schemas.items(), key=lambda item: ts_name(item[0])):
+        typ = ts_name(name)
+        if 'enum' in schema:
+            values = ts_const(name, 'Values')
+            lines += [f'export const {values} = {json.dumps(schema["enum"])} as const;', f'export type {typ} = (typeof {values})[number];']
+        elif 'properties' in schema:
+            required = schema.get('required', [])
+            lines.append(f'export interface {typ} {{')
+            lines += [f'  {k}{"" if k in required else "?"}: {ts_type(v)};' for k, v in schema['properties'].items()]
+            lines += ['}', f'export const {ts_const(name, "Fields")} = {json.dumps(list(schema["properties"]))} as const;']
+            if set(required) != set(schema['properties']):
+                lines.append(f'export const {ts_const(name, "Required")} = {json.dumps(required)} as const;')
+        else:
+            lines.append(f'export type {typ} = {ts_type(schema)};')
+            if 'discriminator' in schema:
+                mapping = schema['discriminator']['mapping']
+                unions += [f'export const {ts_const(name, "Fields")} = {{'] + [f'  {json.dumps(tag)}: {ts_const(ref, "Fields")},' for tag, ref in mapping.items()] + ['} as const;']
+    return ('\n'.join(lines + unions) + '\n').encode()
+
+
 def write(path, data, check):
     if check:
         if not path.exists() or path.read_bytes() != data:
@@ -335,6 +408,7 @@ def main():
         doc = public_document(source, json.loads(args.extensions.read_text()), owners, pin["beta_header"])
         # JSON is a YAML subset and keeps generation independent of PyYAML.
         write(CONTRACT / 'openapi.yaml', (json.dumps(doc, indent=2, ensure_ascii=False) + '\n').encode(), args.check)
+        write(CLIENT_TYPES, ts_module(doc['components']['schemas'], 'contracts/agents-api/openapi.yaml'), args.check)
         routes = sorted(method.upper() + ' ' + re.sub(r'\{[^}]*\}', '{}', path) for path, item in doc['paths'].items() for method in item if method in HTTP_METHODS)
         write(CONTRACT / 'upstream-routes.json', (json.dumps({'openapi_commit': pin['openapi']['commit'], 'generator': 'scripts/generate-public-api.py', 'routes': routes}, indent=2) + '\n').encode(), args.check)
 
diff --git a/scripts/generate-public-api.test.py b/scripts/generate-public-api.test.py
index ad47f433f..83d346df1 100644
--- a/scripts/generate-public-api.test.py
+++ b/scripts/generate-public-api.test.py
@@ -89,6 +89,29 @@ def test_optional_nullable_and_union_representation(self):
         self.assertEqual(generator.field_type({}, {'type': 'array', 'items': {'type': 'string'}}, True, {}), '[]string')
         self.assertEqual(generator.go_type({}, {'oneOf': [{'type': 'string'}, {'type': 'integer'}]}, {}), 'json.RawMessage')
 
+    def test_generated_client_types_are_current(self):
+        actual = generator.ts_module(self.public['components']['schemas'], 'contracts/agents-api/openapi.yaml')
+        self.assertEqual(actual, generator.CLIENT_TYPES.read_bytes())
+
+    def test_client_types_project_values_fields_and_unions(self):
+        ref = '#/components/schemas/'
+        generated = generator.ts_module({
+            'Color': {'type': 'string', 'enum': ['red', 'blue']},
+            'Paint': {'type': 'object', 'required': ['type', 'color'], 'properties': {
+                'type': {'type': 'string', 'enum': ['paint']}, 'color': {'$ref': ref + 'Color'}, 'note': {'type': ['string', 'null']},
+                'shade': {'allOf': [{'$ref': '#/definitions/Color'}], 'x-nullable': True},
+            }},
+            'Item': {'oneOf': [{'$ref': ref + 'Paint'}], 'discriminator': {'propertyName': 'type', 'mapping': {'paint': ref + 'Paint'}}},
+        }, 'test').decode()
+        for line in (
+            'export const colorValues = ["red", "blue"] as const;', 'export type Color = (typeof colorValues)[number];',
+            '  color: Color;', '  note?: string | null;', '  shade?: Color | null;',
+            'export const paintFields = ["type", "color", "note", "shade"] as const;',
+            'export const paintRequired = ["type", "color"] as const;', 'export type Item = Paint;',
+            'export const itemFields = {\n  "paint": paintFields,\n} as const;',
+        ):
+            self.assertIn(line, generated)
+
     def test_every_public_reference_resolves_and_no_other_apis_leak(self):
         self.assertEqual({p.split('/')[1] for p in self.public['paths']}, {'agents', 'vaults', 'files', 'skills'})
         generator.prune_components(copy.deepcopy(self.public))
diff --git a/services/core/internal/api/hosted_failure_test.go b/services/core/internal/api/hosted_failure_test.go
index db2dd4fa8..a5c8d9112 100644
--- a/services/core/internal/api/hosted_failure_test.go
+++ b/services/core/internal/api/hosted_failure_test.go
@@ -193,9 +193,8 @@ func TestHostedProvisioningFailureInputConflict(t *testing.T) {
 	}
 }
 
-// Core's own interruption frame keeps the three-field error that released
-// clients validate exactly; official error events carry param null.
-func TestStreamInterruptionFrameOmitsParam(t *testing.T) {
+// Core's own interruption frame is a pinned error event with param null.
+func TestStreamInterruptionFrameIsAnErrorEvent(t *testing.T) {
 	var frame []byte
 	writeStreamFailure(func(data []byte) error { frame = data; return nil }, "session")
 	name, data, ok := strings.Cut(strings.TrimSuffix(string(frame), "\n\n"), "\n")
@@ -204,7 +203,7 @@ func TestStreamInterruptionFrameOmitsParam(t *testing.T) {
 		t.Fatalf("frame %q", frame)
 	}
 	want := map[string]any{"type": "error", "event_id": event["event_id"], "session_id": "session", "error": map[string]any{
-		"code": "stream_interrupted", "type": "server_error", "message": "The live stream was interrupted. Reconnect and retrieve the Session and its saved Items to recover."}}
+		"code": "stream_interrupted", "type": "server_error", "message": "The live stream was interrupted. Reconnect and retrieve the Session and its saved Items to recover.", "param": nil}}
 	if id, _ := event["event_id"].(string); id == "" || !reflect.DeepEqual(event, want) {
 		t.Fatalf("interruption frame %s", data)
 	}
diff --git a/services/core/internal/api/stream.go b/services/core/internal/api/stream.go
index 983472b0d..1312c730c 100644
--- a/services/core/internal/api/stream.go
+++ b/services/core/internal/api/stream.go
@@ -252,16 +252,9 @@ func withTurnUsage(event v1.SessionEvent) v1.SessionEvent {
 	return event
 }
 
-// writeStreamFailure sends Core's own interruption frame. Unlike official error
-// events it omits param: released clients validate exactly code, type and message.
+// writeStreamFailure sends Core's own interruption frame, a pinned error event.
 func writeStreamFailure(write func([]byte) error, session string) {
-	event := struct {
-		Type      string         `json:"type"`
-		EventID   string         `json:"event_id"`
-		SessionID string         `json:"session_id"`
-		Error     v1.StreamError `json:"error"`
-	}{"error", uuid.NewString(), session,
-		v1.StreamError{Code: "stream_interrupted", Type: "server_error", Message: "The live stream was interrupted. Reconnect and retrieve the Session and its saved Items to recover."}}
-	payload, _ := json.Marshal(event)
+	payload, _ := json.Marshal(v1.SessionEvent{Type: "error", EventID: uuid.NewString(), SessionID: session,
+		Error: &v1.StreamError{Code: "stream_interrupted", Type: "server_error", Message: "The live stream was interrupted. Reconnect and retrieve the Session and its saved Items to recover."}})
 	_ = write([]byte(fmt.Sprintf("event: error\ndata: %s\n\n", payload)))
 }
diff --git a/services/core/tests/integration/environment_connections_test.go b/services/core/tests/integration/environment_connections_test.go
index 28ab46bb8..dbffb4ce5 100644
--- a/services/core/tests/integration/environment_connections_test.go
+++ b/services/core/tests/integration/environment_connections_test.go
@@ -106,7 +106,7 @@ func TestEnvironmentConnectionOrdersGenerationsAndImmutableEvents(t *testing.T)
 		if err := json.Unmarshal(raw, &wire); err != nil {
 			t.Fatal(err)
 		}
-		if len(wire) != 4 {
+		if len(wire) != 5 || string(wire["turn_id"]) != "null" {
 			t.Fatal("private observation fields escaped", string(raw))
 		}
 		var state map[string]json.RawMessage

From 3844cc42a1dfcaf3376895ab0cdb69e7b4d17adf Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Thu, 8 Oct 2026 16:22:16 +0800
Subject: [PATCH 2/3] Generate the Core client types from the schema (#554)

---
 Makefile                                      |   4 +-
 apps/web/src/features/agents/AgentsPage.tsx   |   3 +-
 .../features/api-keys/KeyFlowDialogs.test.tsx |   7 +-
 .../src/features/api-keys/ProjectDetail.tsx   |  29 +-
 .../src/features/api-keys/ProjectStatus.tsx   |   6 +-
 .../src/features/api-keys/ProjectsPage.tsx    |  24 +-
 .../src/features/api-keys/WriteOperations.tsx |  32 +-
 .../src/features/api-keys/key-flows.test.ts   |  18 +-
 apps/web/src/features/api-keys/key-flows.ts   |  25 +-
 .../src/features/api-keys/project-queries.ts  |  11 +-
 .../web/src/features/api-keys/use-key-flow.ts |   7 +-
 .../src/features/metrics/AgentMetricsPage.tsx |  22 +-
 .../src/features/metrics/CoreMetricsPage.tsx  |  18 +-
 .../features/metrics/agent-metrics-loader.ts  |  12 +-
 .../src/features/metrics/key-usage.test.ts    |  15 +-
 apps/web/src/features/metrics/key-usage.ts    |   4 +-
 .../src/features/metrics/metrics-queries.ts   |   8 +-
 .../src/features/metrics/project-sessions.ts  |  13 +-
 .../src/features/overview/FleetOverview.tsx   |   7 +-
 .../src/features/overview/OverviewPage.tsx    |  30 +-
 .../features/overview/getting-started.test.ts |  12 +-
 .../src/features/overview/getting-started.ts  |  21 +-
 .../src/features/overview/overview-loader.ts  |  12 +-
 .../features/overview/overview-model.test.ts  |  27 +-
 .../src/features/overview/overview-model.ts   |  52 +-
 .../src/features/overview/overview-queries.ts |   5 +-
 .../src/features/overview/test-fixtures.ts    |  10 +-
 apps/web/src/features/sandbox/NodeDetail.tsx  |  12 +-
 .../src/features/sandbox/NodeEnrollment.tsx   |   2 +-
 apps/web/src/features/sandbox/NodeList.tsx    |  14 +-
 .../sessions/ExecutorCredentialsSection.tsx   |  12 +-
 .../features/sessions/SessionDeleteDialog.tsx |   5 +-
 .../src/features/sessions/SessionLogPage.tsx  |   5 +-
 .../executor-credential-ownership.test.tsx    |   2 +-
 .../src/features/sessions/session-log.test.ts |   9 +-
 apps/web/src/i18n/locales/en/keys.ts          |   3 +-
 apps/web/src/i18n/locales/zh-CN/keys.ts       |   3 +-
 apps/web/src/lib/admin-view.ts                | 232 +----
 apps/web/src/lib/format.ts                    |   7 +
 apps/web/src/lib/projects.tsx                 |  55 +-
 apps/web/src/lib/sandbox-diagnostic.test.ts   |   2 +-
 contracts/agents-api/core.openapi.yaml        | 469 ++++++++-
 contracts/agents-api/index.md                 |   2 +-
 contracts/agents-api/runtime.openapi.yaml     |  12 +
 contracts/agents-api/zh/index.md              |   4 +-
 packages/agents-client/README.md              |   2 +-
 .../agents-client/src/admin-client.test.ts    |  27 +-
 packages/agents-client/src/admin-client.ts    |  25 +-
 .../agents-client/src/admin-projection.ts     | 146 ++-
 packages/agents-client/src/admin-types.ts     | 228 +----
 packages/agents-client/src/client.ts          |  30 +-
 packages/agents-client/src/core-metrics.ts    | 108 +--
 .../src/execution-configuration-projection.ts |  32 +-
 .../agents-client/src/generated/core-api.ts   | 907 ++++++++++++++++++
 packages/agents-client/src/index.ts           |   7 +-
 .../src/runtime-history-projection.ts         |  57 +-
 .../agents-client/src/sandbox-client.test.ts  |   2 +-
 packages/agents-client/src/sandbox-client.ts  | 280 ++----
 .../agents-client/src/session-diagnostics.ts  |  60 +-
 packages/agents-client/src/types.ts           | 161 +---
 scripts/generate-public-api.py                |  49 +-
 scripts/generate-public-api.test.py           |  22 +
 scripts/openapi-split/main.go                 |  50 +-
 scripts/openapi-split/main_test.go            |  25 +-
 services/core/internal/adminaudit/reader.go   |  26 +-
 services/core/internal/api/admin_runtime.go   |  14 +-
 .../internal/api/admin_session_archive.go     |   2 +-
 services/core/internal/api/admin_summary.go   |  38 +-
 .../api/environment_executor_management.go    |   2 +-
 services/core/internal/api/installation.go    |  30 +-
 .../core/internal/api/project_api_keys.go     |   4 +-
 services/core/internal/api/sandbox_manager.go |  12 +-
 .../core/internal/api/session_diagnostics.go  |  38 +-
 services/core/internal/api/write_audit.go     |   2 +-
 services/core/internal/coremetrics/types.go   | 112 +--
 .../core/internal/deployment/allocation.go    |  24 +-
 services/core/internal/deployment/node.go     |  74 +-
 .../core/internal/deployment/public_url.go    |   8 +-
 services/core/internal/deployment/view.go     |  76 +-
 services/core/internal/projects/api_key.go    |  18 +-
 services/core/internal/projects/project.go    |  14 +-
 services/core/internal/sandbox/deployment.go  |  18 +-
 services/core/internal/sessions/admin.go      |  12 +-
 .../internal/sessions/executor_credentials.go |  10 +-
 services/core/internal/sessions/reads.go      |   6 +-
 services/core/internal/writeaudit/reader.go   |  38 +-
 86 files changed, 2424 insertions(+), 1656 deletions(-)
 create mode 100644 packages/agents-client/src/generated/core-api.ts

diff --git a/Makefile b/Makefile
index f769ed092..f6b4b3836 100644
--- a/Makefile
+++ b/Makefile
@@ -47,8 +47,8 @@ openapi:
 	    --output "$$output" \
 	    --outputTypes yaml --parseInternal; \
 	python3 scripts/patch-agents-openapi.py "$$output/swagger.yaml"; \
-	go run ./scripts/openapi-split $(OPENAPI_FLAGS) "$$output/swagger.yaml" "$$output/extensions.json" contracts/agents-api/core.openapi.yaml contracts/agents-api/runtime.openapi.yaml; \
-	python3 scripts/generate-public-api.py $(OPENAPI_FLAGS) --extensions "$$output/extensions.json"
+	go run ./scripts/openapi-split $(OPENAPI_FLAGS) "$$output/swagger.yaml" "$$output/extensions.json" "$$output/core.json" contracts/agents-api/core.openapi.yaml contracts/agents-api/runtime.openapi.yaml; \
+	python3 scripts/generate-public-api.py $(OPENAPI_FLAGS) --extensions "$$output/extensions.json" --core "$$output/core.json"
 
 check-sqlc:
 	python3 scripts/check-sqlc.py
diff --git a/apps/web/src/features/agents/AgentsPage.tsx b/apps/web/src/features/agents/AgentsPage.tsx
index e3f9fab0e..af7e82846 100644
--- a/apps/web/src/features/agents/AgentsPage.tsx
+++ b/apps/web/src/features/agents/AgentsPage.tsx
@@ -21,8 +21,7 @@ import { useAgentDetail } from "../resources/detail-queries";
 
 
 function coverage(summary: ProjectSummary | undefined, locale?: string): string {
-  if (!summary || summary.coverage.sessions === 0) return MISSING;
-  return formatPercent(summary.coverage.reported / summary.coverage.sessions, locale);
+  return summary ? formatPercent(summary.coverage.ratio, locale) : MISSING;
 }
 
 /**
diff --git a/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx b/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
index df1cedf90..bfe3ab950 100644
--- a/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
+++ b/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
@@ -3,15 +3,14 @@ import type { ReactElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it } from "vitest";
 
-import { AgentCoreError } from "@oac/agents-client";
+import { type AdminIssuedAPIKey, type AdminProject, AgentCoreError } from "@oac/agents-client";
 import { flowError, keyFlowReducer, type KeyFlow } from "./key-flows";
 import { KeyFlowDialogs, PendingKeyNotice } from "./KeyFlowDialogs";
 import type { KeyFlowControls } from "./use-key-flow";
-import { type AdminIssuedKey, type Project } from "../../lib/admin-view";
 
-const project: Project = { id: "proj_7f3a91c2", name: "Production", status: "active", created_at: 100, archived_at: null, active_key_count: 1 };
+const project: AdminProject = { id: "proj_7f3a91c2", name: "Production", created_at: "1970-01-01T00:01:40Z", archived_at: null, active_key_count: 1 };
 const secret = "pc_live_" + "s".repeat(40);
-const issued: AdminIssuedKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: 300, revoked_at: null, key: secret };
+const issued: AdminIssuedAPIKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: "1970-01-01T00:05:00Z", revoked_at: null, key: secret };
 const controls = (flow: KeyFlow): KeyFlowControls => ({ flow, dispatch: () => undefined, submit: async () => undefined });
 // The how-to-call card under a new key reads the installation through the query cache.
 const render = (element: ReactElement) => renderToStaticMarkup(<QueryClientProvider client={new QueryClient()}>{element}</QueryClientProvider>);
diff --git a/apps/web/src/features/api-keys/ProjectDetail.tsx b/apps/web/src/features/api-keys/ProjectDetail.tsx
index 435c0d9b2..98ea1cb25 100644
--- a/apps/web/src/features/api-keys/ProjectDetail.tsx
+++ b/apps/web/src/features/api-keys/ProjectDetail.tsx
@@ -1,3 +1,4 @@
+import type { AdminAPIKey, AdminProject } from "@oac/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { Plus } from "lucide-react";
 import { useTranslation } from "react-i18next";
@@ -5,7 +6,7 @@ import { useTranslation } from "react-i18next";
 
 import { EmptyState, HelpTip, Kpi, KpiStrip, Section, StatusDot } from "../../components/console-ui";
 import { CopyableId, RowActions } from "../../components/list-ui";
-import { formatCompact, formatDateTime, formatInteger, formatRelative } from "../../lib/format";
+import { epochSeconds, formatCompact, formatDateTime, formatInteger, formatRelative } from "../../lib/format";
 import { useConsoleNavigation } from "../../lib/console-navigation";
 import type { ConsoleView } from "../../lib/console-routes";
 import { admin } from "../../lib/projects";
@@ -14,11 +15,11 @@ import { prefixLabel } from "./key-flows";
 import { loadedFrom, projectKeysQuery, projectSummaryQuery, type Loaded } from "./project-queries";
 import { ProjectStatus } from "./ProjectStatus";
 import { WriteOperations } from "./WriteOperations";
-import { type AdminKey, type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 import { TableSkeleton } from "../../components/Skeleton";
 
 /** A project's keys, active first, from the query cache. */
-export function useProjectKeys(projectId: string | null): Loaded<AdminKey[]> & { retry: () => void } {
+export function useProjectKeys(projectId: string | null): Loaded<AdminAPIKey[]> & { retry: () => void } {
   const query = useQuery({ ...projectKeysQuery(projectId ?? ""), enabled: projectId !== null });
   const { refetch } = query;
   return { ...loadedFrom(query), retry: () => { void refetch(); } };
@@ -38,11 +39,11 @@ const assetLinks: ReadonlyArray<{ key: "agents" | "environment_templates" | "ski
  * write-operation history.
  */
 export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
-  project: Project;
+  project: AdminProject;
   keys: ReturnType<typeof useProjectKeys>;
   busy: boolean;
   onIssue: () => void;
-  onRevoke: (key: AdminKey, activeCount: number) => void;
+  onRevoke: (key: AdminAPIKey, activeCount: number) => void;
 }) {
   const { t, i18n } = useTranslation("keys");
   const { t: tCommon } = useTranslation("common");
@@ -73,8 +74,8 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
       <dl className="resource-facts" aria-label={t("detail.facts")}>
         <div><dt>{t("detail.id")}</dt><dd><CopyableId id={project.id} /></dd></div>
         <div><dt>{t("detail.status")}</dt><dd><ProjectStatus project={project} /></dd></div>
-        <div><dt>{t("detail.created")}</dt><dd>{formatDateTime(project.created_at, locale)}</dd></div>
-        {project.archived_at !== null ? <div><dt>{t("detail.archived")}</dt><dd>{formatDateTime(project.archived_at, locale)}</dd></div> : null}
+        <div><dt>{t("detail.created")}</dt><dd>{formatDateTime(epochSeconds(project.created_at), locale)}</dd></div>
+        {project.archived_at !== null ? <div><dt>{t("detail.archived")}</dt><dd>{formatDateTime(epochSeconds(project.archived_at), locale)}</dd></div> : null}
         <div>
           <dt>{t("detail.lastActive")}</dt>
           <dd title={summary?.last_active_at != null ? formatDateTime(summary.last_active_at, locale) : undefined}>{formatRelative(summary?.last_active_at, now, locale)}</dd>
@@ -117,7 +118,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
           <Kpi
             label={t("detail.usageFigures.coverage")}
             help={t("detail.usageFigures.coverageHelp")}
-            value={summary && !pending ? t("detail.coverageValue", { reported: formatInteger(summary.coverage.reported, locale), total: formatInteger(summary.coverage.sessions, locale) }) : "—"}
+            value={summary && !pending ? t("detail.coverageValue", { reported: formatInteger(summary.coverage.measured_sessions, locale), total: formatInteger(summary.coverage.total_sessions, locale) }) : "—"}
           />
         </KpiStrip>
       </Section>
@@ -132,7 +133,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
           </span>
         ) : null}</>}
         help={t("detail.keysHelp")}
-        actions={project.status === "active" ? (
+        actions={project.archived_at === null ? (
           <button className="button outline" type="button" onClick={onIssue} disabled={busy}>
             <Plus size={14} aria-hidden="true" />{t("actions.issue")}
           </button>
@@ -145,7 +146,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
         ) : !keys.value.length && !unknownUsage ? (
           <EmptyState
             title={t("detail.noKeys")}
-            action={project.status === "active" ? <button className="button outline" type="button" onClick={onIssue} disabled={busy}>{t("actions.issue")}</button> : undefined}
+            action={project.archived_at === null ? <button className="button outline" type="button" onClick={onIssue} disabled={busy}>{t("actions.issue")}</button> : undefined}
           />
         ) : (
           <div className="table-frame">
@@ -177,13 +178,13 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
                       <td>
                         <span className="key-status">
                           <StatusDot tone={revoked ? "neutral" : "ok"} label={revoked ? t("detail.keyStatus.revoked") : t("detail.keyStatus.active")} />
-                          {revoked ? <span className="key-status-date">{formatDateTime(key.revoked_at, locale)}</span> : null}
+                          {revoked ? <span className="key-status-date">{formatDateTime(epochSeconds(key.revoked_at), locale)}</span> : null}
                         </span>
                       </td>
-                      <td className="key-nowrap">{formatDateTime(key.created_at, locale)}</td>
+                      <td className="key-nowrap">{formatDateTime(epochSeconds(key.created_at), locale)}</td>
                       {keyUsage(byKey?.get(key.id))}
                       <td className="actions-cell">
-                        {!revoked && project.status === "active" ? (
+                        {!revoked && project.archived_at === null ? (
                           <RowActions>
                             <button className="text-action danger" type="button" aria-label={t("actions.revokeLabel", { name: key.name })} disabled={busy} onClick={() => onRevoke(key, activeCount)}>
                               {t("actions.revoke")}
@@ -210,7 +211,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
         )}
       </Section>
 
-      {project.status === "active" ? <ProjectHowToCall /> : null}
+      {project.archived_at === null ? <ProjectHowToCall /> : null}
 
       <WriteOperations projectId={project.id} keys={keys.value} />
     </>
diff --git a/apps/web/src/features/api-keys/ProjectStatus.tsx b/apps/web/src/features/api-keys/ProjectStatus.tsx
index f0a979e42..83ed957f6 100644
--- a/apps/web/src/features/api-keys/ProjectStatus.tsx
+++ b/apps/web/src/features/api-keys/ProjectStatus.tsx
@@ -1,12 +1,12 @@
+import type { AdminProject } from "@oac/agents-client";
 import { useTranslation } from "react-i18next";
 
 
 import { StatusDot } from "../../components/console-ui";
-import { type Project } from "../../lib/admin-view";
 
-export function ProjectStatus({ project }: { project: Project }) {
+export function ProjectStatus({ project }: { project: AdminProject }) {
   const { t } = useTranslation("keys");
-  return project.status === "archived"
+  return project.archived_at !== null
     ? <StatusDot tone="neutral" label={t("status.archived")} />
     : <StatusDot tone="ok" label={t("status.active")} />;
 }
diff --git a/apps/web/src/features/api-keys/ProjectsPage.tsx b/apps/web/src/features/api-keys/ProjectsPage.tsx
index 01cf722cc..cd8f91f8e 100644
--- a/apps/web/src/features/api-keys/ProjectsPage.tsx
+++ b/apps/web/src/features/api-keys/ProjectsPage.tsx
@@ -1,3 +1,4 @@
+import type { AdminAPIKey, AdminProject } from "@oac/agents-client";
 import { useIsFetching, useQuery, useQueryClient } from "@tanstack/react-query";
 import { ArrowLeft, FolderKanban, Plus } from "lucide-react";
 import { useCallback, useEffect, useMemo, useState } from "react";
@@ -10,7 +11,7 @@ import { ListToolbar, listSummary, NameCell, RowActions, SearchField } from "../
 import { Modal } from "../../components/Modal";
 import { useFailureToast } from "../../components/Toast";
 import { useConsoleIntent, useConsoleNavigation } from "../../lib/console-navigation";
-import { formatDateTime, formatInteger, formatRelative } from "../../lib/format";
+import { epochSeconds, formatDateTime, formatInteger, formatRelative } from "../../lib/format";
 import { admin, useProjects } from "../../lib/projects";
 import { activeKeyNames, archiveKeyCount, flowError, isAbort, isArchiveConfirmed, isUsableName, matchesProject, normalizeName, prefixLabel, projectNameProblem, type FlowError } from "./key-flows";
 import { FlowErrorMessage, KeyFlowDialogs, NameField, PendingKeyNotice } from "./KeyFlowDialogs";
@@ -22,18 +23,17 @@ import { projectsQuery } from "../../lib/queries";
 import { ProjectStatus } from "./ProjectStatus";
 import { useKeyFlow } from "./use-key-flow";
 import "./api-keys.css";
-import { type AdminKey, archiveProject, createProject, type Project, renameProject, revokeKey } from "../../lib/admin-view";
 import { TableSkeleton } from "../../components/Skeleton";
 
 type Dialog =
   /** `thenIssue`: Getting started continues from the new project to its first key. */
   | { kind: "create"; name: string; thenIssue?: boolean }
-  | { kind: "rename"; project: Project; name: string }
+  | { kind: "rename"; project: AdminProject; name: string }
   /** `typed`: the project name, required while it has active keys. */
-  | { kind: "archive"; project: Project; typed: string }
-  | { kind: "revoke"; project: Project; key: AdminKey; activeCount: number };
+  | { kind: "archive"; project: AdminProject; typed: string }
+  | { kind: "revoke"; project: AdminProject; key: AdminAPIKey; activeCount: number };
 
-const manageable = (project: Project) => project.status === "active";
+const manageable = (project: AdminProject) => project.archived_at === null;
 
 /**
  * Platform › Projects and keys. A project owns the assets shared by all of
@@ -58,7 +58,7 @@ export function ProjectsPage() {
   useEffect(() => { setSelectedId(params.id ?? null); }, [params]);
 
   // After a key is issued (or its outcome is uncertain), re-read the project and its keys.
-  const keyChanged = useCallback((project: Project) => {
+  const keyChanged = useCallback((project: AdminProject) => {
     void invalidateProjects(queryClient, { projectId: project.id });
   }, [queryClient]);
   const controls = useKeyFlow(keyChanged);
@@ -138,17 +138,17 @@ export function ProjectsPage() {
     setDialogError(null);
     try {
       if (current.kind === "create") {
-        const project = await createProject(normalizeName(current.name));
+        const project = await admin.createProject({ name: normalizeName(current.name) });
         // The project page opens anew and finds the project in the list at once;
         // the re-read below confirms it. The key dialog follows as its intent.
         queryClient.setQueryData(projectsQuery.queryKey, (list) => (list && !list.some((entry) => entry.id === project.id) ? [...list, project] : list ?? [project]));
         navigate("projects", { id: project.id }, current.thenIssue ? "issue-key" : undefined);
       } else if (current.kind === "rename") {
-        await renameProject(current.project.id, normalizeName(current.name));
+        await admin.renameProject(current.project.id, { name: normalizeName(current.name) });
       } else if (current.kind === "archive") {
-        await archiveProject(current.project.id);
+        await admin.archiveProject(current.project.id);
       } else {
-        await revokeKey(current.project.id, current.key.id);
+        await admin.revokeAPIKey(current.project.id, current.key.id);
       }
       setDialog(null);
     } catch (error) {
@@ -260,7 +260,7 @@ export function ProjectsPage() {
                         </th>
                         <td><ProjectStatus project={project} /></td>
                         <td className="numeric">{formatInteger(project.active_key_count, locale)}</td>
-                        <td className="key-nowrap">{formatDateTime(project.created_at, locale)}</td>
+                        <td className="key-nowrap">{formatDateTime(epochSeconds(project.created_at), locale)}</td>
                         <td className="key-nowrap" title={lastActive !== null ? formatDateTime(lastActive, locale) : undefined}>{formatRelative(lastActive, now, locale)}</td>
                         <td className="actions-cell" onClick={(event) => event.stopPropagation()}>
                           {manageable(project) ? (
diff --git a/apps/web/src/features/api-keys/WriteOperations.tsx b/apps/web/src/features/api-keys/WriteOperations.tsx
index 03f41c3a1..378e61c30 100644
--- a/apps/web/src/features/api-keys/WriteOperations.tsx
+++ b/apps/web/src/features/api-keys/WriteOperations.tsx
@@ -1,3 +1,4 @@
+import { type AdminAPIKey, type AdminKeyProvenance, type AdminResourceType, adminResourceTypes } from "@oac/agents-client";
 import { useInfiniteQuery } from "@tanstack/react-query";
 import { History } from "lucide-react";
 import { useCallback, useMemo, useState } from "react";
@@ -7,28 +8,22 @@ import { useTranslation } from "react-i18next";
 import { useFailureToast } from "../../components/Toast";
 import { EmptyState, Section } from "../../components/console-ui";
 import { CopyableId, ListToolbar, listSummary } from "../../components/list-ui";
-import { formatDateTime, shortId } from "../../lib/format";
+import { epochSeconds, formatDateTime, shortId } from "../../lib/format";
 import { admin } from "../../lib/projects";
 import { prefixLabel } from "./key-flows";
 import { writeOperationsQuery } from "./project-queries";
-import { type AdminKey, type KeyRef, type OwnerResourceType, ownerResourceTypes } from "../../lib/admin-view";
 import { TableSkeleton } from "../../components/Skeleton";
 import { ConsoleSelect } from "../../components/console-select";
 
-export const operationActions = ["create", "update", "delete", "send_events", "upload_file", "upload_version", "update_default_version"] as const;
-type OperationAction = (typeof operationActions)[number];
+const isType = (value: string): value is AdminResourceType => (adminResourceTypes as readonly string[]).includes(value);
 
-const isType = (value: string): value is OwnerResourceType => (ownerResourceTypes as readonly string[]).includes(value);
-const isAction = (value: string): value is OperationAction => (operationActions as readonly string[]).includes(value);
-
-/** The recorded key of a write: its name, else its prefix; "unknown" when none was recorded. */
-export function OperationKey({ value }: { value: KeyRef | null }) {
+/** The recorded key of a write, by name. */
+export function OperationKey({ value }: { value: AdminKeyProvenance }) {
   const { t } = useTranslation("keys");
-  if (!value) return <span className="table-muted">{t("operations.unknownKey")}</span>;
   const revoked = value.revoked_at !== null;
   return (
-    <span className={revoked ? "operation-key revoked" : "operation-key"} title={[value.prefix ? prefixLabel(value.prefix) : null, revoked ? t("detail.keyStatus.revoked") : null].filter(Boolean).join(" · ") || undefined}>
-      {value.name ?? prefixLabel(value.prefix)}
+    <span className={revoked ? "operation-key revoked" : "operation-key"} title={[prefixLabel(value.prefix), revoked ? t("detail.keyStatus.revoked") : null].filter(Boolean).join(" · ")}>
+      {value.name}
     </span>
   );
 }
@@ -37,11 +32,11 @@ export function OperationKey({ value }: { value: KeyRef | null }) {
  * Every successful write made in one project, newest first, with cursor
  * paging (`next_cursor`). Filters go to Core; nothing is inferred.
  */
-export function WriteOperations({ projectId, keys }: { projectId: string; keys: readonly AdminKey[] | null }) {
+export function WriteOperations({ projectId, keys }: { projectId: string; keys: readonly AdminAPIKey[] | null }) {
   const { t, i18n } = useTranslation("keys");
   const { t: tCommon } = useTranslation("common");
   const locale = i18n.resolvedLanguage;
-  const [type, setType] = useState<OwnerResourceType | "">("");
+  const [type, setType] = useState<AdminResourceType | "">("");
   const [keyId, setKeyId] = useState("");
   const query = useInfiniteQuery(writeOperationsQuery(projectId, { keyId, type }));
   const { data, fetchNextPage, hasNextPage, isFetchingNextPage, refetch } = query;
@@ -55,8 +50,7 @@ export function WriteOperations({ projectId, keys }: { projectId: string; keys:
     void fetchNextPage();
   }, [fetchNextPage, hasNextPage, isFetchingNextPage]);
 
-  const actionLabel = (action: string) => (isAction(action) ? t(`operations.actions.${action}`) : action);
-  const typeLabel = (value: string) => (isType(value) ? t(`operations.types.${value}`) : value);
+  const typeLabel = (value: AdminResourceType) => t(`operations.types.${value}`);
 
   useFailureToast(Boolean(entries) && query.isRefetchError && !query.isFetching, t("operations.failed"), "write-operations-refresh");
   useFailureToast(moreFailed, t("operations.moreFailed"), "write-operations-more");
@@ -89,9 +83,9 @@ export function WriteOperations({ projectId, keys }: { projectId: string; keys:
             <tbody>
               {entries.map((entry) => (
                 <tr key={entry.id}>
-                  <td className="operations-time">{formatDateTime(entry.created_at, locale)}</td>
+                  <td className="operations-time">{formatDateTime(epochSeconds(entry.created_at), locale)}</td>
                   <td><OperationKey value={entry.api_key} /></td>
-                  <td>{actionLabel(entry.action)}</td>
+                  <td>{t(`operations.actions.${entry.action}`)}</td>
                   <td>{typeLabel(entry.resource_type)}</td>
                   <td>
                     <span className="operations-resource">
@@ -136,7 +130,7 @@ export function WriteOperations({ projectId, keys }: { projectId: string; keys:
           onChange={(value) => setType(isType(value) ? value : "")}
           options={[
             { value: "", label: t("operations.allTypes") },
-            ...ownerResourceTypes.map((value) => ({ value, label: typeLabel(value) })),
+            ...adminResourceTypes.map((value) => ({ value, label: typeLabel(value) })),
           ]}
         />
       </ListToolbar>
diff --git a/apps/web/src/features/api-keys/key-flows.test.ts b/apps/web/src/features/api-keys/key-flows.test.ts
index 1c167af1e..085e63a55 100644
--- a/apps/web/src/features/api-keys/key-flows.test.ts
+++ b/apps/web/src/features/api-keys/key-flows.test.ts
@@ -1,6 +1,5 @@
-import { AgentCoreError } from "@oac/agents-client";
+import { type AdminAPIKey, type AdminIssuedAPIKey, type AdminProject, AgentCoreError } from "@oac/agents-client";
 import { describe, expect, it } from "vitest";
-import { type AdminIssuedKey, type AdminKey, type Project } from "../../lib/admin-view";
 
 import {
   activeKeyNames,
@@ -19,10 +18,11 @@ import {
   type KeyFlowEvent,
 } from "./key-flows";
 
-const project: Project = { id: "proj_7f3a91c2", name: "Production", status: "active", created_at: 100, archived_at: null, active_key_count: 1 };
-const archived: Project = { ...project, id: "proj_0b533e99", name: "Legacy", status: "archived", archived_at: 200, active_key_count: 0 };
+const at = (seconds: number) => new Date(seconds * 1000).toISOString();
+const project: AdminProject = { id: "proj_7f3a91c2", name: "Production", created_at: at(100), archived_at: null, active_key_count: 1 };
+const archived: AdminProject = { ...project, id: "proj_0b533e99", name: "Legacy", archived_at: at(200), active_key_count: 0 };
 const secret = "pc_live_" + "x".repeat(40);
-const issued: AdminIssuedKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: 300, revoked_at: null, key: secret };
+const issued: AdminIssuedAPIKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: at(300), revoked_at: null, key: secret };
 
 const run = (events: KeyFlowEvent[], from: KeyFlow = idleFlow) => events.reduce(keyFlowReducer, from);
 
@@ -47,7 +47,7 @@ describe("project and key names", () => {
     expect(keyNameProblem("tab\there")).toBe("invalid");
     expect(projectNameProblem(" Production", ["Production", "Data team"])).toBe("taken");
     expect(keyNameProblem("alice", activeKeyNames([
-      { id: "a", project_id: "proj_7f3a91c2", name: "alice", prefix: "pc_a", created_at: 1, revoked_at: 2 },
+      { id: "a", project_id: "proj_7f3a91c2", name: "alice", prefix: "pc_a", created_at: at(1), revoked_at: at(2) },
     ]))).toBeNull();
     expect(isUsableName("Production", projectNameProblem("Production", ["Production"]))).toBe(false);
   });
@@ -109,7 +109,7 @@ describe("issuing a key", () => {
 
 describe("helpers", () => {
   it("lists active keys first, newest first", () => {
-    const key = (id: string, created: number, revoked: number | null = null): AdminKey => ({ id, project_id: "proj_7f3a91c2", name: id, prefix: `pc_${id}`, created_at: created, revoked_at: revoked });
+    const key = (id: string, created: number, revoked: number | null = null): AdminAPIKey => ({ id, project_id: "proj_7f3a91c2", name: id, prefix: `pc_${id}`, created_at: at(created), revoked_at: revoked === null ? null : at(revoked) });
     expect(sortKeys([key("old", 1), key("gone", 5, 6), key("new", 3)]).map((entry) => entry.id)).toEqual(["new", "old", "gone"]);
   });
 
@@ -120,10 +120,10 @@ describe("helpers", () => {
   });
 
   it("counts the keys archiving revokes from the project read, or from its key list when that shows more", () => {
-    const key = (id: string, projectId = project.id, revoked: number | null = null): AdminKey => ({ id, project_id: projectId, name: id, prefix: `pc_${id}`, created_at: 1, revoked_at: revoked });
+    const key = (id: string, projectId = project.id, revoked: string | null = null): AdminAPIKey => ({ id, project_id: projectId, name: id, prefix: `pc_${id}`, created_at: at(1), revoked_at: revoked });
     const stale = { ...project, active_key_count: 0 };
     expect(archiveKeyCount(stale, undefined)).toBe(0);
-    expect(archiveKeyCount(stale, [key("new"), key("old", project.id, 5), key("other", "proj_other")])).toBe(1);
+    expect(archiveKeyCount(stale, [key("new"), key("old", project.id, at(5)), key("other", "proj_other")])).toBe(1);
     expect(archiveKeyCount({ ...project, active_key_count: 3 }, [key("new")])).toBe(3);
   });
 
diff --git a/apps/web/src/features/api-keys/key-flows.ts b/apps/web/src/features/api-keys/key-flows.ts
index b960bad53..318d9c605 100644
--- a/apps/web/src/features/api-keys/key-flows.ts
+++ b/apps/web/src/features/api-keys/key-flows.ts
@@ -1,5 +1,4 @@
-import { AgentCoreError } from "@oac/agents-client";
-import { type AdminIssuedKey, type AdminKey, type Project } from "../../lib/admin-view";
+import { type AdminAPIKey, type AdminIssuedAPIKey, type AdminProject, AgentCoreError } from "@oac/agents-client";
 
 /**
  * Pure state for projects and their named API keys. A project owns the assets
@@ -46,7 +45,7 @@ export function isUsableName(value: string, problem: NameProblem | null): boolea
  * project's loaded key list shows more (it may be newer, for example after a
  * key was issued and the project list could not be read again).
  */
-export function archiveKeyCount(project: Pick<Project, "id" | "active_key_count">, keys: readonly AdminKey[] | null | undefined): number {
+export function archiveKeyCount(project: Pick<AdminProject, "id" | "active_key_count">, keys: readonly AdminAPIKey[] | null | undefined): number {
   const listed = keys ? keys.filter((key) => key.project_id === project.id && key.revoked_at === null).length : 0;
   return Math.max(project.active_key_count, listed);
 }
@@ -87,16 +86,16 @@ export function isAbort(error: unknown): boolean {
 export type KeyFlow =
   | { step: "idle" }
   /** Issue a named key for an active project. */
-  | { step: "issue"; project: Project; name: string; busy: boolean; error: FlowError | null }
+  | { step: "issue"; project: AdminProject; name: string; busy: boolean; error: FlowError | null }
   /** The plaintext is on screen until the operator confirms it was saved. */
-  | { step: "issued"; project: Project; issued: AdminIssuedKey; open: boolean };
+  | { step: "issued"; project: AdminProject; issued: AdminIssuedAPIKey; open: boolean };
 
 export type KeyFlowEvent =
-  | { type: "openIssue"; project: Project }
+  | { type: "openIssue"; project: AdminProject }
   | { type: "setName"; name: string }
   | { type: "started" }
   | { type: "failed"; error: FlowError }
-  | { type: "issued"; projectId: string; key: AdminIssuedKey }
+  | { type: "issued"; projectId: string; key: AdminIssuedAPIKey }
   | { type: "hideIssued" }
   | { type: "saved" }
   | { type: "cancel" };
@@ -107,7 +106,7 @@ export function keyFlowReducer(flow: KeyFlow, event: KeyFlowEvent): KeyFlow {
   switch (event.type) {
     case "openIssue":
       // Never start a second issuance while a plaintext key is waiting to be saved.
-      if (flow.step !== "idle" || event.project.status !== "active") return flow;
+      if (flow.step !== "idle" || event.project.archived_at !== null) return flow;
       return { step: "issue", project: event.project, name: "", busy: false, error: null };
     case "setName":
       return flow.step === "issue" && !flow.busy ? { ...flow, name: event.name, error: null } : flow;
@@ -131,16 +130,16 @@ export function keyFlowReducer(flow: KeyFlow, event: KeyFlowEvent): KeyFlow {
 }
 
 /** The plaintext currently held by a flow, if any. */
-export function pendingPlaintext(flow: KeyFlow): AdminIssuedKey | null {
+export function pendingPlaintext(flow: KeyFlow): AdminIssuedAPIKey | null {
   return flow.step === "issued" ? flow.issued : null;
 }
 
 /** Active keys first, then newest first. */
-export function sortKeys(keys: readonly AdminKey[]): AdminKey[] {
-  return [...keys].sort((a, b) => Number(a.revoked_at !== null) - Number(b.revoked_at !== null) || b.created_at - a.created_at || a.id.localeCompare(b.id));
+export function sortKeys(keys: readonly AdminAPIKey[]): AdminAPIKey[] {
+  return [...keys].sort((a, b) => Number(a.revoked_at !== null) - Number(b.revoked_at !== null) || Date.parse(b.created_at) - Date.parse(a.created_at) || a.id.localeCompare(b.id));
 }
 
-export function activeKeyNames(keys: readonly AdminKey[] | null | undefined): string[] {
+export function activeKeyNames(keys: readonly AdminAPIKey[] | null | undefined): string[] {
   return (keys ?? []).filter((key) => key.revoked_at === null).map((key) => key.name);
 }
 
@@ -149,7 +148,7 @@ export function prefixLabel(prefix: string | null | undefined): string {
   return prefix ? `${prefix}…` : "—";
 }
 
-export function matchesProject(project: Project, query: string): boolean {
+export function matchesProject(project: AdminProject, query: string): boolean {
   const needle = query.trim().toLocaleLowerCase();
   if (!needle) return true;
   return [project.name, project.id].some((value) => value.toLocaleLowerCase().includes(needle));
diff --git a/apps/web/src/features/api-keys/project-queries.ts b/apps/web/src/features/api-keys/project-queries.ts
index c74e71c05..a984f73d0 100644
--- a/apps/web/src/features/api-keys/project-queries.ts
+++ b/apps/web/src/features/api-keys/project-queries.ts
@@ -1,6 +1,7 @@
+import type { AdminResourceType } from "@oac/agents-client";
 import { infiniteQueryOptions, queryOptions, type QueryClient } from "@tanstack/react-query";
 
-import { listKeys, listWriteOperations, loadSummary, type OwnerResourceType, type ProjectSummary } from "../../lib/admin-view";
+import { listKeys, listWriteOperations, loadSummary, type ProjectSummary } from "../../lib/admin-view";
 import { projectsQuery } from "../../lib/queries";
 import { sortKeys } from "./key-flows";
 
@@ -26,7 +27,7 @@ export const projectScope = (projectId: string) => ["project", projectId] as con
 /** Last activity per project for the list: the per-project summary rows. */
 export const projectActivityQuery = queryOptions({
   queryKey: ["project-activity"],
-  queryFn: async ({ signal }) => (await loadSummary({ signal })).filter((row) => row.agent_id === null && row.key === null),
+  queryFn: async ({ signal }) => (await loadSummary({ signal })).filter((row) => row.agent_id === null && row.key_id === null),
   select: (rows: ProjectSummary[]): ReadonlyMap<string, ProjectSummary> => new Map(rows.map((row) => [row.project_id, row])),
 });
 
@@ -53,11 +54,11 @@ export function projectSummaryQuery(projectId: string) {
         loadSummary({ project_id: projectId, signal }),
         loadSummary({ project_id: projectId, group_by: "key", signal }).catch(() => null),
       ]);
-      const project = projectRows.find((row) => row.project_id === projectId && row.agent_id === null && row.key === null) ?? null;
+      const project = projectRows.find((row) => row.project_id === projectId && row.agent_id === null && row.key_id === null) ?? null;
       let byKey: ProjectSummaries["byKey"] = null;
       if (keyRows) {
         byKey = new Map();
-        for (const row of keyRows) if (row.project_id === projectId) byKey.set(row.key?.id ?? null, row);
+        for (const row of keyRows) if (row.project_id === projectId) byKey.set(row.key_id, row);
       }
       return { project, byKey };
     },
@@ -68,7 +69,7 @@ export const WRITE_OPERATIONS_PAGE_SIZE = 50;
 
 export interface WriteOperationFilter {
   keyId: string;
-  type: OwnerResourceType | "";
+  type: AdminResourceType | "";
 }
 
 /** One project's write operations for one filter, newest first, paged by `next_cursor`. */
diff --git a/apps/web/src/features/api-keys/use-key-flow.ts b/apps/web/src/features/api-keys/use-key-flow.ts
index 99aae65b2..bcd3712b3 100644
--- a/apps/web/src/features/api-keys/use-key-flow.ts
+++ b/apps/web/src/features/api-keys/use-key-flow.ts
@@ -1,7 +1,8 @@
+import type { AdminProject } from "@oac/agents-client";
 import { useCallback, useEffect, useReducer, useRef } from "react";
 
 import { flowError, idleFlow, isAbort, keyFlowReducer, normalizeName, type KeyFlow, type KeyFlowEvent } from "./key-flows";
-import { issueKey, type Project } from "../../lib/admin-view";
+import { admin } from "../../lib/admin-view";
 
 export interface KeyFlowControls {
   flow: KeyFlow;
@@ -15,7 +16,7 @@ export interface KeyFlowControls {
  * changed a project or its keys. Writes are never retried automatically: an
  * uncertain result is reported for the operator to check.
  */
-export function useKeyFlow(onChanged: (project: Project) => void = () => undefined): KeyFlowControls {
+export function useKeyFlow(onChanged: (project: AdminProject) => void = () => undefined): KeyFlowControls {
   const [flow, dispatch] = useReducer(keyFlowReducer, idleFlow);
   const flowRef = useRef(flow);
   flowRef.current = flow;
@@ -43,7 +44,7 @@ export function useKeyFlow(onChanged: (project: Project) => void = () => undefin
     const project = current.project;
     send({ type: "started" });
     try {
-      const key = await issueKey(project.id, keyName);
+      const key = await admin.issueAPIKey(project.id, { name: keyName });
       send({ type: "issued", projectId: project.id, key });
     } catch (error) {
       if (!isAbort(error)) send({ type: "failed", error: flowError(error) });
diff --git a/apps/web/src/features/metrics/AgentMetricsPage.tsx b/apps/web/src/features/metrics/AgentMetricsPage.tsx
index 833e35435..1bc88bdaa 100644
--- a/apps/web/src/features/metrics/AgentMetricsPage.tsx
+++ b/apps/web/src/features/metrics/AgentMetricsPage.tsx
@@ -1,3 +1,4 @@
+import type { AdminProject } from "@oac/agents-client";
 import { AlertTriangle } from "lucide-react";
 import { keepPreviousData, useQuery } from "@tanstack/react-query";
 import { useCallback, useMemo, useState } from "react";
@@ -39,7 +40,7 @@ import { type ProjectReadFailure } from "./project-sessions";
 import { type KeyUsageRow } from "./key-usage";
 import { useStableColors } from "./use-stable-colors";
 import "./MetricsView.css";
-import { type KeyRef, type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 const RANGES: readonly AgentMetricsRange[] = ["1h", "6h", "24h", "7d"];
 
@@ -67,7 +68,7 @@ function bucketLabel(seconds: number, t: TFunction<"metrics">): string {
  * Agent metrics and usage by key through the query cache. A changed project
  * filter or range keeps the last figures on screen until the new ones arrive.
  */
-function useAgentMetricsData(projects: readonly Project[], projectsReady: boolean, filter: ProjectFilterValue, range: AgentMetricsRange) {
+function useAgentMetricsData(projects: readonly AdminProject[], projectsReady: boolean, filter: ProjectFilterValue, range: AgentMetricsRange) {
   const targets = useMemo(() => projects.filter((project) => !filter || project.id === filter), [filter, projects]);
   const metricsQuery = useQuery({ ...agentMetricsQuery(targets, filter, range), enabled: projectsReady, placeholderData: keepPreviousData });
   const keyQuery = useQuery({ ...keyUsageQuery(filter, range), enabled: projectsReady, placeholderData: keepPreviousData });
@@ -172,7 +173,7 @@ function AgentMetricsContent({
   metrics: AgentMetrics;
   listFailures: ProjectReadFailure[];
   showProject: boolean;
-  projectOf: (id: string | null) => Project | undefined;
+  projectOf: (id: string | null) => AdminProject | undefined;
   modelColor: (id: string) => string;
   toolColor: (id: string) => string;
   failure: string | null;
@@ -394,13 +395,8 @@ function AgentMetricsContent({
   );
 }
 
-function keyLabel(key: KeyRef | null, t: TFunction<"metrics">): string {
-  if (!key) return t("keys.unknown");
-  return key.name ?? (key.prefix ? `${key.prefix}…` : t("keys.unknown"));
-}
-
 /** Usage by the API key that created each Session, from Core's summary for the range. */
-function KeyUsageSection({ state, window, showProject, projectOf }: { state: KeyUsageState; window: MetricsWindow; showProject: boolean; projectOf: (id: string) => Project | undefined }) {
+function KeyUsageSection({ state, window, showProject, projectOf }: { state: KeyUsageState; window: MetricsWindow; showProject: boolean; projectOf: (id: string) => AdminProject | undefined }) {
   const { t, i18n } = useTranslation("metrics");
   const { t: tCommon } = useTranslation("common");
   const locale = i18n.resolvedLanguage;
@@ -434,13 +430,13 @@ function KeyUsageSection({ state, window, showProject, projectOf }: { state: Key
   );
 }
 
-function KeyUsageTableRow({ row, showProject, project, now, locale }: { row: ProjectSummary; showProject: boolean; project: Project | undefined; now: number; locale: string | undefined }) {
+function KeyUsageTableRow({ row, showProject, project, now, locale }: { row: ProjectSummary; showProject: boolean; project: AdminProject | undefined; now: number; locale: string | undefined }) {
   const { t } = useTranslation("metrics");
   const key = row.key;
   return (
     <tr>
       <th scope="row">
-        <span className={key ? "table-primary" : "table-primary table-muted"} title={key?.prefix ? `${key.prefix}…` : t("keys.unknownHelp")}>{keyLabel(key, t)}</span>
+        <span className={key ? "table-primary" : "table-primary table-muted"} title={key ? `${key.prefix}…` : t("keys.unknownHelp")}>{key ? key.name : t("keys.unknown")}</span>
         {key?.revoked_at ? <span className="pill">{t("keys.revoked")}</span> : null}
       </th>
       {showProject ? <td><ProjectName project={project} /></td> : null}
@@ -448,8 +444,8 @@ function KeyUsageTableRow({ row, showProject, project, now, locale }: { row: Pro
       <td className="numeric">{formatInteger(row.sessions.in_progress, locale)}</td>
       <td className={row.sessions.failed ? "numeric numeric-danger" : "numeric"}>{formatInteger(row.sessions.failed, locale)}</td>
       <td className="numeric">{row.usage ? formatCompact(row.usage.total_tokens, locale) : MISSING}</td>
-      <td className="numeric" title={row.coverage.sessions ? t("keys.coverageDetail", { reported: row.coverage.reported, total: row.coverage.sessions }) : undefined}>
-        {formatPercent(row.coverage.sessions ? row.coverage.reported / row.coverage.sessions : null, locale)}
+      <td className="numeric" title={row.coverage.total_sessions ? t("keys.coverageDetail", { reported: row.coverage.measured_sessions, total: row.coverage.total_sessions }) : undefined}>
+        {formatPercent(row.coverage.ratio, locale)}
       </td>
       <td className="numeric">{formatRelative(row.last_active_at, now, locale)}</td>
     </tr>
diff --git a/apps/web/src/features/metrics/CoreMetricsPage.tsx b/apps/web/src/features/metrics/CoreMetricsPage.tsx
index 0d7fe6239..887bc7a4e 100644
--- a/apps/web/src/features/metrics/CoreMetricsPage.tsx
+++ b/apps/web/src/features/metrics/CoreMetricsPage.tsx
@@ -9,7 +9,7 @@ import { TimeSeriesChart } from "../../components/charts/TimeSeriesChart";
 import { DashboardSkeleton, TableSkeleton } from "../../components/Skeleton";
 import { useFailureToast } from "../../components/Toast";
 import { EmptyState, Kpi, KpiStrip, PageBody, PageHeader, RefreshButton, Section, SegmentedControl, StatusDot, type Tone } from "../../components/console-ui";
-import { formatBucket, formatBytes, formatClock, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
+import { epochSeconds, formatBucket, formatBytes, formatClock, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
 import { FleetReadNotice } from "../fleet/FleetReadNotice";
 import { fleetSnapshot, useSandboxFleet } from "../fleet/use-sandbox-fleet";
 import { coreMetricsQuery } from "./metrics-queries";
@@ -22,12 +22,6 @@ const GIB = 2 ** 30;
 const jobTone: Record<CoreJobStatus, Tone> = { ok: "ok", failing: "danger", stopped: "warning", unknown: "neutral" };
 const statusTone: Record<CoreMetrics["service"]["status"], Tone> = { running: "ok", degraded: "warning", unknown: "neutral" };
 
-function seconds(value: string | null): number | null {
-  if (!value) return null;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? null : Math.floor(parsed / 1000);
-}
-
 function milliseconds(value: number | null): string {
   return value === null ? MISSING : formatDuration(value / 1000);
 }
@@ -93,7 +87,7 @@ export function CoreMetricsPage() {
 
 function ServiceMeta({ metrics }: { metrics: CoreMetrics }) {
   const { t } = useTranslation("metrics");
-  const started = seconds(metrics.service.started_at);
+  const started = epochSeconds(metrics.service.started_at);
   const now = Math.floor(Date.now() / 1000);
   const notOwner = metrics.service.execution_owner === false;
   return (
@@ -115,11 +109,11 @@ function CoreMetricsBody({ metrics }: { metrics: CoreMetrics }) {
   const locale = i18n.resolvedLanguage;
   const now = Math.floor(Date.now() / 1000);
   const { execution, database, process } = metrics;
-  const processBuckets = useMemo(() => process.series.map((entry) => seconds(entry.start) ?? 0), [process.series]);
+  const processBuckets = useMemo(() => process.series.map((entry) => epochSeconds(entry.start) ?? 0), [process.series]);
   const bucketSeconds = metrics.range.resolution_seconds;
   const bucket = formatBucket(bucketSeconds, locale);
-  const executionBuckets = useMemo(() => execution.series.map((entry) => seconds(entry.start) ?? 0), [execution.series]);
-  const databaseBuckets = useMemo(() => database.series.map((entry) => seconds(entry.start) ?? 0), [database.series]);
+  const executionBuckets = useMemo(() => execution.series.map((entry) => epochSeconds(entry.start) ?? 0), [execution.series]);
+  const databaseBuckets = useMemo(() => database.series.map((entry) => epochSeconds(entry.start) ?? 0), [database.series]);
   const count = (value: number | null) => (value === null ? MISSING : formatInteger(value, locale));
   const integer = (value: number) => formatInteger(value, locale);
   const slotsFull = execution.slots_in_use >= execution.slots_total;
@@ -313,7 +307,7 @@ function CoreMetricsBody({ metrics }: { metrics: CoreMetrics }) {
                   <tr key={job.id}>
                     <th scope="row"><span className="table-primary">{t(`core.jobs.names.${job.id}`, { defaultValue: job.id })}</span></th>
                     <td><StatusDot tone={jobTone[job.status]} label={t(`core.jobs.health.${job.status}`)} /></td>
-                    <td className="numeric" title={job.last_run_at ?? undefined}>{formatRelative(seconds(job.last_run_at), now, locale)}</td>
+                    <td className="numeric" title={job.last_run_at ?? undefined}>{formatRelative(epochSeconds(job.last_run_at), now, locale)}</td>
                     <td className="numeric">{count(job.processed)}</td>
                     <td className={job.failed ? "numeric numeric-danger" : "numeric"}>{count(job.failed)}</td>
                   </tr>
diff --git a/apps/web/src/features/metrics/agent-metrics-loader.ts b/apps/web/src/features/metrics/agent-metrics-loader.ts
index b7e6ba23a..27cddade7 100644
--- a/apps/web/src/features/metrics/agent-metrics-loader.ts
+++ b/apps/web/src/features/metrics/agent-metrics-loader.ts
@@ -1,9 +1,9 @@
-import type { AgentSession, AgentTurn, ListPage, PageOptions, SessionItem } from "@oac/agents-client";
+import type { AdminProject, AgentSession, AgentTurn, ListPage, PageOptions, SessionItem } from "@oac/agents-client";
 
 import type { ProjectClient } from "../../lib/projects";
 import type { MetricsCoverage, MetricsWindow, SessionActivity } from "./agent-metrics";
 import { readProjectsSessions, type InProject, type ProjectReadFailure, type SessionLister } from "./project-sessions";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 export interface AgentMetricsSource {
   listTurns(sessionId: string, options?: PageOptions): Promise<ListPage<AgentTurn>>;
@@ -204,7 +204,7 @@ export const PROJECT_SESSION_LIST_CAP = 2_000;
 type ProjectReader = SessionLister & Pick<ProjectClient, "listTurns" | "listItems">;
 
 /** Routes each Session's Turn and Item reads to the admin scope of its project. */
-export function projectMetricsSource(sessions: readonly InProject<AgentSession>[], clientFor: (project: Project) => AgentMetricsSource): AgentMetricsSource {
+export function projectMetricsSource(sessions: readonly InProject<AgentSession>[], clientFor: (project: AdminProject) => AgentMetricsSource): AgentMetricsSource {
   const owners = new Map(sessions.map((entry) => [entry.value.id, entry.project]));
   const client = (sessionId: string) => {
     const project = owners.get(sessionId);
@@ -229,7 +229,7 @@ export function projectMayHaveActivity(row: ProjectSummary | undefined, window:
 
 export interface ProjectAgentMetricsLoad extends AgentMetricsLoad {
   /** Projects whose Session list was longer than the list cap. */
-  truncatedLists: Project[];
+  truncatedLists: AdminProject[];
   listFailures: ProjectReadFailure[];
 }
 
@@ -239,9 +239,9 @@ export interface ProjectAgentMetricsLoad extends AgentMetricsLoad {
  * history of the most recently active ones through each project's scope.
  */
 export async function loadProjectAgentMetrics(
-  projects: readonly Project[],
+  projects: readonly AdminProject[],
   window: MetricsWindow,
-  deps: { clientFor: (project: Project) => ProjectReader; summary: ProjectSummary[] | null },
+  deps: { clientFor: (project: AdminProject) => ProjectReader; summary: ProjectSummary[] | null },
   signal: AbortSignal,
   options: { includeTools: boolean; limits?: AgentMetricsLoadLimits; listCap?: number },
 ): Promise<ProjectAgentMetricsLoad> {
diff --git a/apps/web/src/features/metrics/key-usage.test.ts b/apps/web/src/features/metrics/key-usage.test.ts
index ce8bfb7d7..422bee7ec 100644
--- a/apps/web/src/features/metrics/key-usage.test.ts
+++ b/apps/web/src/features/metrics/key-usage.test.ts
@@ -1,22 +1,19 @@
 import { describe, expect, it } from "vitest";
 
-
 import { summary } from "../overview/test-fixtures";
 import { keyUsageRows } from "./key-usage";
-import { type KeyRef } from "../../lib/admin-view";
 
-const key = (id: string): KeyRef => ({ id, name: id, prefix: `pc_${id}`, revoked_at: null });
 const sessions = (total: number) => ({ total, idle: total, in_progress: 0, requires_action: 0, failed: 0 });
-const usage = (total: number) => ({ input_tokens: total, output_tokens: 0, total_tokens: total, cached_tokens: 0, reasoning_tokens: 0 });
+const usage = (total: number) => ({ input_tokens: total, input_tokens_details: { cached_tokens: 0 }, output_tokens: 0, output_tokens_details: { reasoning_tokens: 0 }, total_tokens: total });
 
 describe("keyUsageRows", () => {
   it("ranks keys by tokens, keeps unreported usage below reported, lists unknown creators last and drops idle keys", () => {
     const rows = keyUsageRows([
-      summary("p1", { key: null, assets: null, sessions: sessions(9), usage: usage(900) }),
-      summary("p1", { key: key("small"), assets: null, sessions: sessions(2), usage: usage(10) }),
-      summary("p2", { key: key("big"), assets: null, sessions: sessions(1), usage: usage(500) }),
-      summary("p2", { key: key("silent"), assets: null, sessions: sessions(4), usage: null }),
-      summary("p2", { key: key("idle"), assets: null, sessions: sessions(0) }),
+      summary("p1", { key_id: null, assets: null, sessions: sessions(9), usage: usage(900) }),
+      summary("p1", { key_id: "small", assets: null, sessions: sessions(2), usage: usage(10) }),
+      summary("p2", { key_id: "big", assets: null, sessions: sessions(1), usage: usage(500) }),
+      summary("p2", { key_id: "silent", assets: null, sessions: sessions(4), usage: null }),
+      summary("p2", { key_id: "idle", assets: null, sessions: sessions(0) }),
     ]);
     expect(rows.map((row) => row.id)).toEqual(["p2:big", "p1:small", "p2:silent", "p1:unknown"]);
   });
diff --git a/apps/web/src/features/metrics/key-usage.ts b/apps/web/src/features/metrics/key-usage.ts
index fa89d686d..593c847d5 100644
--- a/apps/web/src/features/metrics/key-usage.ts
+++ b/apps/web/src/features/metrics/key-usage.ts
@@ -14,9 +14,9 @@ export interface KeyUsageRow {
 export function keyUsageRows(rows: readonly ProjectSummary[]): KeyUsageRow[] {
   return rows
     .filter((row) => row.agent_id === null && row.sessions.total > 0)
-    .map((summary) => ({ id: summary.key ? `${summary.project_id}:${summary.key.id}` : `${summary.project_id}:unknown`, summary }))
+    .map((summary) => ({ id: `${summary.project_id}:${summary.key_id ?? "unknown"}`, summary }))
     .sort((a, b) => (
-      Number(a.summary.key === null) - Number(b.summary.key === null)
+      Number(a.summary.key_id === null) - Number(b.summary.key_id === null)
       || (b.summary.usage?.total_tokens ?? -1) - (a.summary.usage?.total_tokens ?? -1)
       || b.summary.sessions.total - a.summary.sessions.total
       || a.id.localeCompare(b.id)
diff --git a/apps/web/src/features/metrics/metrics-queries.ts b/apps/web/src/features/metrics/metrics-queries.ts
index d76ce332d..f7ac0a983 100644
--- a/apps/web/src/features/metrics/metrics-queries.ts
+++ b/apps/web/src/features/metrics/metrics-queries.ts
@@ -1,7 +1,7 @@
 import { queryOptions } from "@tanstack/react-query";
-import { CoreMetricsClient, type CoreMetricsRange } from "@oac/agents-client";
+import { type AdminProject, CoreMetricsClient, type CoreMetricsRange } from "@oac/agents-client";
 
-import { listRuntimeObservations, loadSummary, type Project } from "../../lib/admin-view";
+import { listRuntimeObservations, loadSummary } from "../../lib/admin-view";
 import { projectClient } from "../../lib/projects";
 import { aggregateAgentMetrics, metricsWindow, type AgentMetrics, type AgentMetricsRange } from "./agent-metrics";
 import { loadProjectAgentMetrics } from "./agent-metrics-loader";
@@ -20,7 +20,7 @@ export const hostedRuntimesQuery = queryOptions({
 
 export interface LoadedAgentMetrics {
   metrics: AgentMetrics;
-  truncatedLists: Project[];
+  truncatedLists: AdminProject[];
   listFailures: ProjectReadFailure[];
   /** Epoch milliseconds. */
   loadedAt: number;
@@ -31,7 +31,7 @@ export interface LoadedAgentMetrics {
  * read time; the key holds every input: the project filter, the range and the
  * projects read.
  */
-export function agentMetricsQuery(targets: readonly Project[], filter: string, range: AgentMetricsRange) {
+export function agentMetricsQuery(targets: readonly AdminProject[], filter: string, range: AgentMetricsRange) {
   return queryOptions({
     queryKey: ["agent-metrics", { project: filter, range }, targets.map((project) => project.id)],
     queryFn: async ({ signal }): Promise<LoadedAgentMetrics> => {
diff --git a/apps/web/src/features/metrics/project-sessions.ts b/apps/web/src/features/metrics/project-sessions.ts
index c5c38fe89..0df779462 100644
--- a/apps/web/src/features/metrics/project-sessions.ts
+++ b/apps/web/src/features/metrics/project-sessions.ts
@@ -1,7 +1,6 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 
 import type { Owned, ProjectClient } from "../../lib/projects";
-import { type Project } from "../../lib/admin-view";
 
 /**
  * Bounded reads of each project's Session list through its admin scope. The
@@ -45,19 +44,19 @@ export async function readSessions(client: SessionLister, options: SessionReadOp
 }
 
 export interface ProjectSessionRead extends SessionRead {
-  project: Project;
+  project: AdminProject;
 }
 
 export interface ProjectReadFailure {
-  project: Project;
+  project: AdminProject;
   message: string;
 }
 
 /** Reads several projects in parallel; a failing project is reported by name and the others still count. */
 export async function readProjectsSessions(
-  projects: readonly Project[],
-  clientFor: (project: Project) => SessionLister,
-  options: (project: Project) => SessionReadOptions,
+  projects: readonly AdminProject[],
+  clientFor: (project: AdminProject) => SessionLister,
+  options: (project: AdminProject) => SessionReadOptions,
 ): Promise<{ reads: ProjectSessionRead[]; failures: ProjectReadFailure[] }> {
   const results = await Promise.allSettled(projects.map(async (project) => ({ project, ...(await readSessions(clientFor(project), options(project))) })));
   const reads: ProjectSessionRead[] = [];
diff --git a/apps/web/src/features/overview/FleetOverview.tsx b/apps/web/src/features/overview/FleetOverview.tsx
index 238d67d49..310a8a2cc 100644
--- a/apps/web/src/features/overview/FleetOverview.tsx
+++ b/apps/web/src/features/overview/FleetOverview.tsx
@@ -6,13 +6,12 @@ import { useTranslation } from "react-i18next";
 
 import { ConsolePopover } from "../../components/console-popover";
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
-import { formatBytes, formatDateTime, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
+import { epochSeconds, formatBytes, formatDateTime, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
 import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { nodeHealth, suspendedSandboxes, type NodeHealth } from "../fleet/fleet-model";
 import { coreMetricsQuery } from "../metrics/metrics-queries";
 import { NodeRolloutStatus } from "../sandbox/NodeRolloutStatus";
-import { seconds } from "../sandbox/NodeList";
 
 /** Nodes shown in the overview; the rest are counted and listed on the Nodes page. */
 export const FLEET_LIMIT = 4;
@@ -147,7 +146,7 @@ function NodeGlance({ node, health, stale, suspends }: { node: SandboxNode; heal
   const { t, i18n } = useTranslation("overview");
   const locale = i18n.resolvedLanguage;
   const now = Math.floor(Date.now() / 1000);
-  const seen = seconds(node.last_seen_at);
+  const seen = epochSeconds(node.last_seen_at);
   const count = (value: number) => formatInteger(value, locale);
   const diagnostic = health === "degraded" ? nodeProviderDiagnostic(node) : "";
   return (
@@ -180,7 +179,7 @@ function CoreGlance({ label, tone }: { label: string; tone: Tone }) {
   const query = useQuery({ ...coreMetricsQuery("1h"), retry: false });
   const metrics = query.data ?? null;
   const count = (value: number | null) => (value === null ? MISSING : formatInteger(value, locale));
-  const started = seconds(metrics?.service.started_at ?? null);
+  const started = epochSeconds(metrics?.service.started_at ?? null);
   const now = Math.floor(Date.now() / 1000);
   return (
     <Facts>
diff --git a/apps/web/src/features/overview/OverviewPage.tsx b/apps/web/src/features/overview/OverviewPage.tsx
index 0b8975260..0036ee4ef 100644
--- a/apps/web/src/features/overview/OverviewPage.tsx
+++ b/apps/web/src/features/overview/OverviewPage.tsx
@@ -1,4 +1,4 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { useCallback, useMemo, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
@@ -39,7 +39,6 @@ import { overviewQuery } from "./overview-queries";
 import {
   attentionCount,
   attentionSessions,
-  coverageRatio,
   projectUsageRows,
   recentFailures,
   serviceHealth,
@@ -50,7 +49,7 @@ import {
   type ServiceHealth,
 } from "./overview-model";
 import "./overview.css";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 export const OVERVIEW_REFRESH_MS = 30_000;
 const ATTENTION_LIMIT = 8;
@@ -72,7 +71,7 @@ function errorText(error: unknown): string {
  * a refresh retains figures within the same project scope, and the
  * page polls while it is visible.
  */
-function useOverviewData(projects: readonly Project[], projectsReady: boolean) {
+function useOverviewData(projects: readonly AdminProject[], projectsReady: boolean) {
   const query = useQuery({
     ...overviewQuery(projects),
     enabled: projectsReady,
@@ -150,10 +149,10 @@ export function OverviewPage() {
 
   const loading = refreshing || projectsState.state.status === "loading" || (fleetState.status === "ready" && fleetState.refreshing);
   const updatedAt = data?.loadedAt ?? fleet?.loadedAt ?? null;
-  const attentionTotal = totals ? attentionCount(totals.sessions) : null;
+  const attentionTotal = totals ? attentionCount(totals) : null;
   const truncated = data?.sessions.truncated ?? [];
   // Whether any Session exists: Core's summary counts them all; without it, any Session read counts.
-  const sessionCount = totals ? totals.sessions.total
+  const sessionCount = totals ? totals.total
     : sessions?.length ? sessions.length
     : summaryError !== null || sessionReadsFailed ? "failed" : null;
 
@@ -190,8 +189,8 @@ export function OverviewPage() {
           <MetricTile
             label={t("kpi.running")}
             help={t("kpi.runningHelp")}
-            value={totals ? <LiveNumber value={totals.sessions.in_progress} /> : MISSING}
-            sub={totals ? t("tiles.sessionSplit", { idle: formatInteger(totals.sessions.idle, locale), total: formatInteger(totals.sessions.total, locale) }) : t("kpi.summaryUnavailable")}
+            value={totals ? <LiveNumber value={totals.in_progress} /> : MISSING}
+            sub={totals ? t("tiles.sessionSplit", { idle: formatInteger(totals.idle, locale), total: formatInteger(totals.total, locale) }) : t("kpi.summaryUnavailable")}
           />
           {cloud ? (
             <MetricTile
@@ -216,7 +215,7 @@ export function OverviewPage() {
             label={t("kpi.attention")}
             help={t("attention.subtitle")}
             value={<LiveNumber value={attentionTotal} />}
-            sub={totals ? t("tiles.attentionSplit", { failed: totals.sessions.failed, waiting: totals.sessions.requires_action }) : t("kpi.summaryUnavailable")}
+            sub={totals ? t("tiles.attentionSplit", { failed: totals.failed, waiting: totals.requires_action }) : t("kpi.summaryUnavailable")}
           />
         </div>
 
@@ -379,12 +378,12 @@ function usageTitle(summary: ProjectSummary, t: TFunction<"overview">, locale: s
   return t("projects.tokenDetail", {
     input: number(summary.usage.input_tokens),
     output: number(summary.usage.output_tokens),
-    cached: number(summary.usage.cached_tokens),
-    reasoning: number(summary.usage.reasoning_tokens),
+    cached: number(summary.usage.input_tokens_details.cached_tokens),
+    reasoning: number(summary.usage.output_tokens_details.reasoning_tokens),
   });
 }
 
-function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRow[] | null; failed: boolean; now: number; onOpen: (project: Project) => void }) {
+function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRow[] | null; failed: boolean; now: number; onOpen: (project: AdminProject) => void }) {
   const { t, i18n } = useTranslation("overview");
   const { t: tCommon } = useTranslation("common");
   const locale = i18n.resolvedLanguage;
@@ -409,14 +408,13 @@ function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRo
         </thead>
         <tbody>
           {rows.map(({ project, summary }) => {
-            const coverage = summary ? coverageRatio(summary.coverage) : null;
             return (
               <tr key={project.id} className="clickable-row" onClick={() => onOpen(project)}>
                 <th scope="row">
                   <button className="table-link" type="button" onClick={(event) => { event.stopPropagation(); onOpen(project); }} aria-label={t("projects.open", { name: project.name })}>
                     <strong><ProjectName project={project} /></strong>
                   </button>
-                  {project.status === "archived" ? <span className="pill">{t("projects.archived")}</span> : null}
+                  {project.archived_at !== null ? <span className="pill">{t("projects.archived")}</span> : null}
                 </th>
                 <td className="numeric">{count(project.active_key_count)}</td>
                 <td className="numeric">{count(summary?.sessions.total)}</td>
@@ -424,8 +422,8 @@ function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRo
                 <td className="numeric">{count(summary?.sessions.requires_action)}</td>
                 <td className={summary?.sessions.failed ? "numeric numeric-danger" : "numeric"}>{count(summary?.sessions.failed)}</td>
                 <td className="numeric" title={summary ? usageTitle(summary, t, locale) : undefined}>{summary?.usage ? formatCompact(summary.usage.total_tokens, locale) : MISSING}</td>
-                <td className="numeric" title={summary && summary.coverage.sessions ? t("projects.coverageDetail", { reported: summary.coverage.reported, total: summary.coverage.sessions }) : undefined}>
-                  {formatPercent(coverage, locale)}
+                <td className="numeric" title={summary && summary.coverage.total_sessions ? t("projects.coverageDetail", { reported: summary.coverage.measured_sessions, total: summary.coverage.total_sessions }) : undefined}>
+                  {formatPercent(summary?.coverage.ratio, locale)}
                 </td>
                 <td className="numeric">{formatRelative(summary?.last_active_at ?? null, now, locale)}</td>
               </tr>
diff --git a/apps/web/src/features/overview/getting-started.test.ts b/apps/web/src/features/overview/getting-started.test.ts
index 0194079ae..97249ca59 100644
--- a/apps/web/src/features/overview/getting-started.test.ts
+++ b/apps/web/src/features/overview/getting-started.test.ts
@@ -75,9 +75,9 @@ describe("Getting started steps", () => {
   it("needs an active project with an active key, and any Session", () => {
     const steps = (projects: Parameters<typeof gettingStartedSteps>[0]["projects"], sessions: number | "failed" | null = 0) => gettingStartedSteps({ sandboxReset: false, fleet: { status: "loading" }, projects, sessions, harnesses: undefined });
     expect(steps([]).key).toEqual({ state: "todo", project: null });
-    const older = project("p1", { active_key_count: 0, created_at: 1 });
-    const newer = project("p2", { active_key_count: 0, created_at: 2 });
-    expect(steps([older, newer, project("p3", { status: "archived", active_key_count: 0, created_at: 3 })]).key).toEqual({ state: "todo", project: newer });
+    const older = project("p1", { active_key_count: 0, created_at: "1970-01-01T00:00:01Z" });
+    const newer = project("p2", { active_key_count: 0, created_at: "1970-01-01T00:00:02Z" });
+    expect(steps([older, newer, project("p3", { archived_at: "1970-01-01T00:00:04Z", active_key_count: 0, created_at: "1970-01-01T00:00:03Z" })]).key).toEqual({ state: "todo", project: newer });
     expect(steps([older, project("p4")]).key.state).toBe("done");
     expect(steps(undefined).key.state).toBeNull();
     expect(steps("failed").key.state).toBe("unknown");
@@ -86,9 +86,9 @@ describe("Getting started steps", () => {
 
   it("opens the call samples of the newest active project with a key, else of the newest active project", () => {
     const call = (projects: Parameters<typeof gettingStartedSteps>[0]["projects"]) => gettingStartedSteps({ sandboxReset: false, fleet: { status: "loading" }, projects, sessions: 0, harnesses: undefined }).session.project;
-    const keyed = project("p1", { created_at: 1 });
-    const newer = project("p2", { active_key_count: 0, created_at: 2 });
-    const archived = project("p3", { status: "archived", active_key_count: 0, created_at: 3 });
+    const keyed = project("p1", { created_at: "1970-01-01T00:00:01Z" });
+    const newer = project("p2", { active_key_count: 0, created_at: "1970-01-01T00:00:02Z" });
+    const archived = project("p3", { archived_at: "1970-01-01T00:00:04Z", active_key_count: 0, created_at: "1970-01-01T00:00:03Z" });
     expect(call([keyed, newer, archived])).toBe(keyed);
     expect(call([newer, archived])).toBe(newer);
     expect([call([archived]), call(undefined), call("failed")]).toEqual([null, null, null]);
diff --git a/apps/web/src/features/overview/getting-started.ts b/apps/web/src/features/overview/getting-started.ts
index 915595455..adc43a39c 100644
--- a/apps/web/src/features/overview/getting-started.ts
+++ b/apps/web/src/features/overview/getting-started.ts
@@ -1,6 +1,5 @@
-import type { CoreHarness } from "@oac/agents-client";
+import type { AdminProject, CoreHarness } from "@oac/agents-client";
 
-import { type Project } from "../../lib/admin-view";
 import { nodeServingReady } from "../fleet/fleet-model";
 import { type FleetState } from "../fleet/use-sandbox-fleet";
 import { templateBuildStatus } from "../sandbox/deployment-specification";
@@ -20,9 +19,9 @@ export interface GettingStartedSteps {
   sandboxes: { state: StepState; action: SandboxAction; cloud: boolean };
   model: StepState;
   /** `project` is the active project a key would be issued for; null means create one first. */
-  key: { state: StepState; project: Project | null };
+  key: { state: StepState; project: AdminProject | null };
   /** `project` is the active project whose call samples the step opens; null leads to the project list. */
-  session: { state: StepState; project: Project | null };
+  session: { state: StepState; project: AdminProject | null };
 }
 
 export function gettingStartedSteps(input: {
@@ -32,7 +31,7 @@ export function gettingStartedSteps(input: {
   /** Undefined while reading; a failed installation read cannot confirm readiness. */
   localOnly?: boolean | "failed";
   /** Undefined until the project list is read. */
-  projects: readonly Project[] | "failed" | undefined;
+  projects: readonly AdminProject[] | "failed" | undefined;
   /** Sessions in every project, by Core's summary; null until it is read. */
   sessions: number | "failed" | null;
   /** Core's harnesses; undefined until they are read. */
@@ -87,13 +86,13 @@ export function modelStep(harnesses: readonly CoreHarness[] | "failed" | undefin
 }
 
 /** The newest of the projects, most likely the one just created. */
-function newestOf(projects: readonly Project[]): Project | null {
-  return projects.reduce<Project | null>((best, project) => (!best || project.created_at > best.created_at ? project : best), null);
+function newestOf(projects: readonly AdminProject[]): AdminProject | null {
+  return projects.reduce<AdminProject | null>((best, project) => (!best || Date.parse(project.created_at) > Date.parse(best.created_at) ? project : best), null);
 }
 
-function keyStep(projects: readonly Project[] | "failed" | undefined): GettingStartedSteps["key"] {
+function keyStep(projects: readonly AdminProject[] | "failed" | undefined): GettingStartedSteps["key"] {
   if (!projects || projects === "failed") return { state: projects ? "unknown" : null, project: null };
-  const active = projects.filter((project) => project.status === "active");
+  const active = projects.filter((project) => project.archived_at === null);
   if (active.some((project) => project.active_key_count > 0)) return { state: "done", project: null };
   return { state: "todo", project: newestOf(active) };
 }
@@ -102,9 +101,9 @@ function keyStep(projects: readonly Project[] | "failed" | undefined): GettingSt
  * Where the first Session's call samples are: the newest active project with
  * an active key, else the newest active project (whose page issues one).
  */
-function callProject(projects: readonly Project[] | "failed" | undefined): Project | null {
+function callProject(projects: readonly AdminProject[] | "failed" | undefined): AdminProject | null {
   if (!projects || projects === "failed") return null;
-  const active = projects.filter((project) => project.status === "active");
+  const active = projects.filter((project) => project.archived_at === null);
   return newestOf(active.filter((project) => project.active_key_count > 0)) ?? newestOf(active);
 }
 
diff --git a/apps/web/src/features/overview/overview-loader.ts b/apps/web/src/features/overview/overview-loader.ts
index eba9be5c2..5c3dffaae 100644
--- a/apps/web/src/features/overview/overview-loader.ts
+++ b/apps/web/src/features/overview/overview-loader.ts
@@ -1,8 +1,8 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 
 import { readProjectsSessions, type InProject, type ProjectReadFailure, type SessionLister } from "../metrics/project-sessions";
 import { activityStart, attentionCount, overviewReadDone, projectRows } from "./overview-model";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 /** Most Sessions read per project for the 24-hour activity and the attention list. */
 export const OVERVIEW_SESSION_CAP = 1_000;
@@ -10,10 +10,10 @@ export const OVERVIEW_SESSION_CAP = 1_000;
 export interface OverviewSessions {
   sessions: InProject<AgentSession>[];
   /** Projects whose read stopped at the cap before covering the window or every Session needing attention. */
-  truncated: Project[];
+  truncated: AdminProject[];
   failures: ProjectReadFailure[];
   /** Failed projects whose previously read Sessions are retained. */
-  stale: Project[];
+  stale: AdminProject[];
 }
 
 export type OverviewSummary =
@@ -31,7 +31,7 @@ export interface OverviewData {
 
 export interface OverviewSource {
   summary: (signal: AbortSignal) => Promise<ProjectSummary[]>;
-  sessions: (project: Project) => SessionLister;
+  sessions: (project: AdminProject) => SessionLister;
 }
 
 /**
@@ -48,7 +48,7 @@ export function needsSessionRead(row: ProjectSummary | undefined, since: number)
 }
 
 export async function loadOverview(
-  projects: readonly Project[],
+  projects: readonly AdminProject[],
   source: OverviewSource,
   nowSeconds: number,
   signal: AbortSignal,
diff --git a/apps/web/src/features/overview/overview-model.test.ts b/apps/web/src/features/overview/overview-model.test.ts
index d431ef8a3..4834d0bf1 100644
--- a/apps/web/src/features/overview/overview-model.test.ts
+++ b/apps/web/src/features/overview/overview-model.test.ts
@@ -8,7 +8,6 @@ import {
   activityStart,
   attentionCount,
   attentionSessions,
-  coverageRatio,
   isGatewayOrNetworkFailure,
   overviewReadDone,
   projectUsageRows,
@@ -19,12 +18,10 @@ import {
   webApiReachable,
 } from "./overview-model";
 
-const usage = (total: number) => ({ input_tokens: total, output_tokens: 0, total_tokens: total, cached_tokens: 0, reasoning_tokens: 0 });
-
 describe("project usage rows", () => {
   it("joins every project with its summary row, active and recent first, missing rows as null", () => {
     const rows = projectUsageRows(
-      [project("old"), project("archived", { status: "archived" }), project("recent"), project("silent")],
+      [project("old"), project("archived", { archived_at: "1970-01-01T00:00:02Z" }), project("recent"), project("silent")],
       [
         summary("old", { last_active_at: 100 }),
         summary("recent", { last_active_at: 500 }),
@@ -37,22 +34,14 @@ describe("project usage rows", () => {
     expect(rows.find((row) => row.project.id === "silent")?.summary).toBeNull();
   });
 
-  it("adds up Session counts and keeps usage unknown when no project reported any", () => {
-    const withUsage = summaryTotals([
-      summary("a", { sessions: { total: 3, idle: 1, in_progress: 1, requires_action: 0, failed: 1 }, usage: usage(10), coverage: { sessions: 3, reported: 2 } }),
-      summary("b", { sessions: { total: 2, idle: 1, in_progress: 0, requires_action: 1, failed: 0 }, coverage: { sessions: 2, reported: 0 } }),
-      summary("a", { agent_id: "agent_a", sessions: { total: 50, idle: 50, in_progress: 0, requires_action: 0, failed: 0 }, usage: usage(99) }),
+  it("adds up the Session counts of project rows", () => {
+    const totals = summaryTotals([
+      summary("a", { sessions: { total: 3, idle: 1, in_progress: 1, requires_action: 0, failed: 1 } }),
+      summary("b", { sessions: { total: 2, idle: 1, in_progress: 0, requires_action: 1, failed: 0 } }),
+      summary("a", { agent_id: "agent_a", sessions: { total: 50, idle: 50, in_progress: 0, requires_action: 0, failed: 0 } }),
     ]);
-    expect(withUsage.sessions).toEqual({ total: 5, idle: 2, in_progress: 1, requires_action: 1, failed: 1 });
-    expect(withUsage.usage?.total_tokens).toBe(10);
-    expect(withUsage.coverage).toEqual({ sessions: 5, reported: 2 });
-    expect(attentionCount(withUsage.sessions)).toBe(2);
-    expect(summaryTotals([summary("b")]).usage).toBeNull();
-  });
-
-  it("reports coverage only when there are Sessions", () => {
-    expect(coverageRatio({ sessions: 4, reported: 3 })).toBe(0.75);
-    expect(coverageRatio({ sessions: 0, reported: 0 })).toBeNull();
+    expect(totals).toEqual({ total: 5, idle: 2, in_progress: 1, requires_action: 1, failed: 1 });
+    expect(attentionCount(totals)).toBe(2);
   });
 });
 
diff --git a/apps/web/src/features/overview/overview-model.ts b/apps/web/src/features/overview/overview-model.ts
index ef13afa7b..338f58a72 100644
--- a/apps/web/src/features/overview/overview-model.ts
+++ b/apps/web/src/features/overview/overview-model.ts
@@ -1,82 +1,50 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 
 import type { CapacitySummary } from "../fleet/fleet-model";
 import type { InProject } from "../metrics/project-sessions";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 /** Pure projections behind the Overview. Missing inputs stay null, never zero. */
 
-export interface SessionCounts {
-  total: number;
-  idle: number;
-  in_progress: number;
-  requires_action: number;
-  failed: number;
-}
-
-export type SummaryUsage = NonNullable<ProjectSummary["usage"]>;
+export type SessionCounts = ProjectSummary["sessions"];
 
 export interface ProjectUsageRow {
-  project: Project;
+  project: AdminProject;
   /** The project's `/summary` row, or null when Core returned none for it. */
   summary: ProjectSummary | null;
 }
 
 /** Project rows of a `/summary` response (Agent and key rows are skipped). */
 export function projectRows(summary: readonly ProjectSummary[]): ProjectSummary[] {
-  return summary.filter((row) => row.agent_id === null && !row.key);
+  return summary.filter((row) => row.agent_id === null && row.key_id === null);
 }
 
 /**
  * One row per project, joined with its `/summary` row. Active projects come
  * first, then the most recently active.
  */
-export function projectUsageRows(projects: readonly Project[], summary: readonly ProjectSummary[]): ProjectUsageRow[] {
+export function projectUsageRows(projects: readonly AdminProject[], summary: readonly ProjectSummary[]): ProjectUsageRow[] {
   const byProject = new Map(projectRows(summary).map((row) => [row.project_id, row]));
   return projects
     .map((project) => ({ project, summary: byProject.get(project.id) ?? null }))
     .sort((a, b) => (
-      Number(a.project.status === "archived") - Number(b.project.status === "archived")
+      Number(a.project.archived_at !== null) - Number(b.project.archived_at !== null)
       || (b.summary?.last_active_at ?? -1) - (a.summary?.last_active_at ?? -1)
       || a.project.name.localeCompare(b.project.name)
     ));
 }
 
-export interface SummaryTotals {
-  sessions: SessionCounts;
-  /** Sum over projects that reported usage; null when none did. */
-  usage: SummaryUsage | null;
-  coverage: { sessions: number; reported: number };
-}
-
-/** Totals over every project row. */
-export function summaryTotals(summary: readonly ProjectSummary[]): SummaryTotals {
+/** Session counts over every project row. */
+export function summaryTotals(summary: readonly ProjectSummary[]): SessionCounts {
   const sessions: SessionCounts = { total: 0, idle: 0, in_progress: 0, requires_action: 0, failed: 0 };
-  const coverage = { sessions: 0, reported: 0 };
-  let usage: SummaryUsage | null = null;
   for (const row of projectRows(summary)) {
     sessions.total += row.sessions.total;
     sessions.idle += row.sessions.idle;
     sessions.in_progress += row.sessions.in_progress;
     sessions.requires_action += row.sessions.requires_action;
     sessions.failed += row.sessions.failed;
-    coverage.sessions += row.coverage.sessions;
-    coverage.reported += row.coverage.reported;
-    if (row.usage) {
-      usage ??= { input_tokens: 0, output_tokens: 0, total_tokens: 0, cached_tokens: 0, reasoning_tokens: 0 };
-      usage.input_tokens += row.usage.input_tokens;
-      usage.output_tokens += row.usage.output_tokens;
-      usage.total_tokens += row.usage.total_tokens;
-      usage.cached_tokens += row.usage.cached_tokens;
-      usage.reasoning_tokens += row.usage.reasoning_tokens;
-    }
   }
-  return { sessions, usage, coverage };
-}
-
-/** Share of Sessions that reported usage; null when there are none. */
-export function coverageRatio(coverage: { sessions: number; reported: number }): number | null {
-  return coverage.sessions > 0 ? coverage.reported / coverage.sessions : null;
+  return sessions;
 }
 
 export function attentionCount(counts: Pick<SessionCounts, "failed" | "requires_action">): number {
diff --git a/apps/web/src/features/overview/overview-queries.ts b/apps/web/src/features/overview/overview-queries.ts
index 6440af462..5b95711b2 100644
--- a/apps/web/src/features/overview/overview-queries.ts
+++ b/apps/web/src/features/overview/overview-queries.ts
@@ -1,11 +1,12 @@
+import type { AdminProject } from "@oac/agents-client";
 import { queryOptions } from "@tanstack/react-query";
 
-import { loadSummary, type Project } from "../../lib/admin-view";
+import { loadSummary } from "../../lib/admin-view";
 import { projectClient } from "../../lib/projects";
 import { loadOverview, type OverviewData } from "./overview-loader";
 
 /** The Overview's summary and Session reads for the listed projects, keyed by their IDs. */
-export function overviewQuery(projects: readonly Project[]) {
+export function overviewQuery(projects: readonly AdminProject[]) {
   const queryKey = ["overview", projects.map((project) => project.id)];
   return queryOptions({
     queryKey,
diff --git a/apps/web/src/features/overview/test-fixtures.ts b/apps/web/src/features/overview/test-fixtures.ts
index 96ed55aac..e11dfcea3 100644
--- a/apps/web/src/features/overview/test-fixtures.ts
+++ b/apps/web/src/features/overview/test-fixtures.ts
@@ -1,10 +1,10 @@
-import type { AgentSession, SandboxNode } from "@oac/agents-client";
-import { type OwnedRuntimeObservation, type Project, type ProjectSummary } from "../../lib/admin-view";
+import type { AdminProject, AgentSession, SandboxNode } from "@oac/agents-client";
+import { type OwnedRuntimeObservation, type ProjectSummary } from "../../lib/admin-view";
 
 /** Fixtures shared by the Monitor page tests. Not part of the application bundle. */
 
-export function project(id: string, overrides: Partial<Project> = {}): Project {
-  return { id, name: id, status: "active", created_at: 1, archived_at: null, active_key_count: 1, ...overrides };
+export function project(id: string, overrides: Partial<AdminProject> = {}): AdminProject {
+  return { id, name: id, created_at: "1970-01-01T00:00:01Z", archived_at: null, active_key_count: 1, ...overrides };
 }
 
 export function summary(projectId: string, overrides: Partial<ProjectSummary> = {}): ProjectSummary {
@@ -16,7 +16,7 @@ export function summary(projectId: string, overrides: Partial<ProjectSummary> =
     assets: { agents: 1, skills: 0, environment_templates: 0, files: 0, vaults: 0, credentials: 0 },
     sessions: { total: 0, idle: 0, in_progress: 0, requires_action: 0, failed: 0 },
     usage: null,
-    coverage: { sessions: 0, reported: 0 },
+    coverage: { total_sessions: 0, measured_sessions: 0, ratio: null },
     last_active_at: null,
     ...overrides,
   };
diff --git a/apps/web/src/features/sandbox/NodeDetail.tsx b/apps/web/src/features/sandbox/NodeDetail.tsx
index 9483c0879..6425e9766 100644
--- a/apps/web/src/features/sandbox/NodeDetail.tsx
+++ b/apps/web/src/features/sandbox/NodeDetail.tsx
@@ -4,13 +4,13 @@ import { useTranslation } from "react-i18next";
 
 import { EmptyState, HelpTip, Kpi, KpiStrip, Section } from "../../components/console-ui";
 import { CopyableId } from "../../components/list-ui";
-import { formatDateTime, formatInteger, formatRelative, formatSpan, MISSING } from "../../lib/format";
+import { epochSeconds, formatDateTime, formatInteger, formatRelative, formatSpan, MISSING } from "../../lib/format";
 import { nodeProviderDiagnostic, sandboxDiagnosticMessage } from "../../lib/sandbox-diagnostic";
 import { sandboxStateLabel } from "../../lib/sandbox-labels";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { NodeRolloutStatus } from "./NodeRolloutStatus";
 import { phaseTiming } from "./allocation-phase";
-import { nodeState, NodeStatus, OldAddressHint, seconds } from "./NodeList";
+import { nodeState, NodeStatus, OldAddressHint } from "./NodeList";
 
 /** Why a node is not serving: disconnected, or the reason its provider is not ready. */
 function nodeDiagnostic(node: SandboxNode): string {
@@ -73,14 +73,14 @@ export function NodeDetail({ node, allocations, coreUrl, targetGeneration, stale
         </div>
         <div>
           <dt>{t("Last seen")}</dt>
-          <dd title={node.last_seen_at ? formatDateTime(seconds(node.last_seen_at), locale) : undefined}>
-            {node.last_seen_at ? formatRelative(seconds(node.last_seen_at), now, locale) : t("Never")}
+          <dd title={node.last_seen_at ? formatDateTime(epochSeconds(node.last_seen_at), locale) : undefined}>
+            {node.last_seen_at ? formatRelative(epochSeconds(node.last_seen_at), now, locale) : t("Never")}
           </dd>
         </div>
         <div><dt>{t("Target generation")}</dt><dd>{targetGeneration ?? MISSING}</dd></div>
         <div><dt>{t("Target preparation")}</dt><dd><NodeRolloutStatus node={node} stale={stale} /></dd></div>
         <div><dt>{t("Serving generation")}<HelpTip>{t("The saved serving generation is not proof that this node is online, ready or has free capacity.")}</HelpTip></dt><dd>{node.rollout.ready_generation ?? MISSING}</dd></div>
-        <div><dt>{t("Added")}</dt><dd>{formatDateTime(seconds(node.created_at), locale)}</dd></div>
+        <div><dt>{t("Added")}</dt><dd>{formatDateTime(epochSeconds(node.created_at), locale)}</dd></div>
       </dl>
 
       {/* Cleanup and host resources are on Sandbox metrics; the node's limit is here as well, beside Edit node that sets it. */}
@@ -123,7 +123,7 @@ export function NodeDetail({ node, allocations, coreUrl, targetGeneration, stale
                     <td>{allocation.compute_phase ? sandboxStateLabel(allocation.compute_phase, shortLocale) : MISSING}</td>
                     {suspension ? <PhaseTime allocation={allocation} retentionSeconds={suspension.retention_seconds} now={now} /> : null}
                     <td>{allocation.diagnostic ? <Diagnostic value={allocation.diagnostic} /> : MISSING}</td>
-                    <td className="nodes-nowrap">{formatDateTime(seconds(allocation.created_at), locale)}</td>
+                    <td className="nodes-nowrap">{formatDateTime(epochSeconds(allocation.created_at), locale)}</td>
                   </tr>
                 ))}
               </tbody>
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 9a1ef808a..8247faea1 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -96,7 +96,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const backend = sandboxProviderLabel(deployment.provider, locale);
   // Nodes and their sandboxes reach Core at its public URL, so a loopback one serves no other machine;
   // and without the provider's node files the installer would fail on the host. Either way no command
-  // is issued, nor before the installation is read: a failed read (an older Core, say) proves nothing.
+  // is issued, nor before the installation is read: a failed read proves nothing about the address.
   const blocker: { text: string; failed?: boolean } | null = deployment.reset
     ? { text: t("Node enrollment is paused while reset is in progress.") }
     : !fresh
diff --git a/apps/web/src/features/sandbox/NodeList.tsx b/apps/web/src/features/sandbox/NodeList.tsx
index b5c4fd979..055c9b700 100644
--- a/apps/web/src/features/sandbox/NodeList.tsx
+++ b/apps/web/src/features/sandbox/NodeList.tsx
@@ -3,7 +3,7 @@ import { useTranslation } from "react-i18next";
 
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
 import { NameCell, RowActions } from "../../components/list-ui";
-import { formatDateTime, formatRelative } from "../../lib/format";
+import { epochSeconds, formatDateTime, formatRelative } from "../../lib/format";
 import type { MessageKey } from "../../lib/locale-strings";
 import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
@@ -56,12 +56,6 @@ export function OldAddressHint() {
   return <span className="node-status-hint">{t("Remove and add again")}</span>;
 }
 
-export function seconds(value: string | null): number | null {
-  if (!value) return null;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? null : Math.floor(parsed / 1000);
-}
-
 export function NodeList({ nodes, allocations, coreUrl, stale, disabled, suspends = false, onOpen, onRemove }: {
   nodes: readonly SandboxNode[];
   /** The deployment's address; a node enrolled with another one is on an old address. */
@@ -111,10 +105,10 @@ export function NodeList({ nodes, allocations, coreUrl, stale, disabled, suspend
                 </td>
                 <td className="numeric">{node.active} / {node.max_active}</td>
                 {suspends ? <td className="numeric">{suspendedSandboxes(node)}</td> : null}
-                <td className="numeric" title={node.last_seen_at ? formatDateTime(seconds(node.last_seen_at), locale) : undefined}>
-                  {node.last_seen_at ? formatRelative(seconds(node.last_seen_at), now, locale) : t("Never")}
+                <td className="numeric" title={node.last_seen_at ? formatDateTime(epochSeconds(node.last_seen_at), locale) : undefined}>
+                  {node.last_seen_at ? formatRelative(epochSeconds(node.last_seen_at), now, locale) : t("Never")}
                 </td>
-                <td className="nodes-nowrap">{formatDateTime(seconds(node.created_at), locale)}</td>
+                <td className="nodes-nowrap">{formatDateTime(epochSeconds(node.created_at), locale)}</td>
                 <td className="actions-cell">
                   <RowActions>
                     <button className="text-action danger" type="button" disabled={disabled} aria-label={t("Remove {{name}}", { name })} onClick={() => onRemove(node)}>
diff --git a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
index b764877a8..6ce5664a3 100644
--- a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
+++ b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
@@ -12,7 +12,7 @@ import { Modal } from "../../components/Modal";
 import { TableSkeleton } from "../../components/Skeleton";
 import { failedLast, useFailureToast, useToast } from "../../components/Toast";
 import { useDeleteFlow } from "../../lib/delete-flow";
-import { formatDateTime, shortId } from "../../lib/format";
+import { epochSeconds, formatDateTime, shortId } from "../../lib/format";
 import { admin, useProjects } from "../../lib/projects";
 import { ExecutorInstallPanel, useExecutorInstall } from "./ExecutorInstallPanel";
 import { CredentialFile } from "./executor-credential-file";
@@ -54,10 +54,6 @@ function sameKey(a: string, b: string): boolean {
   return a.toLowerCase() === b.toLowerCase();
 }
 
-function seconds(value: string | null): number | null {
-  return value === null ? null : Math.floor(Date.parse(value) / 1000);
-}
-
 /**
  * Executor credentials of a self-hosted Session's environment: Core issues,
  * rotates and revokes them with the deployment's Core key. An issued
@@ -78,7 +74,7 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
   const locale = i18n.resolvedLanguage;
   const toast = useToast();
   const { byId, refresh: refreshProjects } = useProjects();
-  const archived = byId.get(projectId)?.status === "archived";
+  const archived = Boolean(byId.get(projectId)?.archived_at);
   const install = useExecutorInstall(projectId, environmentId, archived);
   const query = useQuery(executorConnectionQuery(projectId, sessionId, environmentId));
   const credentials = query.data?.data ?? null;
@@ -253,11 +249,11 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
                       <HelpTip>{t(revoked ? "executor.connection.restore" : "executor.connection.bound", { id })}</HelpTip>
                     </span> : null}
                   </span></th>
-                  <td className="session-nowrap">{formatDateTime(seconds(credential.created_at), locale)}</td>
+                  <td className="session-nowrap">{formatDateTime(epochSeconds(credential.created_at), locale)}</td>
                   <td>
                     <span className="executor-credential-status">
                       <StatusDot tone={revoked ? "neutral" : "ok"} label={revoked ? t("executor.status.revoked") : t("executor.status.active")} />
-                      {revoked ? <span className="executor-credential-date">{formatDateTime(seconds(credential.revoked_at), locale)}</span> : null}
+                      {revoked ? <span className="executor-credential-date">{formatDateTime(epochSeconds(credential.revoked_at), locale)}</span> : null}
                     </span>
                   </td>
                   <td className="actions-cell">
diff --git a/apps/web/src/features/sessions/SessionDeleteDialog.tsx b/apps/web/src/features/sessions/SessionDeleteDialog.tsx
index 388af654b..52a6ce180 100644
--- a/apps/web/src/features/sessions/SessionDeleteDialog.tsx
+++ b/apps/web/src/features/sessions/SessionDeleteDialog.tsx
@@ -1,4 +1,4 @@
-import { AgentCoreError, isSessionDeletionConflict } from "@oac/agents-client";
+import { type AdminProject, AgentCoreError, isSessionDeletionConflict } from "@oac/agents-client";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -6,10 +6,9 @@ import { ConfirmDialog } from "../../components/ConfirmDialog";
 import { useToast } from "../../components/Toast";
 import { projectClient } from "../../lib/projects";
 import { shortId } from "../../lib/format";
-import { type Project } from "../../lib/admin-view";
 
 export interface SessionDeleteTarget {
-  project: Project;
+  project: AdminProject;
   sessionId: string;
 }
 
diff --git a/apps/web/src/features/sessions/SessionLogPage.tsx b/apps/web/src/features/sessions/SessionLogPage.tsx
index 53cf494e0..f4ecc097e 100644
--- a/apps/web/src/features/sessions/SessionLogPage.tsx
+++ b/apps/web/src/features/sessions/SessionLogPage.tsx
@@ -1,4 +1,4 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 import { MessageSquareText } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
@@ -25,7 +25,6 @@ import {
   type SessionLogFilters,
 } from "./session-log";
 import "./sessions.css";
-import { type Project } from "../../lib/admin-view";
 import { collections, queryClient } from "../../lib/queries";
 import { forgetDeleted } from "../resources/detail-queries";
 import { sessionKey } from "./session-queries";
@@ -238,7 +237,7 @@ function SessionLogRow({
   now: number;
   locale: string | undefined;
   onOpen: (projectId: string, sessionId: string) => void;
-  onDelete: (target: { project: Project; sessionId: string }) => void;
+  onDelete: (target: { project: AdminProject; sessionId: string }) => void;
 }) {
   const { t } = useTranslation("sessions");
   const projectCell = allProjects ? <td><ProjectName project={row.project} /></td> : null;
diff --git a/apps/web/src/features/sessions/executor-credential-ownership.test.tsx b/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
index e10fa04cc..4295269c9 100644
--- a/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
+++ b/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
@@ -9,7 +9,7 @@ import { executorConnectionQuery } from "./executor-connection-query";
 const project = vi.hoisted(() => ({ archived: false }));
 vi.mock("../../lib/projects", async (original) => ({
   ...await original<typeof import("../../lib/projects")>(),
-  useProjects: () => ({ byId: new Map([["project", { status: project.archived ? "archived" : "active" }]]), refresh: () => undefined }),
+  useProjects: () => ({ byId: new Map([["project", { archived_at: project.archived ? "2026-09-28T04:00:00Z" : null }]]), refresh: () => undefined }),
 }));
 vi.mock("./ExecutorInstallPanel", () => ({
   useExecutorInstall: () => ({ kind: "unavailable" }),
diff --git a/apps/web/src/features/sessions/session-log.test.ts b/apps/web/src/features/sessions/session-log.test.ts
index 8f12ae19e..419469c31 100644
--- a/apps/web/src/features/sessions/session-log.test.ts
+++ b/apps/web/src/features/sessions/session-log.test.ts
@@ -1,9 +1,8 @@
 import { describe, expect, it } from "vitest";
 
-import type { AgentSession, ListPage } from "@oac/agents-client";
+import type { AdminProject, AgentSession, ListPage } from "@oac/agents-client";
 
 import type { Owned } from "../../lib/projects";
-import { type Project } from "../../lib/admin-view";
 import {
   agentOptions,
   environmentKind,
@@ -16,8 +15,8 @@ import {
   type SessionLogFilters,
 } from "./session-log";
 
-function project(id: string, name: string): Project {
-  return { id, name, status: "active", created_at: 1, archived_at: null, active_key_count: 1 };
+function project(id: string, name: string): AdminProject {
+  return { id, name, created_at: "1970-01-01T00:00:01Z", archived_at: null, active_key_count: 1 };
 }
 
 const production = project("proj_prod", "Production");
@@ -52,7 +51,7 @@ function session(id: string, overrides: Partial<AgentSession> & { agentId?: stri
   };
 }
 
-function row(owner: Project, value: AgentSession): Owned<AgentSession> {
+function row(owner: AdminProject, value: AgentSession): Owned<AgentSession> {
   return { project: owner, value };
 }
 
diff --git a/apps/web/src/i18n/locales/en/keys.ts b/apps/web/src/i18n/locales/en/keys.ts
index 5f15a8187..d7d438205 100644
--- a/apps/web/src/i18n/locales/en/keys.ts
+++ b/apps/web/src/i18n/locales/en/keys.ts
@@ -172,12 +172,11 @@ export const keys = {
   },
   operations: {
     title: "Write operations",
-    help: "Every successful write in this project, with the key that made it, recorded by Core, newest first. Reads are not recorded; request bodies and secrets are never stored. Unknown: no recorded key.",
+    help: "Every successful write in this project, with the key that made it, recorded by Core, newest first. Reads are not recorded; request bodies and secrets are never stored.",
     filterLabel: "Filter write operations",
     allTypes: "All resources",
     allKeys: "All keys",
     revokedKeyOption: "{{name}} · revoked",
-    unknownKey: "Unknown",
     columns: {
       time: "Time",
       action: "Action",
diff --git a/apps/web/src/i18n/locales/zh-CN/keys.ts b/apps/web/src/i18n/locales/zh-CN/keys.ts
index b5340bd6a..6879216fb 100644
--- a/apps/web/src/i18n/locales/zh-CN/keys.ts
+++ b/apps/web/src/i18n/locales/zh-CN/keys.ts
@@ -174,12 +174,11 @@ export const keys: TranslationShape<typeof english> = {
   },
   operations: {
     title: "写操作记录",
-    help: "这个项目里每一次成功的写操作，以及发起它的 key，由 Core 记录，按时间倒序。读操作不记录，也不保存请求内容和密钥。“未知”表示没有记录 key。",
+    help: "这个项目里每一次成功的写操作，以及发起它的 key，由 Core 记录，按时间倒序。读操作不记录，也不保存请求内容和密钥。",
     filterLabel: "筛选写操作记录",
     allTypes: "全部资源",
     allKeys: "全部 key",
     revokedKeyOption: "{{name}} · 已撤销",
-    unknownKey: "未知",
     columns: {
       time: "时间",
       action: "操作",
diff --git a/apps/web/src/lib/admin-view.ts b/apps/web/src/lib/admin-view.ts
index 86c5a3154..258dae7be 100644
--- a/apps/web/src/lib/admin-view.ts
+++ b/apps/web/src/lib/admin-view.ts
@@ -6,135 +6,37 @@ import {
   type AdminResourceType,
   type AdminRuntimeObservation,
   type AdminSummaryEntry,
-  type AdminWriteOperation,
-  type RuntimeObservation,
+  type AdminWriteOperationOptions,
+  type AdminWriteOperationPage,
 } from "@oac/agents-client";
 
 /**
- * View models over the typed management client (`AdminClient`, `/core/v1`).
- * Pages format Unix seconds and never treat missing data as zero, so this
- * layer converts RFC 3339 timestamps, resolves creating keys by name, walks
- * cursor pages and turns an unmeasured usage sum into `null`.
+ * Reads over the typed management client (`AdminClient`, `/core/v1`): they
+ * walk cursor pages, resolve the creating key of summary key rows and turn an
+ * unmeasured usage sum into `null`, so pages never treat missing data as zero.
  */
 export const admin = new AdminClient();
 
-export type ProjectStatus = "active" | "archived";
-
-export interface Project {
-  id: string;
-  name: string;
-  status: ProjectStatus;
-  /** Unix seconds. */
-  created_at: number;
-  archived_at: number | null;
-  active_key_count: number;
-}
-
-export interface AdminKey {
-  id: string;
-  project_id: string;
-  name: string;
-  prefix: string;
-  created_at: number;
-  revoked_at: number | null;
-}
-
-export interface AdminIssuedKey extends AdminKey {
-  /** Plaintext returned once by issuance; never stored. */
-  key: string;
-}
-
-/** The key recorded for a write or a resource's creation. */
-export interface KeyRef {
-  id: string;
-  name: string | null;
-  prefix: string | null;
-  revoked_at: number | null;
-}
-
-/** Who created a resource: a key, or null when Core has no creation record. */
-export interface Creator {
-  key: KeyRef | null;
-}
-
-export interface SpaceUsage {
-  input_tokens: number;
-  output_tokens: number;
-  total_tokens: number;
-  cached_tokens: number;
-  reasoning_tokens: number;
-}
-
-export interface ProjectSummary {
-  project_id: string;
-  agent_id: string | null;
-  /** Key rows: the creating key's ID; null groups Sessions with unknown provenance. */
-  key_id: string | null;
-  /** Key rows: the creating key resolved by name, or null when unknown. */
-  key: KeyRef | null;
-  assets: { agents: number; skills: number; environment_templates: number; files: number; vaults: number; credentials: number } | null;
-  sessions: { total: number; idle: number; in_progress: number; requires_action: number; failed: number };
+/** A summary row; a key row carries its key when the project's key list holds it. */
+export type ProjectSummary = Omit<AdminSummaryEntry, "usage"> & {
+  key: AdminAPIKey | null;
   /** null when no Session in the group reported usage. */
-  usage: SpaceUsage | null;
-  /** Sessions in range (denominator) and those that reported usage. */
-  coverage: { sessions: number; reported: number };
-  last_active_at: number | null;
-}
+  usage: AdminSummaryEntry["usage"] | null;
+};
 
-export interface WriteOperation {
-  id: string;
-  created_at: number;
-  api_key: KeyRef | null;
-  action: string;
-  resource_type: string;
-  resource_id: string;
-  parent_id: string;
-  request_id: string;
-  trace_id: string;
-}
-
-/** A Runtime observation with its project; the administrator list adds disk (E2B only, null elsewhere). */
-export type OwnedRuntimeObservation = RuntimeObservation & { project_id: string; disk?: AdminRuntimeObservation["observation"]["disk"] };
-export const ownerResourceTypes = ["agent", "session", "environment", "environment_template", "skill", "skill_version", "file", "vault", "credential", "artifact"] as const satisfies readonly AdminResourceType[];
-export type OwnerResourceType = AdminResourceType;
+/** A Runtime observation with its project; disk is E2B-only and null elsewhere. */
+export type OwnedRuntimeObservation = AdminRuntimeObservation["observation"] & { project_id: string };
 
 const PAGE = 100;
 /** Bounded walks: a deployment has a handful of projects and keys. */
 const MAX_PAGES = 100;
 
-function seconds(value: string): number {
-  return Math.floor(Date.parse(value) / 1000);
-}
-function maybeSeconds(value: string | null): number | null {
-  return value === null ? null : seconds(value);
-}
-
-export function projectView(project: AdminProject): Project {
-  return {
-    id: project.id,
-    name: project.name,
-    status: project.archived_at === null ? "active" : "archived",
-    created_at: seconds(project.created_at),
-    archived_at: maybeSeconds(project.archived_at),
-    active_key_count: project.active_key_count,
-  };
-}
-
-function keyView(key: AdminAPIKey): AdminKey {
-  return { ...key, created_at: seconds(key.created_at), revoked_at: maybeSeconds(key.revoked_at) };
-}
-
-function keyRef(key: AdminKeyProvenance | null): KeyRef | null {
-  if (!key) return null;
-  return { id: key.id, name: key.name || null, prefix: key.prefix || null, revoked_at: maybeSeconds(key.revoked_at) };
-}
-
-export async function listAllProjects(signal?: AbortSignal): Promise<Project[]> {
-  const projects: Project[] = [];
+export async function listAllProjects(signal?: AbortSignal): Promise<AdminProject[]> {
+  const projects: AdminProject[] = [];
   let after: string | undefined;
   for (let page = 0; page < MAX_PAGES; page += 1) {
     const result = await admin.listProjects({ after, limit: PAGE, order: "asc", signal });
-    projects.push(...result.data.map(projectView));
+    projects.push(...result.data);
     const last = result.data.at(-1)?.id;
     if (!result.has_more || !last) break;
     after = last;
@@ -142,23 +44,12 @@ export async function listAllProjects(signal?: AbortSignal): Promise<Project[]>
   return projects;
 }
 
-export async function createProject(name: string, signal?: AbortSignal): Promise<Project> {
-  return projectView(await admin.createProject({ name }, { signal }));
-}
-export async function renameProject(projectId: string, name: string, signal?: AbortSignal): Promise<Project> {
-  return projectView(await admin.renameProject(projectId, { name }, { signal }));
-}
-/** Revokes every key of the project; its assets stay viewable. */
-export async function archiveProject(projectId: string, signal?: AbortSignal): Promise<Project> {
-  return projectView(await admin.archiveProject(projectId, { signal }));
-}
-
-export async function listKeys(projectId: string, signal?: AbortSignal): Promise<AdminKey[]> {
-  const keys: AdminKey[] = [];
+export async function listKeys(projectId: string, signal?: AbortSignal): Promise<AdminAPIKey[]> {
+  const keys: AdminAPIKey[] = [];
   let after: string | undefined;
   for (let page = 0; page < MAX_PAGES; page += 1) {
     const result = await admin.listAPIKeys(projectId, { after, limit: PAGE, signal });
-    keys.push(...result.data.map(keyView));
+    keys.push(...result.data);
     const last = result.data.at(-1)?.id;
     if (!result.has_more || !last) break;
     after = last;
@@ -166,40 +57,6 @@ export async function listKeys(projectId: string, signal?: AbortSignal): Promise
   return keys;
 }
 
-/** Issues a named key; the plaintext exists only in this result. */
-export async function issueKey(projectId: string, name: string, signal?: AbortSignal): Promise<AdminIssuedKey> {
-  const issued = await admin.issueAPIKey(projectId, { name }, { signal });
-  return { ...keyView(issued), key: issued.key };
-}
-export async function revokeKey(projectId: string, keyId: string, signal?: AbortSignal): Promise<void> {
-  await admin.revokeAPIKey(projectId, keyId, { signal });
-}
-
-function summaryView(entry: AdminSummaryEntry, keys: ReadonlyMap<string, AdminKey>): ProjectSummary {
-  const measured = entry.coverage.measured_sessions;
-  const key = entry.key_id ? keys.get(entry.key_id) : undefined;
-  return {
-    project_id: entry.project_id,
-    agent_id: entry.agent_id,
-    key_id: entry.key_id,
-    key: entry.key_id
-      ? { id: entry.key_id, name: key?.name ?? null, prefix: key?.prefix ?? null, revoked_at: key?.revoked_at ?? null }
-      : null,
-    assets: entry.assets,
-    sessions: entry.sessions,
-    // Unmeasured Sessions add no tokens; an all-unmeasured group has no usage, not zero.
-    usage: measured === 0 ? null : {
-      input_tokens: entry.usage.input_tokens,
-      output_tokens: entry.usage.output_tokens,
-      total_tokens: entry.usage.total_tokens,
-      cached_tokens: entry.usage.input_tokens_details.cached_tokens,
-      reasoning_tokens: entry.usage.output_tokens_details.reasoning_tokens,
-    },
-    coverage: { sessions: entry.coverage.total_sessions, reported: measured },
-    last_active_at: entry.last_active_at,
-  };
-}
-
 export interface SummaryQuery {
   group_by?: "project" | "agent" | "key";
   project_id?: string;
@@ -210,7 +67,7 @@ export interface SummaryQuery {
   signal?: AbortSignal;
 }
 
-/** Every summary row for the query; key rows carry the creating key's name. */
+/** Every summary row for the query; key rows carry the creating key. */
 export async function loadSummary(query: SummaryQuery = {}): Promise<ProjectSummary[]> {
   const entries: AdminSummaryEntry[] = [];
   let after: string | undefined;
@@ -228,48 +85,35 @@ export async function loadSummary(query: SummaryQuery = {}): Promise<ProjectSumm
     if (!result.has_more || !result.next_cursor) break;
     after = result.next_cursor;
   }
-  const keys = new Map<string, AdminKey>();
+  const keys = new Map<string, AdminAPIKey>();
   if (query.group_by === "key") {
     const projectIds = [...new Set(entries.filter((entry) => entry.key_id).map((entry) => entry.project_id))];
     const lists = await Promise.allSettled(projectIds.map((projectId) => listKeys(projectId, query.signal)));
     for (const list of lists) if (list.status === "fulfilled") for (const key of list.value) keys.set(key.id, key);
   }
-  return entries.map((entry) => summaryView(entry, keys));
+  return entries.map((entry) => ({
+    ...entry,
+    key: entry.key_id === null ? null : keys.get(entry.key_id) ?? null,
+    // Unmeasured Sessions add no tokens; an all-unmeasured group has no usage, not zero.
+    usage: entry.coverage.measured_sessions === 0 ? null : entry.usage,
+  }));
 }
 
-export interface WriteOperationQuery {
-  key_id?: string;
-  resource_type?: AdminResourceType;
-  resource_id?: string;
-  after?: string;
-  limit?: number;
-  signal?: AbortSignal;
-}
+export type WriteOperationQuery = Pick<AdminWriteOperationOptions, "key_id" | "resource_type" | "resource_id" | "after" | "limit" | "signal">;
 
-function operationView(operation: AdminWriteOperation): WriteOperation {
-  return { ...operation, created_at: seconds(operation.created_at), api_key: keyRef(operation.api_key) };
+export async function listWriteOperations(projectId: string, query: WriteOperationQuery = {}): Promise<AdminWriteOperationPage> {
+  const page = await admin.listWriteOperations(projectId, { ...query, limit: query.limit ?? 50 });
+  return { ...page, has_more: page.has_more && page.next_cursor !== "" };
 }
 
-export async function listWriteOperations(projectId: string, query: WriteOperationQuery = {}): Promise<{ data: WriteOperation[]; has_more: boolean; next_cursor: string }> {
-  const page = await admin.listWriteOperations(projectId, {
-    key_id: query.key_id,
-    resource_type: query.resource_type,
-    resource_id: query.resource_id,
-    after: query.after,
-    limit: query.limit ?? 50,
-    signal: query.signal,
-  });
-  return { data: page.data.map(operationView), has_more: page.has_more && page.next_cursor !== "", next_cursor: page.next_cursor };
-}
-
-/** Creators of up to any number of resources of one project, in batches of 100. */
-export async function listCreators(projectId: string, type: OwnerResourceType, ids: readonly string[], signal?: AbortSignal): Promise<Map<string, Creator>> {
+/** Creators of any number of resources of one project, in batches of 100; null when Core has no creation record. */
+export async function listCreators(projectId: string, type: AdminResourceType, ids: readonly string[], signal?: AbortSignal): Promise<Map<string, AdminKeyProvenance | null>> {
   const unique = [...new Set(ids)];
-  const creators = new Map<string, Creator>();
+  const creators = new Map<string, AdminKeyProvenance | null>();
   for (let start = 0; start < unique.length; start += PAGE) {
     const batch = unique.slice(start, start + PAGE);
     const result = await admin.retrieveResourceOwners(projectId, type, batch, { signal });
-    for (const owner of result.data) creators.set(owner.resource_id, { key: keyRef(owner.api_key) });
+    for (const owner of result.data) creators.set(owner.resource_id, owner.api_key);
   }
   return creators;
 }
@@ -286,11 +130,3 @@ export async function listRuntimeObservations(signal?: AbortSignal): Promise<Own
   }
   return observations;
 }
-
-export function isProjectName(value: string): boolean {
-  return value.trim() === value && [...value].length >= 1 && [...value].length <= 128 && !/[\u0000-\u001f\u007f]/.test(value);
-}
-
-export function isKeyName(value: string): boolean {
-  return value.trim() === value && [...value].length >= 1 && [...value].length <= 80 && !/[\u0000-\u001f\u007f]/.test(value);
-}
diff --git a/apps/web/src/lib/format.ts b/apps/web/src/lib/format.ts
index c2b1fb7f2..b9e28984f 100644
--- a/apps/web/src/lib/format.ts
+++ b/apps/web/src/lib/format.ts
@@ -56,6 +56,13 @@ export function formatCores(value: number | null | undefined, locale?: string):
   return value.toLocaleString(locale, { maximumFractionDigits: value < 10 ? 2 : 1 });
 }
 
+/** Unix seconds of an RFC 3339 timestamp, for the formatters below; null when absent or unparseable. */
+export function epochSeconds(value: string | null | undefined): number | null {
+  if (!value) return null;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : Math.floor(parsed / 1000);
+}
+
 /** Date and time; the year is left out for dates in the current year. */
 export function formatDateTime(epochSeconds: number | null | undefined, locale?: string, now: Date = new Date()): string {
   if (epochSeconds === null || epochSeconds === undefined || !Number.isFinite(epochSeconds)) return MISSING;
diff --git a/apps/web/src/lib/projects.tsx b/apps/web/src/lib/projects.tsx
index b8ac7df0d..c5dc0e10f 100644
--- a/apps/web/src/lib/projects.tsx
+++ b/apps/web/src/lib/projects.tsx
@@ -1,8 +1,8 @@
 import type {
-  AgentDeleted, AgentSession, AgentTurn, EnvironmentTemplateDeleted, EnvironmentTemplateList, EnvironmentTemplateResource, ListPage, PageOptions, ReadOptions,
-  RuntimeHistory, RuntimeHistoryQuery, RuntimeObservation, SavedAgent, SessionDeleted, SessionItem, SessionListOptions, Skill, SkillContent, SkillDeleted, SkillList,
-  SkillListOptions, SkillVersionDeleted, SkillVersionList, SourceFileDeleted, SourceFileList, SourceFileListOptions, Vault, VaultCredentialDeleted,
-  VaultCredentialList, VaultDeleted, VaultList, VaultListOptions,
+  AdminKeyProvenance, AdminProject, AdminResourceType, AgentDeleted, AgentSession, AgentTurn, EnvironmentTemplateDeleted, EnvironmentTemplateList,
+  EnvironmentTemplateResource, ListPage, PageOptions, ReadOptions, RuntimeHistory, RuntimeHistoryQuery, RuntimeObservation, SavedAgent, SessionDeleted,
+  SessionItem, SessionListOptions, Skill, SkillContent, SkillDeleted, SkillList, SkillListOptions, SkillVersionDeleted, SkillVersionList, SourceFileDeleted,
+  SourceFileList, SourceFileListOptions, Vault, VaultCredentialDeleted, VaultCredentialList, VaultDeleted, VaultList, VaultListOptions,
 } from "@oac/agents-client";
 import { QueryClientProvider, useQueries, useQuery, useQueryClient } from "@tanstack/react-query";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
@@ -11,11 +11,10 @@ import { useTranslation } from "react-i18next";
 import { readError } from "./read-error";
 import { ConsoleSelect } from "../components/console-select";
 import { HelpTip } from "../components/console-ui";
-import { admin, listCreators, type Creator, type OwnerResourceType, type Project } from "./admin-view";
+import { admin, listCreators } from "./admin-view";
 import { collectionQuery, projectsQuery, queryClient, type CollectionSpec } from "./queries";
 
 export { admin };
-export type { Project };
 
 /**
  * The console reaches Core only through the Web API (`/core/v1`). A
@@ -24,14 +23,14 @@ export type { Project };
  */
 
 export type ProjectsState =
-  | { status: "loading"; projects: Project[]; error: null }
-  | { status: "ready"; projects: Project[]; error: null }
-  | { status: "failed"; projects: Project[]; error: string };
+  | { status: "loading"; projects: AdminProject[]; error: null }
+  | { status: "ready"; projects: AdminProject[]; error: null }
+  | { status: "failed"; projects: AdminProject[]; error: string };
 
 interface ProjectsContextValue {
   state: ProjectsState;
   refresh: () => void;
-  byId: ReadonlyMap<string, Project>;
+  byId: ReadonlyMap<string, AdminProject>;
   /** Why the last refresh failed while earlier projects stay on screen. */
   refreshError: string | null;
   /** Original query failure for classification; translated display text is never evidence. */
@@ -84,30 +83,30 @@ export function ProjectFilter({ value, onChange, includeAll = true }: { value: P
     ...(includeAll ? [{ value: "", label: t("project.all") }] : []),
     ...state.projects.map((project) => ({
       value: project.id,
-      label: project.status === "archived" ? t("project.archivedOption", { name: project.name }) : project.name,
+      label: project.archived_at !== null ? t("project.archivedOption", { name: project.name }) : project.name,
     })),
   ], [includeAll, state.projects, t]);
   return <ConsoleSelect value={value} onChange={onChange} options={options} label={t("project.filter")} />;
 }
 
 /** The project a row belongs to when a table shows every project. */
-export function ProjectName({ project }: { project: Project | undefined }) {
+export function ProjectName({ project }: { project: AdminProject | undefined }) {
   const { t } = useTranslation("common");
   if (!project) return <span className="table-muted">—</span>;
   return (
-    <span className={project.status === "archived" ? "space-name space-disabled" : "space-name"} title={project.status === "archived" ? t("project.archived") : undefined}>
+    <span className={project.archived_at !== null ? "space-name space-disabled" : "space-name"} title={project.archived_at !== null ? t("project.archived") : undefined}>
       {project.name}
     </span>
   );
 }
 
 export interface Owned<T> {
-  project: Project;
+  project: AdminProject;
   value: T;
 }
 
 export interface ProjectFailure {
-  project: Project;
+  project: AdminProject;
   message: string;
 }
 
@@ -221,7 +220,7 @@ export function useProjectCollection<T>(spec: CollectionSpec<T>, filter: Project
   });
   // `items` keeps its identity until a project's cached data changes, so pages
   // may depend on it in effects and memos without re-running on every render.
-  const cache = useRef<{ targets: readonly Project[]; sources: readonly (T[] | undefined)[]; items: Owned<T>[] } | null>(null);
+  const cache = useRef<{ targets: readonly AdminProject[]; sources: readonly (T[] | undefined)[]; items: Owned<T>[] } | null>(null);
   const sources = results.map((result) => result.data);
   const previous = cache.current;
   let items: Owned<T>[];
@@ -262,9 +261,9 @@ export async function readAllPages<T extends { id: string }>(
   return values;
 }
 
-/** Creator lookups are cached per project and resource; a refresh forgets them. */
-const creatorCache = new Map<string, Creator>();
-const creatorKey = (type: OwnerResourceType, projectId: string, id: string) => `${type}:${projectId}:${id}`;
+/** Creator lookups are cached per project and resource (null when Core has no creation record); a refresh forgets them. */
+const creatorCache = new Map<string, AdminKeyProvenance | null>();
+const creatorKey = (type: AdminResourceType, projectId: string, id: string) => `${type}:${projectId}:${id}`;
 let creatorGeneration = 0;
 const creatorListeners = new Set<(generation: number) => void>();
 
@@ -277,11 +276,11 @@ export function forgetCreators() {
 
 export interface Creators {
   /** undefined: not loaded yet or the lookup failed. */
-  creatorOf: (projectId: string, id: string) => Creator | undefined;
+  creatorOf: (projectId: string, id: string) => AdminKeyProvenance | null | undefined;
 }
 
 /** The key that created each row (#87 ownership), batched per project. */
-export function useCreators(type: OwnerResourceType, rows: ReadonlyArray<{ projectId: string; id: string }>): Creators {
+export function useCreators(type: AdminResourceType, rows: ReadonlyArray<{ projectId: string; id: string }>): Creators {
   const [, setVersion] = useState(0);
   const [generation, setGeneration] = useState(creatorGeneration);
   useEffect(() => {
@@ -299,7 +298,7 @@ export function useCreators(type: OwnerResourceType, rows: ReadonlyArray<{ proje
     const controller = new AbortController();
     void Promise.allSettled([...byProject].map(async ([projectId, ids]) => {
       const creators = await listCreators(projectId, type, ids, controller.signal);
-      for (const id of ids) creatorCache.set(creatorKey(type, projectId, id), creators.get(id) ?? { key: null });
+      for (const id of ids) creatorCache.set(creatorKey(type, projectId, id), creators.get(id) ?? null);
     })).then(() => { if (!controller.signal.aborted) setVersion((value) => value + 1); });
     return () => controller.abort();
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -316,16 +315,14 @@ export function CreatorHeading() {
 }
 
 /** The creating key's name, or "Unknown" when Core has no record. */
-export function CreatorCell({ creator }: { creator: Creator | undefined }) {
+export function CreatorCell({ creator }: { creator: AdminKeyProvenance | null | undefined }) {
   const { t } = useTranslation("common");
   if (creator === undefined) return <span className="owner-missing">—</span>;
-  const key = creator.key;
-  if (!key) return <span className="owner-missing" title={t("creator.unknownHelp")}>{t("creator.unknown")}</span>;
-  const label = key.name ?? (key.prefix ? `${key.prefix}…` : t("creator.unknown"));
+  if (!creator) return <span className="owner-missing" title={t("creator.unknownHelp")}>{t("creator.unknown")}</span>;
   return (
-    <span className={key.revoked_at ? "owner-name owner-revoked" : "owner-name"} title={key.prefix ? `${key.prefix}…` : undefined}>
-      {label}
-      {key.revoked_at ? <span className="pill">{t("creator.revoked")}</span> : null}
+    <span className={creator.revoked_at ? "owner-name owner-revoked" : "owner-name"} title={`${creator.prefix}…`}>
+      {creator.name}
+      {creator.revoked_at ? <span className="pill">{t("creator.revoked")}</span> : null}
     </span>
   );
 }
diff --git a/apps/web/src/lib/sandbox-diagnostic.test.ts b/apps/web/src/lib/sandbox-diagnostic.test.ts
index 4ead7d8fb..5c6c5a0c6 100644
--- a/apps/web/src/lib/sandbox-diagnostic.test.ts
+++ b/apps/web/src/lib/sandbox-diagnostic.test.ts
@@ -19,7 +19,7 @@ describe("sandbox diagnostics", () => {
   it("names why a node's provider is not ready, reading an unknown code as provider_unavailable", () => {
     expect(sandboxDiagnosticMessage(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic: "host_unsupported" }))?.label).toBe("Host unsupported");
     expect(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic: "future_code" as SandboxNodeDiagnostic })).toBe("provider_unavailable");
-    expect(nodeProviderDiagnostic({ online: true, provider_ready: true, diagnostic: "" })).toBe("");
+    expect(nodeProviderDiagnostic({ online: true, provider_ready: true })).toBe("");
     // An offline node's last code may no longer apply.
     expect(nodeProviderDiagnostic({ online: false, provider_ready: false, diagnostic: "host_unsupported" })).toBe("");
   });
diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
index af9ea99b5..941308164 100644
--- a/contracts/agents-api/core.openapi.yaml
+++ b/contracts/agents-api/core.openapi.yaml
@@ -23,6 +23,17 @@ definitions:
         type: string
       trace_id:
         type: string
+    required:
+      - action
+      - actor_label
+      - admin_credential_id
+      - created_at
+      - id
+      - project_id
+      - request_id
+      - resource_id
+      - resource_type
+      - trace_id
     type: object
   adminaudit.Page:
     properties:
@@ -34,6 +45,10 @@ definitions:
         type: boolean
       next_cursor:
         type: string
+    required:
+      - data
+      - has_more
+      - next_cursor
     type: object
   api.AdminRuntimeObservation:
     properties:
@@ -41,6 +56,9 @@ definitions:
         $ref: '#/definitions/api.AdminRuntimeObservationDetail'
       project_id:
         type: string
+    required:
+      - observation
+      - project_id
     type: object
   api.AdminRuntimeObservationDetail:
     properties:
@@ -150,17 +168,29 @@ definitions:
         type: array
       first_id:
         type: string
+        x-nullable: true
       has_more:
         type: boolean
       last_id:
         type: string
+        x-nullable: true
       object:
+        enum:
+          - list
         type: string
+    required:
+      - data
+      - first_id
+      - has_more
+      - last_id
+      - object
     type: object
   api.AdminSessionArchiveRequest:
     properties:
       expected_generation:
         type: integer
+    required:
+      - expected_generation
     type: object
   api.AdminSessionCounts:
     properties:
@@ -174,6 +204,12 @@ definitions:
         type: integer
       total:
         type: integer
+    required:
+      - failed
+      - idle
+      - in_progress
+      - requires_action
+      - total
     type: object
   api.AdminSummaryResponse:
     properties:
@@ -185,25 +221,43 @@ definitions:
         type: boolean
       next_cursor:
         type: string
+    required:
+      - data
+      - has_more
+      - next_cursor
     type: object
   api.AdminSummaryRow:
     properties:
       agent_id:
         type: string
+        x-nullable: true
       assets:
-        $ref: '#/definitions/sessions.AdminAssetCounts'
+        allOf:
+          - $ref: '#/definitions/sessions.AdminAssetCounts'
+        x-nullable: true
       coverage:
         $ref: '#/definitions/api.AdminUsageCoverage'
       key_id:
         type: string
+        x-nullable: true
       last_active_at:
         type: integer
+        x-nullable: true
       project_id:
         type: string
       sessions:
         $ref: '#/definitions/api.AdminSessionCounts'
       usage:
         $ref: '#/definitions/v1.TokenUsage'
+    required:
+      - agent_id
+      - assets
+      - coverage
+      - key_id
+      - last_active_at
+      - project_id
+      - sessions
+      - usage
     type: object
   api.AdminUsageCoverage:
     properties:
@@ -211,8 +265,13 @@ definitions:
         type: integer
       ratio:
         type: number
+        x-nullable: true
       total_sessions:
         type: integer
+    required:
+      - measured_sessions
+      - ratio
+      - total_sessions
     type: object
   api.CoreAPIError:
     properties:
@@ -322,6 +381,10 @@ definitions:
         x-nullable: true
       params:
         type: object
+    required:
+      - code
+      - failed_at
+      - params
     type: object
   api.EnvironmentExecutorCredentialRequest:
     properties:
@@ -330,6 +393,8 @@ definitions:
         type: string
       rotate:
         type: boolean
+    required:
+      - key_id
     type: object
   api.ExecutorConnection:
     properties:
@@ -449,6 +514,15 @@ definitions:
         description: Full source commit Core was built from; null for development builds.
         type: string
         x-nullable: true
+    required:
+      - address_bindings
+      - api_base_url
+      - configuration
+      - installation_id
+      - local_only
+      - object
+      - public_url
+      - source_commit
     type: object
   api.InstallationConfiguration:
     properties:
@@ -456,6 +530,8 @@ definitions:
         items:
           $ref: '#/definitions/api.InstallationSetting'
         type: array
+    required:
+      - settings
     type: object
   api.InstallationSetting:
     properties:
@@ -473,6 +549,9 @@ definitions:
       restarts:
         description: Services that restart when the setting changes.
         items:
+          enum:
+            - core
+            - web
           type: string
         type: array
       sensitive:
@@ -480,6 +559,13 @@ definitions:
       value:
         description: Applied value; always null for a sensitive setting.
         x-nullable: true
+    required:
+      - changeable
+      - default
+      - key
+      - restarts
+      - sensitive
+      - value
     type: object
   api.ItemDiagnosticTiming:
     properties:
@@ -493,16 +579,25 @@ definitions:
         x-nullable: true
       started_at:
         type: string
+    required:
+      - completed_at
+      - item_id
+      - observed_duration_ms
+      - started_at
     type: object
   api.ProjectAPIKeyRequest:
     properties:
       name:
         type: string
+    required:
+      - name
     type: object
   api.ProjectRequest:
     properties:
       name:
         type: string
+    required:
+      - name
     type: object
   api.ResourceOwnerList:
     properties:
@@ -510,6 +605,8 @@ definitions:
         items:
           $ref: '#/definitions/writeaudit.ResourceOwner'
         type: array
+    required:
+      - data
     type: object
   api.RuntimeDiskObservation:
     properties:
@@ -531,6 +628,8 @@ definitions:
         items:
           $ref: '#/definitions/deployment.NodeAllocation'
         type: array
+    required:
+      - data
     type: object
   api.SandboxDeploymentChangeInput:
     properties:
@@ -583,6 +682,10 @@ definitions:
         type: string
       token:
         type: string
+    required:
+      - enrollment_id
+      - expires_at
+      - token
     type: object
   api.SandboxEnrollmentTokenRequest:
     properties:
@@ -600,6 +703,8 @@ definitions:
         type: string
       updated:
         type: boolean
+    required:
+      - id
     type: object
   api.SandboxNodeList:
     properties:
@@ -607,6 +712,8 @@ definitions:
         items:
           $ref: '#/definitions/deployment.Node'
         type: array
+    required:
+      - data
     type: object
   api.SessionDiagnosticFailure:
     properties:
@@ -651,6 +758,11 @@ definitions:
         type: string
       turn_id:
         type: string
+    required:
+      - code
+      - failed_at
+      - params
+      - source
     type: object
   api.SessionDiagnostics:
     properties:
@@ -671,6 +783,11 @@ definitions:
           - requires_action
           - failed
         type: string
+    required:
+      - failure
+      - object
+      - session_id
+      - status
     type: object
   api.TurnDiagnostics:
     properties:
@@ -694,6 +811,14 @@ definitions:
         type: string
       turn_id:
         type: string
+    required:
+      - failure
+      - items
+      - items_truncated
+      - object
+      - session_id
+      - status
+      - turn_id
     type: object
   coremetrics.Database:
     properties:
@@ -708,6 +833,11 @@ definitions:
       size_bytes:
         type: integer
         x-nullable: true
+    required:
+      - ping_ms
+      - pool
+      - series
+      - size_bytes
     type: object
   coremetrics.DatabaseBucket:
     properties:
@@ -719,6 +849,10 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - ping_p95_ms
+      - pool_in_use
+      - start
     type: object
   coremetrics.Execution:
     properties:
@@ -752,6 +886,18 @@ definitions:
       waiting_for_daemon:
         type: integer
         x-nullable: true
+    required:
+      - connected_daemons
+      - in_progress_turns
+      - interrupted
+      - oldest_queued_seconds
+      - queue_wait_ms
+      - queued_turns
+      - series
+      - slots_in_use
+      - slots_total
+      - unavailable
+      - waiting_for_daemon
     type: object
   coremetrics.ExecutionBucket:
     properties:
@@ -766,6 +912,11 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - in_progress
+      - queue_wait_p95_ms
+      - queued
+      - start
     type: object
   coremetrics.Job:
     properties:
@@ -781,7 +932,18 @@ definitions:
         type: integer
         x-nullable: true
       status:
+        enum:
+          - ok
+          - failing
+          - stopped
+          - unknown
         type: string
+    required:
+      - failed
+      - id
+      - last_run_at
+      - processed
+      - status
     type: object
   coremetrics.Latency:
     properties:
@@ -791,6 +953,9 @@ definitions:
       p95:
         type: number
         x-nullable: true
+    required:
+      - p50
+      - p95
     type: object
   coremetrics.Pool:
     properties:
@@ -803,6 +968,10 @@ definitions:
       max:
         type: integer
         x-nullable: true
+    required:
+      - idle
+      - in_use
+      - max
     type: object
   coremetrics.Process:
     properties:
@@ -828,6 +997,14 @@ definitions:
         items:
           $ref: '#/definitions/coremetrics.ProcessBucket'
         type: array
+    required:
+      - cpu_cores
+      - cpu_limit_cores
+      - goroutines
+      - memory_bytes
+      - memory_limit_bytes
+      - rss_bytes
+      - series
     type: object
   coremetrics.ProcessBucket:
     properties:
@@ -839,6 +1016,10 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - cpu_cores
+      - rss_bytes
+      - start
     type: object
   coremetrics.Range:
     properties:
@@ -848,6 +1029,10 @@ definitions:
         type: integer
       start:
         type: string
+    required:
+      - end
+      - resolution_seconds
+      - start
     type: object
   coremetrics.ServiceState:
     properties:
@@ -861,7 +1046,15 @@ definitions:
         type: string
         x-nullable: true
       status:
+        enum:
+          - running
+          - degraded
         type: string
+    required:
+      - execution_owner
+      - revision
+      - started_at
+      - status
     type: object
   coremetrics.View:
     properties:
@@ -874,6 +1067,8 @@ definitions:
           $ref: '#/definitions/coremetrics.Job'
         type: array
       object:
+        enum:
+          - core.metrics
         type: string
       process:
         $ref: '#/definitions/coremetrics.Process'
@@ -881,6 +1076,14 @@ definitions:
         $ref: '#/definitions/coremetrics.Range'
       service:
         $ref: '#/definitions/coremetrics.ServiceState'
+    required:
+      - database
+      - execution
+      - jobs
+      - object
+      - process
+      - range
+      - service
     type: object
   deployment.AddressBindings:
     properties:
@@ -892,6 +1095,11 @@ definitions:
         type: integer
       self_hosted_executors:
         type: integer
+    required:
+      - hosted_sandboxes
+      - nodes
+      - nodes_on_other_address
+      - self_hosted_executors
     type: object
   deployment.HostHistory:
     properties:
@@ -901,6 +1109,9 @@ definitions:
         type: array
       resolution_seconds:
         type: integer
+    required:
+      - points
+      - resolution_seconds
     type: object
   deployment.HostHistoryPoint:
     properties:
@@ -915,6 +1126,11 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - available_disk_bytes_min
+      - cpu_utilization_max
+      - memory_used_bytes_max
+      - start
     type: object
   deployment.Node:
     properties:
@@ -922,8 +1138,10 @@ definitions:
         type: integer
       available_disk_bytes:
         type: integer
+        x-nullable: true
       available_memory_bytes:
         type: integer
+        x-nullable: true
       cleanup_pending:
         type: integer
       core_url:
@@ -933,6 +1151,7 @@ definitions:
         type: string
       cpu_count:
         type: integer
+        x-nullable: true
       created_at:
         type: string
       diagnostic:
@@ -953,6 +1172,7 @@ definitions:
         type: string
       last_seen_at:
         type: string
+        x-nullable: true
       max_active:
         type: integer
       max_retained:
@@ -975,6 +1195,28 @@ definitions:
         type: integer
       snapshots:
         type: integer
+    required:
+      - active
+      - available_disk_bytes
+      - available_memory_bytes
+      - cleanup_pending
+      - core_url
+      - cpu_count
+      - created_at
+      - enrollment_id
+      - id
+      - last_seen_at
+      - max_active
+      - max_retained
+      - name
+      - online
+      - provider
+      - provider_ready
+      - reserved
+      - retained
+      - rollout
+      - running
+      - snapshots
     type: object
   deployment.NodeAllocation:
     properties:
@@ -989,6 +1231,13 @@ definitions:
       deployment_generation:
         type: integer
       diagnostic:
+        enum:
+          - ""
+          - node_unavailable
+          - resource_missing
+          - compute_unconfirmed
+          - ownership_mismatch
+          - provider_unavailable
         type: string
       environment_id:
         type: string
@@ -1004,6 +1253,19 @@ definitions:
         type: string
       tenant_id:
         type: string
+    required:
+      - compute_phase
+      - compute_phase_changed_at
+      - created_at
+      - deployment_generation
+      - diagnostic
+      - environment_id
+      - id
+      - initialization
+      - node_id
+      - session_id
+      - state
+      - tenant_id
     type: object
   deployment.NodeDetail:
     properties:
@@ -1011,8 +1273,10 @@ definitions:
         type: integer
       available_disk_bytes:
         type: integer
+        x-nullable: true
       available_memory_bytes:
         type: integer
+        x-nullable: true
       cleanup_pending:
         type: integer
       core_url:
@@ -1022,6 +1286,7 @@ definitions:
         type: string
       cpu_count:
         type: integer
+        x-nullable: true
       created_at:
         type: string
       diagnostic:
@@ -1046,6 +1311,7 @@ definitions:
         type: string
       last_seen_at:
         type: string
+        x-nullable: true
       max_active:
         type: integer
       max_retained:
@@ -1068,6 +1334,30 @@ definitions:
         type: integer
       snapshots:
         type: integer
+    required:
+      - active
+      - available_disk_bytes
+      - available_memory_bytes
+      - cleanup_pending
+      - core_url
+      - cpu_count
+      - created_at
+      - enrollment_id
+      - history
+      - host
+      - id
+      - last_seen_at
+      - max_active
+      - max_retained
+      - name
+      - online
+      - provider
+      - provider_ready
+      - reserved
+      - retained
+      - rollout
+      - running
+      - snapshots
     type: object
   deployment.NodeHost:
     properties:
@@ -1089,6 +1379,13 @@ definitions:
       total_memory_bytes:
         type: integer
         x-nullable: true
+    required:
+      - available_disk_bytes
+      - available_memory_bytes
+      - cpu_utilization
+      - effective_cpu_cores
+      - observed_at
+      - total_memory_bytes
     type: object
   deployment.NodeRollout:
     properties:
@@ -1114,6 +1411,9 @@ definitions:
           - update_required
           - unknown
         type: string
+    required:
+      - ready_generation
+      - state
     type: object
   deployment.NodeUpdate:
     properties:
@@ -1124,10 +1424,16 @@ definitions:
         type: integer
       name:
         type: string
+    required:
+      - max_active
+      - name
     type: object
   deployment.Reset:
     properties:
       clear:
+        enum:
+          - auto
+          - force
         type: string
       deadline_at:
         type: string
@@ -1139,6 +1445,12 @@ definitions:
         $ref: '#/definitions/deployment.ResetRemaining'
       requested_at:
         type: string
+    required:
+      - clear
+      - deadline_at
+      - forced_at
+      - remaining
+      - requested_at
     type: object
   deployment.ResetOfflineNode:
     properties:
@@ -1148,6 +1460,10 @@ definitions:
         type: string
       resources:
         type: integer
+    required:
+      - name
+      - node_id
+      - resources
     type: object
   deployment.ResetRemaining:
     properties:
@@ -1163,6 +1479,12 @@ definitions:
         type: array
       on_offline_nodes:
         type: integer
+    required:
+      - busy
+      - cleanup
+      - idle
+      - offline_nodes
+      - on_offline_nodes
     type: object
   deployment.ResetRequest:
     properties:
@@ -1188,6 +1510,9 @@ definitions:
         type: integer
       pending:
         type: integer
+    required:
+      - allocations
+      - pending
     type: object
   deployment.Rollout:
     properties:
@@ -1202,6 +1527,10 @@ definitions:
           - settled
           - preparing
         type: string
+    required:
+      - nodes
+      - previous_generation_sandboxes
+      - state
     type: object
   deployment.RolloutNodes:
     properties:
@@ -1215,6 +1544,12 @@ definitions:
         type: integer
       update_required:
         type: integer
+    required:
+      - failed
+      - preparing
+      - ready
+      - unknown
+      - update_required
     type: object
   deployment.Suspension:
     properties:
@@ -1222,6 +1557,9 @@ definitions:
         type: integer
       retention_seconds:
         type: integer
+    required:
+      - idle_seconds
+      - retention_seconds
     type: object
   deployment.View:
     properties:
@@ -1239,6 +1577,10 @@ definitions:
       metadata:
         type: object
       mode:
+        enum:
+          - ""
+          - nodes
+          - direct
         type: string
       owner_epoch:
         type: integer
@@ -1261,6 +1603,18 @@ definitions:
           - $ref: '#/definitions/deployment.Suspension'
         description: Idle suspension policy; null unless the selected Provider declares checkpoint support.
         x-nullable: true
+    required:
+      - core_url
+      - credential_configured
+      - generation
+      - installation_id
+      - mode
+      - owner_epoch
+      - provider
+      - reset
+      - resources
+      - rollout
+      - suspension
     type: object
   projects.APIKey:
     properties:
@@ -1276,6 +1630,14 @@ definitions:
         type: string
       revoked_at:
         type: string
+        x-nullable: true
+    required:
+      - created_at
+      - id
+      - name
+      - prefix
+      - project_id
+      - revoked_at
     type: object
   projects.IssuedAPIKey:
     properties:
@@ -1293,6 +1655,15 @@ definitions:
         type: string
       revoked_at:
         type: string
+        x-nullable: true
+    required:
+      - created_at
+      - id
+      - key
+      - name
+      - prefix
+      - project_id
+      - revoked_at
     type: object
   projects.KeyPage:
     properties:
@@ -1302,6 +1673,9 @@ definitions:
         type: array
       has_more:
         type: boolean
+    required:
+      - data
+      - has_more
     type: object
   projects.Page:
     properties:
@@ -1311,6 +1685,9 @@ definitions:
         type: array
       has_more:
         type: boolean
+    required:
+      - data
+      - has_more
     type: object
   projects.Project:
     properties:
@@ -1318,12 +1695,19 @@ definitions:
         type: integer
       archived_at:
         type: string
+        x-nullable: true
       created_at:
         type: string
       id:
         type: string
       name:
         type: string
+    required:
+      - active_key_count
+      - archived_at
+      - created_at
+      - id
+      - name
     type: object
   sandbox.ConfigurationDiscoveryInput:
     properties:
@@ -1340,6 +1724,8 @@ definitions:
         $ref: '#/definitions/sandbox.Resources'
       runtime:
         $ref: '#/definitions/sandbox.RuntimeRelease'
+    required:
+      - resources
     type: object
   sandbox.Resources:
     properties:
@@ -1351,6 +1737,9 @@ definitions:
         type: integer
       root_disk_mib:
         type: integer
+    required:
+      - cpus
+      - memory_mib
     type: object
   sandbox.RuntimeRelease:
     properties:
@@ -1366,6 +1755,13 @@ definitions:
         type: string
       source_commit:
         type: string
+    required:
+      - firmware_sha256
+      - image_id
+      - image_manifest_digest
+      - microsandbox_ref
+      - runtime_sha256
+      - source_commit
     type: object
   sessions.AdminAssetCounts:
     properties:
@@ -1381,6 +1777,13 @@ definitions:
         type: integer
       vaults:
         type: integer
+    required:
+      - agents
+      - credentials
+      - environment_templates
+      - files
+      - skills
+      - vaults
     type: object
   sessions.ExecutorCredential:
     properties:
@@ -1392,6 +1795,10 @@ definitions:
       revoked_at:
         type: string
         x-nullable: true
+    required:
+      - created_at
+      - key_id
+      - revoked_at
     type: object
   sessions.IssuedExecutorCredential:
     properties:
@@ -1401,6 +1808,9 @@ definitions:
         type: string
       key_id:
         type: string
+    required:
+      - executor_token
+      - key_id
     type: object
   sessions.ManagedArchive:
     properties:
@@ -1409,7 +1819,15 @@ definitions:
       session_id:
         type: string
       state:
+        enum:
+          - active
+          - cleanup_pending
+          - released
         type: string
+    required:
+      - environment_id
+      - session_id
+      - state
     type: object
   v1.Agent:
     properties:
@@ -3333,6 +3751,8 @@ definitions:
       id:
         type: string
       kind:
+        enum:
+          - issued
         type: string
       name:
         type: string
@@ -3340,10 +3760,25 @@ definitions:
         type: string
       revoked_at:
         type: string
+        x-nullable: true
+    required:
+      - id
+      - kind
+      - name
+      - prefix
+      - revoked_at
     type: object
   writeaudit.Operation:
     properties:
       action:
+        enum:
+          - create
+          - update
+          - delete
+          - send_events
+          - upload_file
+          - upload_version
+          - update_default_version
         type: string
       api_key:
         $ref: '#/definitions/writeaudit.APIKey'
@@ -3358,9 +3793,30 @@ definitions:
       resource_id:
         type: string
       resource_type:
+        enum:
+          - agent
+          - session
+          - environment
+          - environment_template
+          - skill
+          - skill_version
+          - file
+          - vault
+          - credential
+          - artifact
         type: string
       trace_id:
         type: string
+    required:
+      - action
+      - api_key
+      - created_at
+      - id
+      - parent_id
+      - request_id
+      - resource_id
+      - resource_type
+      - trace_id
     type: object
   writeaudit.Page:
     properties:
@@ -3372,13 +3828,22 @@ definitions:
         type: boolean
       next_cursor:
         type: string
+    required:
+      - data
+      - has_more
+      - next_cursor
     type: object
   writeaudit.ResourceOwner:
     properties:
       api_key:
-        $ref: '#/definitions/writeaudit.APIKey'
+        allOf:
+          - $ref: '#/definitions/writeaudit.APIKey'
+        x-nullable: true
       resource_id:
         type: string
+    required:
+      - api_key
+      - resource_id
     type: object
 info:
   contact: {}
diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index 286d27a27..f9ffb2cf9 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -14,7 +14,7 @@ Core targets the complete OpenAI Agents API as pinned below ([public API rule](h
 | [openapi.yaml](./openapi.yaml) | The official public contract with Core's `x_agents_core` extension on Agent and Session request/response objects |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go names, field representations, encoding order and stored projections; it does not define official field membership, enums or constraints |
 
-Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
+Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations; the same generator projects the `/core/v1` document into `packages/agents-client/src/generated/core-api.ts`, which imports the public types it references from `public-api.ts`. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
 
 The public contract is the official API plus Core extensions. Standard fields are generated into `v1/official.gen.go`; `go-bindings.json` lists types consumed by Core and overrides only the Go representation or field order that existing storage or custom JSON encoding requires. Unspecified fields follow the official schema; shared shapes use one Go type. Selected discriminated unions also generate JSON serializers to retain required nullable fields for each variant. Other union serializers, Core's local limits, execution admission and state transitions remain implementation code. Contract tests verify that the public schema preserves the official definitions, extensions remain in `x_agents_core`, and all documents match registered routes. Official-client and raw HTTP tests verify behavior. Schema generation does not qualify an unimplemented feature; the gaps below still apply. Upstream upgrades update the OpenAPI and SDK pins together after comparison and compatibility tests.
 
diff --git a/contracts/agents-api/runtime.openapi.yaml b/contracts/agents-api/runtime.openapi.yaml
index 8e1ac37a7..fb434cab2 100644
--- a/contracts/agents-api/runtime.openapi.yaml
+++ b/contracts/agents-api/runtime.openapi.yaml
@@ -117,6 +117,8 @@ definitions:
         $ref: '#/definitions/sandbox.Resources'
       runtime:
         $ref: '#/definitions/sandbox.RuntimeRelease'
+    required:
+      - resources
     type: object
   sandbox.Resources:
     properties:
@@ -128,6 +130,9 @@ definitions:
         type: integer
       root_disk_mib:
         type: integer
+    required:
+      - cpus
+      - memory_mib
     type: object
   sandbox.RuntimeRelease:
     properties:
@@ -143,6 +148,13 @@ definitions:
         type: string
       source_commit:
         type: string
+    required:
+      - firmware_sha256
+      - image_id
+      - image_manifest_digest
+      - microsandbox_ref
+      - runtime_sha256
+      - source_commit
     type: object
   v1.APIError:
     properties:
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index 3897fefdc..04c831d54 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "Agents API 覆盖台账"
 source: contracts/agents-api/index.md
-source_hash: c3180e51ce893b3752370abbdf3a58255ebe11fdfd7ec1e1620ad85f7ce1b30d
+source_hash: b2281fe0f7ab7c4f810b029aca847a11a3a292d367dcacd1ac3f716f511e2814
 ---
 
 Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。本台账记录 Core 对各项资源实现了哪些内容、哪些契约保存其详细信息，并列出相对于 OpenAI 服务的所有已知差异和所有未解决缺口。[API namespaces and credentials](../../../docs/zh/api/index.md) 说明谁调用哪些 API；[Agents API guide](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
@@ -16,7 +16,7 @@ Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[publi
 | [openapi.yaml](../openapi.yaml) | 官方公共契约，并在 Agent 和 Session 请求及响应对象上加入 Core 的 `x_agents_core` 扩展 |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go 名称、字段表示、编码顺序和存储投影；不定义官方字段集合、枚举或约束 |
 
-运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
+运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成；同一生成器把 `/core/v1` 文档投影为 `packages/agents-client/src/generated/core-api.ts`，其中引用的公共类型从 `public-api.ts` 导入。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
 
 公共契约是官方 API 加上 Core 扩展。标准字段生成到 `v1/official.gen.go`；`go-bindings.json` 只列出 Core 使用的类型，仅在已有存储或自定义 JSON 编码需要时覆盖 Go 表示或字段顺序。未覆盖的字段遵循官方 schema，相同结构复用同一个 Go 类型。部分带判别字段的联合类型也从 schema 生成 JSON 序列化代码，保留每个分支必需的可空字段。其他联合类型序列化、Core 的本地限制、执行准入和状态转换仍由实现代码负责。契约测试验证公共 schema 保留官方定义、扩展位于 `x_agents_core` 中，且所有文档与注册路由一致。官方客户端和原始 HTTP 测试验证行为。生成 schema 不代表某个尚未实现的功能已经得到验证；下方缺口仍然适用。升级上游时，在比对和兼容性测试后一起更新 OpenAPI 和 SDK 固定版本。
 
diff --git a/packages/agents-client/README.md b/packages/agents-client/README.md
index c93f98670..0e471313f 100644
--- a/packages/agents-client/README.md
+++ b/packages/agents-client/README.md
@@ -20,7 +20,7 @@ Every constructor also takes `baseUrl` and `fetch`. A token may be a string or a
 
 Behavior shared by the clients:
 
-- **Generated types.** `make openapi` generates `src/generated/public-api.ts` from the [public schema](../../contracts/agents-api/openapi.yaml): each schema's type, each enum's values and each object's field names. `types.ts` builds on the types and the validators read the value and field lists; `make check-openapi` rejects a stale copy, so change the schema and regenerate instead of editing the file.
+- **Generated types.** `make openapi` generates `src/generated/public-api.ts` from the [public schema](../../contracts/agents-api/openapi.yaml) and `src/generated/core-api.ts` from the [Core API schema](../../contracts/agents-api/core.openapi.yaml): each schema's type, each enum's values and each object's field names. `types.ts`, `admin-types.ts`, `sandbox-client.ts` and `core-metrics.ts` name and compose the types, and the validators read the value and field lists; `make check-openapi` rejects a stale copy, so change the schema or the Go annotations and regenerate instead of editing the files.
 - **Strict responses.** Session, history, event, Environment and Core API responses are checked against their pinned shapes before they are returned. A malformed one throws `AgentCoreError` with status 502 and a code such as `invalid_session_resource` or `invalid_admin_response` (`CoreMetricsClient`: status 0, `invalid_response`) instead of passing on a guessed value. Agent responses are typed but not checked at run time.
 - **Errors.** A non-2xx response throws `AgentCoreError` with `status`, `code`, `param`, `errorType` and, from the Core API, the optional `details` of the [Core error envelope](../../contracts/agents-api/core-errors.md). Input the client cannot send, such as a malformed resource ID, throws `TypeError` before any request; Core enforces size, count and range limits.
 - **No retries or timeouts.** No client retries a request. Pass `signal` to cancel one.
diff --git a/packages/agents-client/src/admin-client.test.ts b/packages/agents-client/src/admin-client.test.ts
index 94613c92e..a19504b87 100644
--- a/packages/agents-client/src/admin-client.test.ts
+++ b/packages/agents-client/src/admin-client.test.ts
@@ -236,10 +236,10 @@ describe("AdminClient response contracts", () => {
     }
   });
 
-  it("reads any provider base URL an earlier Core stored but still rejects unsafe ones", async () => {
+  it("reads any provider base URL Core's write rule allows but still rejects unsafe ones", async () => {
     const saved = { id: resourceId, object: "agent", model: "model", name: null, instructions: null, metadata: {}, multi_agent: { enabled: false, max_concurrent_subagents: null }, reasoning: { effort: null, summary: null }, service_tier: "auto", text: { format: { type: "text" }, verbosity: "medium" }, tools: [], created_at: 1, updated_at: 1 };
     const withURL = (base_url: string, id = resourceId) => ({ ...saved, id, x_agents_core: { model_provider: { protocol: "responses", base_url, api_key_configured: true } } });
-    // Core once accepted hosts and ports that URL parsing rejects; one must not fail the list.
+    // The client is never stricter than Core's write rule: a host or port that URL parsing rejects must not fail the list.
     const stored = ["https://p.test:99999/v1", "https://xn--.test", "https://[::1]:8443/v1", "HTTPS://p.test/v1?"].map((url, index) => withURL(url, `agent-${index}`));
     expect((await clientWith(page(stored)).client.listAgents(projectId)).data).toEqual(stored);
     for (const url of ["http://p.test", "https://user:pw@p.test", "https://p.test/?key=secret", "https://p.test/#secret", "https://:443/v1"]) {
@@ -248,10 +248,12 @@ describe("AdminClient response contracts", () => {
   });
 
   it("binds Skills, versions and Artifacts to requested resources", async () => {
-    const skill = { id: "skill", object: "skill", created_at: 1, name: "helper", description: "help", default_version: "1", latest_version: "2" };
-    expect(await clientWith(skill).client.retrieveSkill(projectId, "skill")).toEqual(skill);
-    const version = { id: "version", object: "skill.version", created_at: 1, skill_id: "skill", version: "2", name: "helper", description: "help" };
-    await expect(clientWith(version).client.retrieveSkillVersion(projectId, "other", "2")).rejects.toBeInstanceOf(AgentCoreError);
+    const skill = { id: "skill_helper", object: "skill", created_at: 1, name: "helper", description: "help", default_version: "1", latest_version: "2" };
+    expect(await clientWith(skill).client.retrieveSkill(projectId, "skill_helper")).toEqual(skill);
+    await expect(clientWith(skill).client.retrieveSkill(projectId, "skill_other")).rejects.toBeInstanceOf(AgentCoreError);
+    const version = { id: "skillver_helper2", object: "skill.version", created_at: 1, skill_id: "skill_helper", version: "2", name: "helper", description: "help" };
+    expect(await clientWith(version).client.retrieveSkillVersion(projectId, "skill_helper", "2")).toEqual(version);
+    await expect(clientWith(version).client.retrieveSkillVersion(projectId, "skill_other", "2")).rejects.toBeInstanceOf(AgentCoreError);
     const artifact = { id: "artifact", object: "agent.session.artifact", created_at: 1, session_id: sessionId, environment_id: resourceId, path: "/result.txt", size_bytes: 2, turn_id: "turn" };
     expect((await clientWith(page([artifact])).client.listArtifacts(projectId, sessionId)).data).toEqual([artifact]);
     await expect(clientWith(artifact).client.retrieveArtifact(projectId, resourceId, "artifact")).rejects.toBeInstanceOf(AgentCoreError);
@@ -302,6 +304,15 @@ describe("AdminClient deployment read models", () => {
     await expect(clientWith({ ...audit, data: [{ ...audit.data[0], request_body: { token: "leak" } }] }).client.listAuditLog()).rejects.toBeInstanceOf(AgentCoreError);
   });
 
+  it("requires each write operation's key and a recorded action and resource type", async () => {
+    const operation = { id: "op", created_at: "2026-09-24T00:00:00Z", api_key: { id: keyId, name: "SDK", prefix: "p", kind: "issued", revoked_at: null }, action: "create", resource_type: "agent", resource_id: "a", parent_id: "", request_id: "request", trace_id: "trace" };
+    const operations = { data: [operation], has_more: false, next_cursor: "" };
+    expect(await clientWith(operations).client.listWriteOperations(projectId)).toEqual(operations);
+    for (const invalid of [{ ...operation, api_key: null }, { ...operation, action: "archive" }, { ...operation, resource_type: "deployment" }]) {
+      await expect(clientWith({ ...operations, data: [invalid] }).client.listWriteOperations(projectId)).rejects.toBeInstanceOf(AgentCoreError);
+    }
+  });
+
   it("passes provenance filters without a binding digest and preserves Vault status arrays", async () => {
     const operations = { data: [], has_more: false, next_cursor: "" };
     const { client, fetch } = clientWith(operations);
@@ -456,8 +467,8 @@ describe("AdminClient project monitoring", () => {
     };
     const value = { object: "list", data: [{ project_id: projectId, observation }], has_more: false, first_id: sessionId, last_id: sessionId };
     expect(await clientWith(value).client.listRuntimeObservations()).toEqual(value);
-    const { disk: _, ...older } = observation;
-    expect((await clientWith({ ...value, data: [{ project_id: projectId, observation: older }] }).client.listRuntimeObservations()).data[0]!.observation.disk).toBeNull();
+    const { disk: _, ...withoutDisk } = observation;
+    await expect(clientWith({ ...value, data: [{ project_id: projectId, observation: withoutDisk }] }).client.listRuntimeObservations()).rejects.toMatchObject({ code: "invalid_admin_response" });
     const invalid = { ...observation, disk: { usage_bytes: 1, limit_bytes: 0 } };
     await expect(clientWith({ ...value, data: [{ project_id: projectId, observation: invalid }] }).client.listRuntimeObservations()).rejects.toMatchObject({ code: "invalid_admin_response" });
   });
diff --git a/packages/agents-client/src/admin-client.ts b/packages/agents-client/src/admin-client.ts
index 7d208fc0c..16e5ae20c 100644
--- a/packages/agents-client/src/admin-client.ts
+++ b/packages/agents-client/src/admin-client.ts
@@ -11,9 +11,11 @@ import { projectAgentTurn, projectSessionItem, projectHistoryPage } from "./hist
 import { projectRuntimeHistory } from "./runtime-history-projection";
 import { canonicalUuid, isNonnegativeInteger, isRecord } from "./response-projection";
 import { CoreRequester } from "./core-request";
+import { projectSkill, projectSkillDeleted, projectSkillVersion, projectSkillVersionDeleted } from "./skill-projection";
+import { keyPageFields, projectsPageFields } from "./generated/core-api";
 import {
   invalidAdminResponse, projectAdminProject, projectAdminKey, projectIssuedAdminKey, projectAdminPage, projectAdminDeleted, projectAdminSessionArchive,
-  projectResourcePage, projectSavedAgent, projectSkill, projectSkillVersion, projectArtifact, projectSummary, projectAdminRuntimePage, projectResourceOwners, projectWriteOperations, projectAdminAudit,
+  projectResourcePage, projectSavedAgent, projectArtifact, projectSummary, projectAdminRuntimePage, projectResourceOwners, projectWriteOperations, projectAdminAudit,
   projectExecutorCredentials, projectIssuedExecutorCredential, projectCoreHarnessList, projectHarnessModelConfiguration, projectInstallation,
 } from "./admin-projection";
 import type {
@@ -78,7 +80,7 @@ export class AdminClient {
     return projectInstallation(await this.#json("/installation", options));
   }
   async listProjects(options?: PageOptions) {
-    return projectAdminPage(await this.#json(pageQuery("/projects", options), options), (value) => projectAdminProject(value));
+    return projectAdminPage(await this.#json(pageQuery("/projects", options), options), projectsPageFields, (value) => projectAdminProject(value));
   }
   async createProject(input: CreateAdminProjectInput, options?: ReadOptions) {
     return projectAdminProject(await this.#json("/projects", options, "POST", { name: input.name }));
@@ -90,7 +92,7 @@ export class AdminClient {
     return projectAdminProject(await this.#json(`${scope(projectId)}/archive`, options, "POST"), projectId);
   }
   async listAPIKeys(projectId: string, options?: PageOptions) {
-    return projectAdminPage(await this.#json(pageQuery(`${scope(projectId)}/keys`, options), options), (value) => projectAdminKey(value, projectId));
+    return projectAdminPage(await this.#json(pageQuery(`${scope(projectId)}/keys`, options), options), keyPageFields, (value) => projectAdminKey(value, projectId));
   }
   async issueAPIKey(projectId: string, input: IssueAdminAPIKeyInput, options?: ReadOptions) {
     return projectIssuedAdminKey(await this.#json(`${scope(projectId)}/keys`, options, "POST", { name: input.name }), projectId);
@@ -121,25 +123,22 @@ export class AdminClient {
     return this.#delete(`${scope(projectId)}/agents/${segment(agentId)}`, agentId, "agent.deleted", options);
   }
   async listSkills(projectId: string, options?: PageOptions): Promise<SkillList> {
-    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills`, options), options), (value) => projectSkill(value));
+    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills`, options), options), (value) => projectSkill(value, invalidAdminResponse));
   }
   async retrieveSkill(projectId: string, skillId: string, options?: ReadOptions) {
-    return projectSkill(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}`, options), skillId);
+    return projectSkill(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}`, options), invalidAdminResponse, skillId);
   }
-  deleteSkill(projectId: string, skillId: string, options?: ReadOptions) {
-    return this.#delete(`${scope(projectId)}/skills/${segment(skillId)}`, skillId, "skill.deleted", options);
+  async deleteSkill(projectId: string, skillId: string, options?: ReadOptions) {
+    return projectSkillDeleted(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}`, options, "DELETE"), invalidAdminResponse, skillId);
   }
   async listSkillVersions(projectId: string, skillId: string, options?: PageOptions): Promise<SkillVersionList> {
-    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills/${segment(skillId)}/versions`, options), options), (value) => projectSkillVersion(value, skillId));
+    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills/${segment(skillId)}/versions`, options), options), (value) => projectSkillVersion(value, invalidAdminResponse, skillId));
   }
   async retrieveSkillVersion(projectId: string, skillId: string, version: string, options?: ReadOptions) {
-    return projectSkillVersion(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options), skillId, version);
+    return projectSkillVersion(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options), invalidAdminResponse, skillId, version);
   }
   async deleteSkillVersion(projectId: string, skillId: string, version: string, options?: ReadOptions): Promise<SkillVersionDeleted> {
-    const value = await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options, "DELETE");
-    if (!isRecord(value) || value.version !== version || typeof value.id !== "string") return invalidAdminResponse();
-    const { version: _, ...receipt } = value;
-    return { ...projectAdminDeleted(receipt, value.id, "skill.version.deleted"), version };
+    return projectSkillVersionDeleted(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options, "DELETE"), invalidAdminResponse, version);
   }
   downloadSkill(projectId: string, skillId: string, options?: ReadOptions) {
     return this.#content(`${scope(projectId)}/skills/${segment(skillId)}/content`, options);
diff --git a/packages/agents-client/src/admin-projection.ts b/packages/agents-client/src/admin-projection.ts
index 28051cae1..de765a7df 100644
--- a/packages/agents-client/src/admin-projection.ts
+++ b/packages/agents-client/src/admin-projection.ts
@@ -2,15 +2,30 @@ import { coreHarnessKinds, modelProviderProtocols } from "./harness-catalog";
 import { AgentCoreError, projectRuntimeObservation, projectSavedAgentConfiguration } from "./client";
 import { projectTokenUsage } from "./usage-projection";
 import { safeProvider } from "./execution-configuration-projection";
-import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
-import type { CoreHarness, CoreHarnessKind, HarnessModelConfiguration, ProviderObservationErrorCode, ListPage, SavedAgent } from "./types";
-import type { AdminAPIKey, AdminProject, AdminAuditPage, AdminSummary, AdminRuntimeObservation, RuntimeDiskObservation, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperationPage, AdminDeleted, AdminIssuedAPIKey, AdminPage, AdminSessionArchive, SessionArtifact, Skill, SkillVersion, ExecutorCredentialList, ExecutorConnection, IssuedExecutorCredential, CoreInstallation, CoreInstallationSetting } from "./admin-types";
+import { canonicalUuid, exactFields, type FieldNames, hasOwn, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import { sessionArtifactResourceFields } from "./generated/public-api";
+import {
+  addressBindingsFields, adminAssetCountsFields, adminauditOperationFields, adminauditPageFields, adminRuntimeObservationFields,
+  adminRuntimeObservationListFields, adminSessionCountsFields, adminSummaryResponseFields, adminSummaryRowFields, adminUsageCoverageFields,
+  coreHarnessFields, coreHarnessListFields, executorConnectionFields, executorConnectionStatusValues, executorCredentialFields,
+  executorCredentialListFields, harnessModelConfigurationFields, harnessModelConfigurationLastErrorCodeValues, installationConfigurationFields,
+  installationFields, installationSettingFields, installationSettingRequired, installationSettingRestartsValues, issuedExecutorCredentialFields,
+  managedArchiveFields, managedArchiveStateValues, modelConfigurationSupportFields, projectFields, projectsAPIKeyFields, resourceOwnerFields,
+  resourceOwnerListFields, runtimeDiskObservationFields, writeauditAPIKeyFields, writeauditOperationActionValues, writeauditOperationFields,
+  writeauditOperationResourceTypeValues, writeauditPageFields,
+} from "./generated/core-api";
+import type { CoreHarness, CoreHarnessKind, HarnessModelConfiguration, ListPage, SavedAgent, SessionArtifact } from "./types";
+import type {
+  AdminAPIKey, AdminAuditPage, AdminDeleted, AdminIssuedAPIKey, AdminKeyProvenance, AdminPage, AdminProject, AdminResourceOwner,
+  AdminRuntimeObservation, AdminSessionArchive, AdminSummary, AdminWriteOperationPage, CoreInstallation, CoreInstallationSetting,
+  ExecutorConnection, ExecutorCredentialList, IssuedExecutorCredential, RuntimeDiskObservation,
+} from "./admin-types";
 
 export function invalidAdminResponse(): never {
   throw new AgentCoreError("Core returned an invalid administration response.", 502, "invalid_admin_response");
 }
-function record(value: unknown, fields: string[]): Record<string, unknown> {
-  if (!isRecord(value) || !exactFields(value, new Set(fields))) return invalidAdminResponse();
+function record(value: unknown, fields: FieldNames): Record<string, unknown> {
+  if (!isRecord(value) || !exactFields(value, fields)) return invalidAdminResponse();
   return value;
 }
 function strings(value: Record<string, unknown>, fields: string[]): void {
@@ -20,7 +35,7 @@ function date(value: unknown): boolean {
   return value === null || (typeof value === "string" && Number.isFinite(Date.parse(value)));
 }
 export function projectAdminProject(value: unknown, expectedId?: string): AdminProject {
-  const project = record(value, ["id", "name", "created_at", "archived_at", "active_key_count"]);
+  const project = record(value, projectFields);
   strings(project, ["id", "name", "created_at"]);
   if (!date(project.created_at) ||
     !date(project.archived_at) || !isNonnegativeInteger(project.active_key_count) ||
@@ -28,7 +43,7 @@ export function projectAdminProject(value: unknown, expectedId?: string): AdminP
   return { ...project } as unknown as AdminProject;
 }
 export function projectAdminKey(value: unknown, projectId: string): AdminAPIKey {
-  const key = record(value, ["id", "project_id", "name", "prefix", "created_at", "revoked_at"]);
+  const key = record(value, projectsAPIKeyFields);
   strings(key, ["id", "project_id", "name", "prefix", "created_at"]);
   if (!date(key.created_at) || !date(key.revoked_at) ||
     !sameResourceId(key.project_id as string, projectId)) return invalidAdminResponse();
@@ -41,8 +56,8 @@ export function projectIssuedAdminKey(value: unknown, projectId: string): AdminI
   if (projected.revoked_at !== null) return invalidAdminResponse();
   return { ...projected, key };
 }
-export function projectAdminPage<T>(value: unknown, project: (entry: unknown) => T): AdminPage<T> {
-  const page = record(value, ["data", "has_more"]);
+export function projectAdminPage<T>(value: unknown, fields: FieldNames, project: (entry: unknown) => T): AdminPage<T> {
+  const page = record(value, fields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || (page.has_more && page.data.length === 0)) return invalidAdminResponse();
   return { data: page.data.map(project), has_more: page.has_more };
 }
@@ -62,10 +77,9 @@ export function projectAdminDeleted<O extends string>(value: unknown, expectedId
   return { id: deleted.id, object, deleted: true };
 }
 export function projectAdminSessionArchive(value: unknown, sessionId: string): AdminSessionArchive {
-  const archive = record(value, ["session_id", "environment_id", "state"]);
+  const archive = record(value, managedArchiveFields);
   if (typeof archive.session_id !== "string" || !sameResourceId(archive.session_id, sessionId) ||
-    canonicalUuid(archive.environment_id) === null ||
-    (archive.state !== "active" && archive.state !== "cleanup_pending" && archive.state !== "released")) return invalidAdminResponse();
+    canonicalUuid(archive.environment_id) === null || !isOneOf(managedArchiveStateValues, archive.state)) return invalidAdminResponse();
   return { session_id: archive.session_id, environment_id: archive.environment_id as string, state: archive.state };
 }
 export function projectSavedAgent(value: unknown, expectedId?: string): SavedAgent {
@@ -77,66 +91,51 @@ export function projectSavedAgent(value: unknown, expectedId?: string): SavedAge
     (expectedId !== undefined && !sameResourceId(agent.id, expectedId))) return invalidAdminResponse();
   return { ...agent, object, metadata: { ...metadata } as Record<string, string>, created_at, updated_at };
 }
-export function projectSkill(value: unknown, expectedId?: string): Skill {
-  const skill = record(value, ["id", "object", "created_at", "name", "description", "default_version", "latest_version"]);
-  strings(skill, ["id", "name", "description", "default_version", "latest_version"]);
-  if (skill.object !== "skill" || !isNonnegativeInteger(skill.created_at) ||
-    (expectedId !== undefined && !sameResourceId(skill.id as string, expectedId))) return invalidAdminResponse();
-  return { ...skill } as unknown as Skill;
-}
-export function projectSkillVersion(value: unknown, skillId: string, version?: string): SkillVersion {
-  const skill = record(value, ["id", "object", "created_at", "skill_id", "version", "name", "description"]);
-  strings(skill, ["id", "skill_id", "version", "name", "description"]);
-  if (skill.object !== "skill.version" || !isNonnegativeInteger(skill.created_at) || !sameResourceId(skill.skill_id as string, skillId) ||
-    (version !== undefined && skill.version !== version)) return invalidAdminResponse();
-  return { ...skill } as unknown as SkillVersion;
-}
 export function projectArtifact(value: unknown, sessionId: string, expectedId?: string): SessionArtifact {
-  const artifact = record(value, ["id", "object", "created_at", "environment_id", "path", "session_id", "size_bytes", "turn_id"]);
+  const artifact = record(value, sessionArtifactResourceFields);
   strings(artifact, ["id", "environment_id", "path", "session_id", "turn_id"]);
   if (artifact.object !== "agent.session.artifact" || !isNonnegativeInteger(artifact.created_at) || !isNonnegativeInteger(artifact.size_bytes) ||
     !sameResourceId(artifact.session_id as string, sessionId) || (expectedId !== undefined && !sameResourceId(artifact.id as string, expectedId))) return invalidAdminResponse();
   return { ...artifact } as unknown as SessionArtifact;
 }
-function projectProvenance(value: unknown): AdminKeyProvenance | null {
-  if (value === null) return null;
-  const key = record(value, ["id", "name", "prefix", "kind", "revoked_at"]);
+function projectProvenance(value: unknown): AdminKeyProvenance {
+  const key = record(value, writeauditAPIKeyFields);
   strings(key, ["id", "name", "prefix"]);
   if (key.kind !== "issued" || !date(key.revoked_at)) return invalidAdminResponse();
   return { ...key } as unknown as AdminKeyProvenance;
 }
 export function projectResourceOwners(value: unknown, ids: string[]): { data: AdminResourceOwner[] } {
-  const page = record(value, ["data"]);
+  const page = record(value, resourceOwnerListFields);
   if (!Array.isArray(page.data) || page.data.length !== ids.length) return invalidAdminResponse();
   return { data: page.data.map((entry, index) => {
-    const owner = record(entry, ["resource_id", "api_key"]);
+    const owner = record(entry, resourceOwnerFields);
     if (owner.resource_id !== ids[index]) return invalidAdminResponse();
-    return { resource_id: owner.resource_id as string, api_key: projectProvenance(owner.api_key) };
+    return { resource_id: owner.resource_id as string, api_key: owner.api_key === null ? null : projectProvenance(owner.api_key) };
   }) };
 }
 export function projectWriteOperations(value: unknown): AdminWriteOperationPage {
-  const page = record(value, ["data", "has_more", "next_cursor"]);
+  const page = record(value, writeauditPageFields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || typeof page.next_cursor !== "string") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const operation = record(entry, ["id", "created_at", "api_key", "action", "resource_type", "resource_id", "parent_id", "request_id", "trace_id"]);
-    strings(operation, ["id", "created_at", "action", "resource_type", "resource_id", "parent_id", "request_id", "trace_id"]);
-    if (!date(operation.created_at)) return invalidAdminResponse();
+    const operation = record(entry, writeauditOperationFields);
+    strings(operation, ["id", "created_at", "action", "resource_id", "parent_id", "request_id", "trace_id"]);
+    if (!date(operation.created_at) || !isOneOf(writeauditOperationActionValues, operation.action) || !isOneOf(writeauditOperationResourceTypeValues, operation.resource_type)) return invalidAdminResponse();
     return { ...operation, api_key: projectProvenance(operation.api_key) };
   });
   return { data, has_more: page.has_more, next_cursor: page.next_cursor } as AdminWriteOperationPage;
 }
 export function projectSummary(value: unknown): AdminSummary {
-  const page = record(value, ["data", "has_more", "next_cursor"]);
+  const page = record(value, adminSummaryResponseFields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || typeof page.next_cursor !== "string") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const summary = record(entry, ["project_id", "key_id", "agent_id", "assets", "sessions", "usage", "coverage", "last_active_at"]);
+    const summary = record(entry, adminSummaryRowFields);
     strings(summary, ["project_id"]);
     if (!(summary.key_id === null || typeof summary.key_id === "string") ||
       !(summary.agent_id === null || typeof summary.agent_id === "string") ||
       !(summary.last_active_at === null || isNonnegativeInteger(summary.last_active_at))) return invalidAdminResponse();
-    const assets = summary.assets === null ? null : record(summary.assets, ["agents", "skills", "environment_templates", "files", "vaults", "credentials"]);
-    const sessions = record(summary.sessions, ["total", "idle", "in_progress", "requires_action", "failed"]);
-    const coverage = record(summary.coverage, ["measured_sessions", "total_sessions", "ratio"]);
+    const assets = summary.assets === null ? null : record(summary.assets, adminAssetCountsFields);
+    const sessions = record(summary.sessions, adminSessionCountsFields);
+    const coverage = record(summary.coverage, adminUsageCoverageFields);
     const usage = projectTokenUsage(summary.usage, invalidAdminResponse);
     if (usage === null || (assets !== null && Object.values(assets).some((count) => !isNonnegativeInteger(count))) ||
       Object.values(sessions).some((count) => !isNonnegativeInteger(count)) || !isNonnegativeInteger(coverage.measured_sessions) ||
@@ -144,17 +143,16 @@ export function projectSummary(value: unknown): AdminSummary {
       !(coverage.ratio === null || (typeof coverage.ratio === "number" && Number.isFinite(coverage.ratio) && coverage.ratio >= 0 && coverage.ratio <= 1))) return invalidAdminResponse();
     return { ...summary, assets, sessions, coverage, usage };
   });
-  return { data, has_more: page.has_more, next_cursor: page.next_cursor } as AdminSummary;
+  return { data, has_more: page.has_more, next_cursor: page.next_cursor } as unknown as AdminSummary;
 }
 export function projectAdminRuntimePage(value: unknown): ListPage<AdminRuntimeObservation> {
-  const page = record(value, ["object", "data", "has_more", "first_id", "last_id"]);
+  const page = record(value, adminRuntimeObservationListFields);
   if (page.object !== "list" || !Array.isArray(page.data) || typeof page.has_more !== "boolean") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const item = record(entry, ["project_id", "observation"]);
+    const item = record(entry, adminRuntimeObservationFields);
     strings(item, ["project_id"]);
-    if (!isRecord(item.observation)) return invalidAdminResponse();
-    // A Core without disk observations omits the field; disk is then unknown.
-    const { disk = null, ...rest } = item.observation;
+    if (!isRecord(item.observation) || !hasOwn(item.observation, "disk")) return invalidAdminResponse();
+    const { disk, ...rest } = item.observation;
     const observation = projectRuntimeObservation(rest);
     return { project_id: item.project_id as string, observation: { ...observation, disk: projectRuntimeDisk(disk, observation.status === "observed") } };
   });
@@ -165,7 +163,7 @@ export function projectAdminRuntimePage(value: unknown): ListPage<AdminRuntimeOb
 
 function projectRuntimeDisk(value: unknown, observed: boolean): RuntimeDiskObservation | null {
   if (value === null) return null;
-  const disk = record(value, ["usage_bytes", "limit_bytes"]);
+  const disk = record(value, runtimeDiskObservationFields);
   const known = (field: unknown) => field === null || isNonnegativeInteger(field);
   if (!observed || !known(disk.usage_bytes) || !known(disk.limit_bytes) || disk.limit_bytes === 0 ||
     (disk.usage_bytes === null && disk.limit_bytes === null)) return invalidAdminResponse();
@@ -173,10 +171,10 @@ function projectRuntimeDisk(value: unknown, observed: boolean): RuntimeDiskObser
 }
 
 export function projectAdminAudit(value: unknown): AdminAuditPage {
-  const page = record(value, ["data", "has_more", "next_cursor"]);
+  const page = record(value, adminauditPageFields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || typeof page.next_cursor !== "string") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const audit = record(entry, ["id", "created_at", "admin_credential_id", "actor_label", "action", "project_id", "resource_type", "resource_id", "request_id", "trace_id"]);
+    const audit = record(entry, adminauditOperationFields);
     strings(audit, ["id", "created_at", "admin_credential_id", "actor_label", "action", "resource_type", "resource_id", "request_id", "trace_id"]);
     if (!date(audit.created_at) || !(audit.project_id === null || typeof audit.project_id === "string")) return invalidAdminResponse();
     return audit;
@@ -184,52 +182,49 @@ export function projectAdminAudit(value: unknown): AdminAuditPage {
   return { data, has_more: page.has_more, next_cursor: page.next_cursor } as unknown as AdminAuditPage;
 }
 export function projectExecutorCredentials(value: unknown): ExecutorCredentialList {
-  const page = record(value, ["data", "connection"]);
+  const page = record(value, executorCredentialListFields);
   if (!Array.isArray(page.data)) return invalidAdminResponse();
-  const connection = record(page.connection, ["status", "bound_key_id", "enrolled_at", "last_seen_at"]);
-  if (!["never_enrolled", "connected", "disconnected"].includes(connection.status as string) ||
+  const connection = record(page.connection, executorConnectionFields);
+  if (!isOneOf(executorConnectionStatusValues, connection.status) ||
       !(connection.bound_key_id === null || (typeof connection.bound_key_id === "string" && connection.bound_key_id.length > 0)) ||
       !date(connection.enrolled_at) || !date(connection.last_seen_at)) return invalidAdminResponse();
   if (connection.status === "never_enrolled" && [connection.bound_key_id, connection.enrolled_at, connection.last_seen_at].some(value => value !== null)) return invalidAdminResponse();
   if (connection.status !== "never_enrolled" && connection.enrolled_at === null) return invalidAdminResponse();
   if (connection.status === "connected" && connection.bound_key_id === null) return invalidAdminResponse();
   return { connection: { ...connection } as unknown as ExecutorConnection, data: page.data.map((entry) => {
-    const credential = record(entry, ["key_id", "created_at", "revoked_at"]);
+    const credential = record(entry, executorCredentialFields);
     if (typeof credential.key_id !== "string" || typeof credential.created_at !== "string" || !date(credential.created_at) || !date(credential.revoked_at)) return invalidAdminResponse();
     return { key_id: credential.key_id, created_at: credential.created_at, revoked_at: credential.revoked_at as string | null };
   }) };
 }
 /** The one-time credential must belong to the requested key ID and Environment. */
 export function projectIssuedExecutorCredential(value: unknown, keyId: string, environmentId: string): IssuedExecutorCredential {
-  const issued = record(value, ["key_id", "environment_id", "executor_token"]);
+  const issued = record(value, issuedExecutorCredentialFields);
   if (typeof issued.key_id !== "string" || !sameResourceId(issued.key_id, keyId) ||
     typeof issued.environment_id !== "string" || !sameResourceId(issued.environment_id, environmentId) ||
     typeof issued.executor_token !== "string" || !issued.executor_token) return invalidAdminResponse();
   return { key_id: issued.key_id, environment_id: issued.environment_id, executor_token: issued.executor_token };
 }
 
-const providerObservationErrors = new Set<string>(["authentication_error", "connection_failed", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "resource_not_found", "request_timeout", "invalid_request"]);
-const harnessKinds = new Set<string>(coreHarnessKinds);
 /** A deployment default model provider: exactly the safe view, never `api_key`. */
 export function projectHarnessModelConfiguration(value: unknown, harness?: CoreHarnessKind): HarnessModelConfiguration {
-  if (!isRecord(value) || !onlyFields(value, new Set(["object", "harness", "updated_at", "last_used_at", "last_error_code", "last_error_at", "model_provider", "model", "harness_config"]))) return invalidAdminResponse();
+  if (!isRecord(value) || !onlyFields(value, harnessModelConfigurationFields)) return invalidAdminResponse();
   const { object, harness: kind, updated_at, last_used_at, last_error_code, last_error_at, model_provider, model, harness_config } = value;
   if ((last_used_at !== null && (typeof last_used_at !== "string" || !date(last_used_at))) ||
     (last_error_at !== null && (typeof last_error_at !== "string" || !date(last_error_at))) ||
-    (last_error_code !== null && (typeof last_error_code !== "string" || !providerObservationErrors.has(last_error_code))) ||
+    (last_error_code !== null && !isOneOf(harnessModelConfigurationLastErrorCodeValues, last_error_code)) ||
     ((last_error_code === null) !== (last_error_at === null))) return invalidAdminResponse();
-  if (object !== "core.model_configuration" || typeof kind !== "string" || !harnessKinds.has(kind) || (harness !== undefined && kind !== harness) ||
+  if (object !== "core.model_configuration" || !isOneOf(coreHarnessKinds, kind) || (harness !== undefined && kind !== harness) ||
     typeof updated_at !== "string" || !date(updated_at)) return invalidAdminResponse();
   if (typeof model !== "string" || !model.trim() || !isRecord(harness_config)) return invalidAdminResponse();
   const provider = safeProvider(model_provider, invalidAdminResponse);
   if (!provider.api_key_configured) return invalidAdminResponse();
-  return { object, harness: kind as CoreHarnessKind, model_provider: provider, model, harness_config: { ...harness_config }, updated_at, last_used_at, last_error_at, last_error_code: last_error_code as ProviderObservationErrorCode | null };
+  return { object, harness: kind, model_provider: provider, model, harness_config: { ...harness_config }, updated_at, last_used_at, last_error_at, last_error_code };
 }
 function projectModelConfigurationSupport(value: unknown): CoreHarness["model_configuration_support"] {
-  const support = record(value, ["protocols", "accepts_harness_config", "token_limits_required"]);
-  const known: ReadonlySet<unknown> = new Set(modelProviderProtocols);
+  const support = record(value, modelConfigurationSupportFields);
   const protocols = support.protocols;
-  if (!Array.isArray(protocols) || protocols.length === 0 || protocols.some((protocol) => !known.has(protocol)) ||
+  if (!Array.isArray(protocols) || protocols.length === 0 || !protocols.every((protocol) => isOneOf(modelProviderProtocols, protocol)) ||
     new Set(protocols).size !== protocols.length ||
     typeof support.accepts_harness_config !== "boolean" || typeof support.token_limits_required !== "boolean") return invalidAdminResponse();
   return {
@@ -238,13 +233,13 @@ function projectModelConfigurationSupport(value: unknown): CoreHarness["model_co
   };
 }
 export function projectCoreHarnessList(value: unknown): { object: "list"; data: CoreHarness[] } {
-  const page = record(value, ["object", "data"]);
+  const page = record(value, coreHarnessListFields);
   if (page.object !== "list" || !Array.isArray(page.data)) return invalidAdminResponse();
   const data = page.data.map((entry): CoreHarness => {
-    const harness = record(entry, ["object", "id", "enabled", "default", "model_configuration", "model_configuration_support"]);
-    if (harness.object !== "core.harness" || typeof harness.id !== "string" || !harnessKinds.has(harness.id) ||
+    const harness = record(entry, coreHarnessFields);
+    if (harness.object !== "core.harness" || !isOneOf(coreHarnessKinds, harness.id) ||
       typeof harness.enabled !== "boolean" || typeof harness.default !== "boolean" || (harness.default && !harness.enabled)) return invalidAdminResponse();
-    const id = harness.id as CoreHarnessKind;
+    const id = harness.id;
     return {
       object: "core.harness", id, enabled: harness.enabled, default: harness.default,
       model_configuration_support: projectModelConfigurationSupport(harness.model_configuration_support),
@@ -255,28 +250,27 @@ export function projectCoreHarnessList(value: unknown): { object: "list"; data:
   return { object: "list", data };
 }
 const settingKey = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/;
-const settingServices = new Set(["core", "web", "database"]);
 function projectInstallationSetting(value: unknown): CoreInstallationSetting {
-  const base = ["key", "value", "default", "changeable", "sensitive", "restarts"];
   if (!isRecord(value) || typeof value.sensitive !== "boolean") return invalidAdminResponse();
-  const setting = record(value, value.sensitive ? [...base, "configured"] : base);
+  // `configured` is present exactly for a sensitive setting.
+  const setting = record(value, value.sensitive ? installationSettingFields : installationSettingRequired);
   if (typeof setting.key !== "string" || !settingKey.test(setting.key) || typeof setting.changeable !== "boolean" ||
-    !Array.isArray(setting.restarts) || !setting.restarts.every((service) => typeof service === "string" && settingServices.has(service)) ||
+    !Array.isArray(setting.restarts) || !setting.restarts.every((service) => isOneOf(installationSettingRestartsValues, service)) ||
     (setting.sensitive && (setting.value !== null || setting.default !== null || typeof setting.configured !== "boolean"))) return invalidAdminResponse();
   return { ...setting } as unknown as CoreInstallationSetting;
 }
 /** Sensitive settings carry no value, keys are unique and binding counts are consistent. */
 export function projectInstallation(value: unknown): CoreInstallation {
-  const installation = record(value, ["object", "installation_id", "public_url", "api_base_url", "local_only", "source_commit", "configuration", "address_bindings"]);
+  const installation = record(value, installationFields);
   const origin = installation.public_url;
   if (installation.object !== "core.installation" || canonicalUuid(installation.installation_id) === null ||
     typeof origin !== "string" || installation.api_base_url !== `${origin}/v1` ||
     typeof installation.local_only !== "boolean" ||
     (installation.source_commit !== null && (typeof installation.source_commit !== "string" || !/^[0-9a-f]{40}$/.test(installation.source_commit)))) return invalidAdminResponse();
-  const bindings = record(installation.address_bindings, ["nodes", "nodes_on_other_address", "hosted_sandboxes", "self_hosted_executors"]);
+  const bindings = record(installation.address_bindings, addressBindingsFields);
   if (![bindings.nodes, bindings.nodes_on_other_address, bindings.hosted_sandboxes, bindings.self_hosted_executors].every(isNonnegativeInteger) ||
     (bindings.nodes_on_other_address as number) > (bindings.nodes as number)) return invalidAdminResponse();
-  const configuration = record(installation.configuration, ["settings"]);
+  const configuration = record(installation.configuration, installationConfigurationFields);
   if (!Array.isArray(configuration.settings)) return invalidAdminResponse();
   const settings = configuration.settings.map(projectInstallationSetting);
   if (new Set(settings.map((setting) => setting.key)).size !== settings.length) return invalidAdminResponse();
diff --git a/packages/agents-client/src/admin-types.ts b/packages/agents-client/src/admin-types.ts
index 815592d83..266296360 100644
--- a/packages/agents-client/src/admin-types.ts
+++ b/packages/agents-client/src/admin-types.ts
@@ -1,5 +1,50 @@
-import type { PageOptions } from "./types";
+import type {
+  AddressBindings, AdminauditOperation, AdminauditPage, AdminRuntimeObservationDetail, AdminSessionArchiveRequest, AdminSummaryResponse,
+  AdminSummaryRow, EnvironmentExecutorCredentialRequest, Installation, InstallationConfiguration, InstallationSetting, IssuedAPIKey,
+  IssuedExecutorCredential as IssuedExecutorCredentialResource, ManagedArchive, Project, ProjectAPIKeyRequest, ProjectRequest, ProjectsAPIKey,
+  ResourceOwner, WriteauditAPIKey, WriteauditOperation, WriteauditOperationResourceType, WriteauditPage,
+} from "./generated/core-api";
+import type { PageOptions, RuntimeObservation } from "./types";
 
+export type { ExecutorConnection, ExecutorCredential, ExecutorCredentialList, RuntimeDiskObservation } from "./generated/core-api";
+export { writeauditOperationResourceTypeValues as adminResourceTypes } from "./generated/core-api";
+
+// Generated types keep their schema names in ./generated/core-api; these are the client's names for them.
+export type AdminProject = Project;
+export type CreateAdminProjectInput = ProjectRequest;
+export type RenameAdminProjectInput = ProjectRequest;
+export type AdminAPIKey = ProjectsAPIKey;
+export type AdminIssuedAPIKey = IssuedAPIKey;
+export type IssueAdminAPIKeyInput = ProjectAPIKeyRequest;
+export type ArchiveAdminSessionInput = AdminSessionArchiveRequest;
+/** Current resource disposition; released does not imply that the active Turn has finalized. */
+export type AdminSessionArchive = ManagedArchive;
+export type AdminResourceType = WriteauditOperationResourceType;
+export type AdminKeyProvenance = WriteauditAPIKey;
+/** `api_key` is null when Core has no creation record. */
+export type AdminResourceOwner = ResourceOwner;
+export type AdminWriteOperation = WriteauditOperation;
+export type AdminWriteOperationPage = WriteauditPage;
+export type AdminSummaryEntry = AdminSummaryRow;
+export type AdminSummary = AdminSummaryResponse;
+export type AdminAuditEntry = AdminauditOperation;
+export type AdminAuditPage = AdminauditPage;
+/** `key_id` is chosen by the caller, so an uncertain issuance can be reissued with the same ID and `rotate: true`. */
+export type IssueExecutorCredentialInput = EnvironmentExecutorCredentialRequest;
+// This route always restricts the credential to its Environment, so environment_id is always present.
+export type IssuedExecutorCredential = Required<IssuedExecutorCredentialResource>;
+export type CoreAddressBindings = AddressBindings;
+export type CoreInstallationSetting = InstallationSetting;
+export type CoreInstallationConfiguration = InstallationConfiguration;
+export type CoreInstallation = Installation;
+
+// The schema's flat observation cannot state each mode's null rules; the client's RuntimeObservation union does.
+export interface AdminRuntimeObservation {
+  project_id: string;
+  observation: RuntimeObservation & Pick<AdminRuntimeObservationDetail, "disk">;
+}
+
+// Call options and receipts the client composes; they are not schema definitions.
 export interface AdminClientOptions {
   /** Prefix that request paths are appended to; defaults to `/core/v1`. */
   baseUrl?: string;
@@ -8,88 +53,12 @@ export interface AdminClientOptions {
   /** Fetch implementation; defaults to the global fetch. */
   fetch?: typeof fetch;
 }
-
-export interface AdminProject {
-  id: string;
-  name: string;
-  created_at: string;
-  archived_at: string | null;
-  active_key_count: number;
-}
-export interface CreateAdminProjectInput { name: string }
-export interface RenameAdminProjectInput { name: string }
-export interface AdminAPIKey {
-  id: string;
-  project_id: string;
-  name: string;
-  prefix: string;
-  created_at: string;
-  revoked_at: string | null;
-}
-export interface AdminIssuedAPIKey extends AdminAPIKey { key: string }
-export interface IssueAdminAPIKeyInput { name: string }
+/** The project and key pages; the schema repeats this envelope for each. */
 export interface AdminPage<T> { data: T[]; has_more: boolean }
+/** Deletion receipts of the `/v1` objects administrators delete; `deleted` is always true. */
 export interface AdminDeleted<O extends string = string> { id: string; object: O; deleted: true }
-export interface ArchiveAdminSessionInput { expected_generation: number }
-/** Current resource disposition; released does not imply that the active Turn has finalized. */
-export interface AdminSessionArchive {
-  session_id: string;
-  environment_id: string;
-  state: "active" | "cleanup_pending" | "released";
-}
-export interface Skill {
-  id: string;
-  object: "skill";
-  created_at: number;
-  name: string;
-  description: string;
-  default_version: string;
-  latest_version: string;
-}
-export interface SkillVersion {
-  id: string;
-  object: "skill.version";
-  created_at: number;
-  skill_id: string;
-  version: string;
-  name: string;
-  description: string;
-}
-export interface SessionArtifact {
-  id: string;
-  object: "agent.session.artifact";
-  created_at: number;
-  environment_id: string;
-  path: string;
-  session_id: string;
-  size_bytes: number;
-  turn_id: string;
-}
+/** A downloaded body; it is not JSON. */
 export interface AdminContent { blob: Blob; contentType: string | null; contentDisposition: string | null }
-export type AdminResourceType = "agent" | "skill" | "environment_template" | "file" | "vault" | "credential" | "session" | "environment" | "skill_version" | "artifact";
-export interface AdminKeyProvenance {
-  id: string;
-  name: string;
-  prefix: string;
-  kind: "issued";
-  revoked_at: string | null;
-}
-/** `api_key` is null when Core has no creation record. */
-export interface AdminResourceOwner {
-  resource_id: string;
-  api_key: AdminKeyProvenance | null;
-}
-export interface AdminWriteOperation {
-  id: string;
-  created_at: string;
-  api_key: AdminKeyProvenance | null;
-  action: string;
-  resource_type: AdminResourceType;
-  resource_id: string;
-  parent_id: string;
-  request_id: string;
-  trace_id: string;
-}
 export interface AdminWriteOperationOptions extends Omit<PageOptions, "order"> {
   key_id?: string;
   resource_type?: AdminResourceType;
@@ -97,113 +66,14 @@ export interface AdminWriteOperationOptions extends Omit<PageOptions, "order"> {
   created_after?: string;
   created_before?: string;
 }
-export interface AdminWriteOperationPage extends AdminPage<AdminWriteOperation> { next_cursor: string }
-
 export interface AdminSummaryOptions extends PageOptions {
   project_id?: string;
   group_by?: "project" | "agent" | "key";
   created_after?: string;
   created_before?: string;
 }
-export interface AdminSummaryEntry {
-  project_id: string;
-  /** Session creation provenance for key grouping; null includes unknown creators. */
-  key_id: string | null;
-  agent_id: string | null;
-  assets: { agents: number; skills: number; environment_templates: number; files: number; vaults: number; credentials: number } | null;
-  sessions: { total: number; idle: number; in_progress: number; requires_action: number; failed: number };
-  usage: import("./types").TokenUsage;
-  coverage: { measured_sessions: number; total_sessions: number; ratio: number | null };
-  last_active_at: number | null;
-}
-export interface AdminSummary extends AdminPage<AdminSummaryEntry> { next_cursor: string }
-/** Current disk usage and capacity; E2B reports them, Docker and microsandbox return null. */
-export interface RuntimeDiskObservation { usage_bytes: number | null; limit_bytes: number | null }
-/** The administrator list adds disk to the project observation shape. */
-export interface AdminRuntimeObservation {
-  project_id: string;
-  observation: import("./types").RuntimeObservation & { disk: RuntimeDiskObservation | null };
-}
-
 export interface AdminAuditOptions extends Omit<AdminWriteOperationOptions, "resource_type" | "key_id"> {
   project_id?: string;
   action?: string;
   resource_type?: string;
 }
-export interface AdminAuditEntry {
-  id: string;
-  created_at: string;
-  admin_credential_id: string;
-  actor_label: string;
-  action: string;
-  /** Null for deployment-wide writes, such as deployment default model providers. */
-  project_id: string | null;
-  resource_type: string;
-  resource_id: string;
-  request_id: string;
-  trace_id: string;
-}
-export interface AdminAuditPage extends AdminPage<AdminAuditEntry> { next_cursor: string }
-
-/** Executor credential metadata for one self_hosted environment; the credential itself is never listed. */
-export interface ExecutorCredential { key_id: string; created_at: string; revoked_at: string | null }
-/** Core authority plus a matching live gateway peer; timestamps alone are not readiness. */
-export interface ExecutorConnection {
-  status: "never_enrolled" | "connected" | "disconnected";
-  bound_key_id: string | null;
-  enrolled_at: string | null;
-  last_seen_at: string | null;
-}
-export interface ExecutorCredentialList { data: ExecutorCredential[]; connection: ExecutorConnection }
-
-/** `key_id` is chosen by the caller, so an uncertain issuance can be reissued with the same ID and `rotate: true`. */
-export interface IssueExecutorCredentialInput { key_id: string; rotate?: boolean }
-/** Returned once, on issuance or rotation. */
-export interface IssuedExecutorCredential { key_id: string; environment_id: string; executor_token: string }
-
-/** What is bound to the installation public URL; a change of that URL affects all of it. */
-export interface CoreAddressBindings {
-  /** Enrolled nodes that are not removed. */
-  nodes: number;
-  /** Nodes enrolled with another address; they receive no new sandboxes until re-added. At most `nodes`. */
-  nodes_on_other_address: number;
-  /** Retained and pending hosted sandboxes, which were started with the address current at the time. */
-  hosted_sandboxes: number;
-  /** Unrevoked self-hosted executor credentials, whose executors were installed with an advertised remote_url. */
-  self_hosted_executors: number;
-}
-/** One process setting from the installation's config.json, as last applied. */
-export interface CoreInstallationSetting {
-  /** Dotted config.json key, such as `ports.core`. Unique within the snapshot. */
-  key: string;
-  /** Applied JSON value; always null for a sensitive setting. */
-  value: unknown;
-  default: unknown;
-  /** Present exactly for a sensitive setting: whether it has a value. */
-  configured?: boolean;
-  /** False for settings fixed at installation. */
-  changeable: boolean;
-  sensitive: boolean;
-  /** Services that restart when the setting changes. */
-  restarts: ("core" | "web" | "database")[];
-}
-/** The process settings Core loaded. */
-export interface CoreInstallationConfiguration {
-  settings: CoreInstallationSetting[];
-}
-/** `GET /core/v1/installation`: available before any sandbox deployment exists. */
-export interface CoreInstallation {
-  object: "core.installation";
-  installation_id: string;
-  /** The origin applications, nodes, sandboxes and self-hosted executors use. */
-  public_url: string;
-  /** `public_url` followed by `/v1`; the base URL for application API keys. */
-  api_base_url: string;
-  /** True when `public_url` is a loopback origin that only the Core host reaches. */
-  local_only: boolean;
-  /** Full source commit Core was built from; null for development builds. */
-  source_commit: string | null;
-  /** The process settings Core loaded. */
-  configuration: CoreInstallationConfiguration;
-  address_bindings: CoreAddressBindings;
-}
diff --git a/packages/agents-client/src/client.ts b/packages/agents-client/src/client.ts
index aac1fd365..5beb09c3a 100644
--- a/packages/agents-client/src/client.ts
+++ b/packages/agents-client/src/client.ts
@@ -23,6 +23,10 @@ import {
   textFormatResourceFields, textResourceFields, vaultCredentialResourceFields, vaultListResourceFields, vaultResourceFields,
   verbosityResourceValues,
 } from "./generated/public-api";
+import {
+  runtimeCPUObservationFields, runtimeInstanceFields, runtimeMemoryObservationFields, runtimeObservationFields,
+  runtimeObservationLifecycleStateValues, runtimeObservationModeValues, runtimeObservationReasonValues, runtimeObservationStatusValues,
+} from "./generated/core-api";
 import { projectTokenUsage } from "./usage-projection";
 import { projectAgentTurn, projectSessionItem, projectItemContent, projectHistoryPage } from "./history-projection";
 import { projectOpenAIHostedSessionEnvironment } from "./session-environment-projection";
@@ -240,19 +244,7 @@ const maxSourceFileListLimit = 10000;
 const unsafeUnknownEventFields = new Set([
   "session", "turn", "turn_id", "item", "item_id", "output_index", "content_index", "part", "delta", "text", "error", "environment",
 ]);
-const runtimeObservationFields = new Set([
-  "id", "object", "session_id", "environment_id", "mode", "provider_type", "instance", "status", "reason",
-  "lifecycle_state", "allocation_created_at", "resolved_at", "observed_at", "started_at", "cpu", "memory",
-]);
-const runtimeInstanceFields = new Set(["kind", "allocation_id", "device_id", "connection_generation"]);
-const runtimeCPUFields = new Set(["usage_seconds_total", "capacity_cores", "usage_cores", "utilization_ratio"]);
-const runtimeMemoryFields = new Set(["usage_bytes", "limit_bytes"]);
-const runtimeObservationReasons = new Set([
-  "runtime_mode_not_observable", "allocation_pending", "runtime_not_running",
-  "sample_timeout", "sample_unavailable",
-]);
 const runtimeProviderTypePattern = /^[a-z][a-z0-9_]{0,31}$/;
-const runtimeLifecycleStates = new Set(["active", "sleeping", "transitioning", "pending", "stopped"]);
 function invalidSessionInputBatch(): never {
   throw new TypeError("Invalid Session input event batch.");
 }
@@ -886,15 +878,13 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
     id === null || sessionId === null || id !== sessionId ||
     (expectedSessionId !== undefined && !sameUuid(sessionId, expectedSessionId)) ||
     value.object !== "agent.runtime_observation" ||
-    (value.mode !== "none" && value.mode !== "self_hosted" && value.mode !== "openai_hosted") ||
+    !isOneOf(runtimeObservationModeValues, value.mode) ||
     !(value.provider_type === null || (
       typeof value.provider_type === "string" && runtimeProviderTypePattern.test(value.provider_type)
     )) ||
     !isRecord(value.instance) || !exactFields(value.instance, runtimeInstanceFields) ||
-    (value.status !== "observed" && value.status !== "unsupported" && value.status !== "unavailable") ||
-    !(value.reason === null || (
-      typeof value.reason === "string" && runtimeObservationReasons.has(value.reason)
-    )) ||
+    !isOneOf(runtimeObservationStatusValues, value.status) ||
+    !(value.reason === null || isOneOf(runtimeObservationReasonValues, value.reason)) ||
     !isNonnegativeInteger(value.resolved_at)
   ) return invalidRuntimeObservation();
 
@@ -927,7 +917,7 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
     )) ||
     (isManaged && (
       value.instance.kind !== "managed_allocation" || environmentId === null || connectionGeneration !== null ||
-      !runtimeLifecycleStates.has(String(value.lifecycle_state)) ||
+      !isOneOf(runtimeObservationLifecycleStateValues, value.lifecycle_state) ||
       (allocationId === null && (deviceId !== null || allocationCreatedAt !== null))
     ))
   ) return invalidRuntimeObservation();
@@ -953,7 +943,7 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
 
   let cpu: RuntimeObservation["cpu"] = null;
   if (value.cpu !== null) {
-    if (!observed || !isRecord(value.cpu) || !exactFields(value.cpu, runtimeCPUFields)) {
+    if (!observed || !isRecord(value.cpu) || !exactFields(value.cpu, runtimeCPUObservationFields)) {
       return invalidRuntimeObservation();
     }
     cpu = {
@@ -970,7 +960,7 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
 
   let memory: RuntimeObservation["memory"] = null;
   if (value.memory !== null) {
-    if (!observed || !isRecord(value.memory) || !exactFields(value.memory, runtimeMemoryFields)) {
+    if (!observed || !isRecord(value.memory) || !exactFields(value.memory, runtimeMemoryObservationFields)) {
       return invalidRuntimeObservation();
     }
     memory = {
diff --git a/packages/agents-client/src/core-metrics.ts b/packages/agents-client/src/core-metrics.ts
index d1b14ceeb..43cd21e9e 100644
--- a/packages/agents-client/src/core-metrics.ts
+++ b/packages/agents-client/src/core-metrics.ts
@@ -1,111 +1,25 @@
 import { AgentCoreError } from "./client";
 import { CoreRequester, type CoreClientOptions } from "./core-request";
+import { isOneOf } from "./response-projection";
 import type { ReadOptions } from "./types";
+import { jobStatusValues, serviceStateStatusValues, type CoremetricsView, type JobStatus, type Latency, type ServiceState, type ServiceStateStatus } from "./generated/core-api";
 
 function invalidCoreMetrics(): never {
   throw new AgentCoreError("Core metrics: the response is not JSON.", 0, "invalid_response");
 }
 
+export type CoreMetricsRange = "1h" | "6h" | "24h" | "7d";
+export type CoreJobStatus = JobStatus;
 /**
  * Core's own health as the one `oac-core` process sees it: execution slots
  * and the Turn queue (a Postgres table polled by the worker), connected
  * daemons, the PostgreSQL database, background jobs and the process itself.
  * `GET /core/v1/metrics`, defined in
  * contracts/agents-api/core-metrics.md; every figure Core cannot measure is
- * null, never zero.
+ * null, never zero. The client reads a service status it does not recognise
+ * as `unknown`, which is never shown as running.
  */
-export type CoreMetricsRange = "1h" | "6h" | "24h" | "7d";
-export type CoreJobStatus = "ok" | "failing" | "stopped" | "unknown";
-
-export interface CoreLatency {
-  p50: number | null;
-  p95: number | null;
-}
-
-export interface CoreExecutionBucket {
-  start: string;
-  /** Highest queued Turn count seen in the bucket. */
-  queued: number | null;
-  /** Highest in-progress Turn count seen in the bucket. */
-  in_progress: number | null;
-  queue_wait_p95_ms: number | null;
-}
-
-export interface CoreDatabaseBucket {
-  start: string;
-  ping_p95_ms: number | null;
-  pool_in_use: number | null;
-}
-
-export interface CoreProcessBucket {
-  start: string;
-  /** Highest CPU use observed in the bucket, in cores. */
-  cpu_cores: number | null;
-  /** Highest resident memory observed in the bucket. */
-  rss_bytes: number | null;
-}
-
-export interface CoreJob {
-  /** `scheduler`, `runtime_sampler`, `history_cleanup`, `audit_cleanup`, or another bounded name. */
-  id: string;
-  status: CoreJobStatus;
-  last_run_at: string | null;
-  /** Items the last run handled (Turns dispatched, Runtimes sampled, rows removed). */
-  processed: number | null;
-  failed: number | null;
-}
-
-export interface CoreMetrics {
-  object: "core.metrics";
-  range: { start: string; end: string; resolution_seconds: number };
-  service: {
-    /** `unknown` stands for a status this client does not recognise; it is never shown as running. */
-    status: "running" | "degraded" | "unknown";
-    /** Build revision (source commit) of the running Core. */
-    revision: string | null;
-    started_at: string | null;
-    /** Whether this process holds the database's execution lease. */
-    execution_owner: boolean | null;
-  };
-  execution: {
-    slots_in_use: number;
-    slots_total: number;
-    queued_turns: number | null;
-    /** Queued Turns whose Session has no connected daemon (part of queued_turns). */
-    waiting_for_daemon: number | null;
-    in_progress_turns: number | null;
-    oldest_queued_seconds: number | null;
-    connected_daemons: number;
-    /** Turns failed with execution_interrupted in the range. */
-    interrupted: number | null;
-    /** Requests refused with execution_unavailable in the range. */
-    unavailable: number | null;
-    queue_wait_ms: CoreLatency;
-    series: CoreExecutionBucket[];
-  };
-  database: {
-    ping_ms: CoreLatency;
-    pool: { in_use: number | null; idle: number | null; max: number | null };
-    size_bytes: number | null;
-    series: CoreDatabaseBucket[];
-  };
-  jobs: CoreJob[];
-  process: {
-    /** Go heap in use (runtime.MemStats.Alloc), not resident memory. */
-    memory_bytes: number | null;
-    goroutines: number | null;
-    /**
-     * CPU used over the last sample interval, in cores; the CPU available to
-     * the process; resident memory; its memory limit; and a series
-     * (contracts/agents-api/core-metrics.md). Null when Core cannot measure them.
-     */
-    cpu_cores: number | null;
-    cpu_limit_cores: number | null;
-    rss_bytes: number | null;
-    memory_limit_bytes: number | null;
-    series: CoreProcessBucket[];
-  };
-}
+export type CoreMetrics = Omit<CoremetricsView, "service"> & { service: Omit<ServiceState, "status"> & { status: ServiceStateStatus | "unknown" } };
 
 type Json = Record<string, unknown>;
 
@@ -138,13 +52,11 @@ function list<T>(value: unknown, item: (entry: Json, index: number) => T, path:
   return value.map((entry, index) => item(record(entry, `${path}[${index}]`), index));
 }
 
-function latency(value: unknown): CoreLatency {
+function latency(value: unknown): Latency {
   const entry = optional(value);
   return { p50: number(entry.p50), p95: number(entry.p95) };
 }
 
-const jobStatuses = new Set<CoreJobStatus>(["ok", "failing", "stopped", "unknown"]);
-
 /** Validates the envelope and normalises every missing figure to null. */
 export function projectCoreMetrics(value: unknown): CoreMetrics {
   const body = record(value, "response");
@@ -155,7 +67,7 @@ export function projectCoreMetrics(value: unknown): CoreMetrics {
   const database = optional(body.database);
   const pool = optional(database.pool);
   const process = optional(body.process);
-  const status = service.status === "running" || service.status === "degraded" ? service.status : "unknown";
+  const status = isOneOf(serviceStateStatusValues, service.status) ? service.status : "unknown";
   const resolution = number(range.resolution_seconds);
   if (resolution === null || resolution <= 0) throw new AgentCoreError("Core metrics: range.resolution_seconds is missing.", 0, "invalid_response");
   return {
@@ -197,7 +109,7 @@ export function projectCoreMetrics(value: unknown): CoreMetrics {
     },
     jobs: list(body.jobs, (entry, index) => ({
       id: String(entry.id ?? index),
-      status: jobStatuses.has(entry.status as CoreJobStatus) ? entry.status as CoreJobStatus : "unknown",
+      status: isOneOf(jobStatusValues, entry.status) ? entry.status : "unknown",
       last_run_at: text(entry.last_run_at),
       processed: number(entry.processed),
       failed: number(entry.failed),
diff --git a/packages/agents-client/src/execution-configuration-projection.ts b/packages/agents-client/src/execution-configuration-projection.ts
index 577a2fd36..efaca3016 100644
--- a/packages/agents-client/src/execution-configuration-projection.ts
+++ b/packages/agents-client/src/execution-configuration-projection.ts
@@ -1,27 +1,29 @@
 import { modelProviderProtocols } from "./harness-catalog";
-import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
 import { modelProviderViewFields } from "./generated/public-api";
-import type { ExecutionConfigurationSource, ModelProviderView, SessionExecutionConfiguration } from "./types";
+import {
+  executionHarnessConfigSelectionFields, executionProviderSelectionFields, executionSelectionFields, executionSelectionSourceValues,
+  sessionExecutionConfigurationFields, type ExecutionSelectionSource,
+} from "./generated/core-api";
+import { canonicalUuid, exactFields, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import type { ModelProviderView, SessionExecutionConfiguration } from "./types";
 
 type Invalid = () => never;
-const sources = new Set(["session", "agent", "deployment", "unknown"]);
-const selectionFields = new Set(["value", "source"]);
 const protocols: ReadonlySet<unknown> = new Set(modelProviderProtocols);
 
 function selection(value: unknown, invalid: Invalid): SessionExecutionConfiguration["model"] {
-  if (!isRecord(value) || !exactFields(value, selectionFields) || !sources.has(String(value.source)) ||
+  if (!isRecord(value) || !exactFields(value, executionSelectionFields) || !isOneOf(executionSelectionSourceValues, value.source) ||
     (value.value !== null && (typeof value.value !== "string" || value.value.length === 0)) ||
     (value.value === null && value.source !== "unknown")) return invalid();
-  return { value: value.value as string | null, source: value.source as ExecutionConfigurationSource };
+  return { value: value.value as string | null, source: value.source as ExecutionSelectionSource };
 }
 
 // Splits an absolute URL as RFC 3986 appendix B does, without parsing its host.
 const baseURLPattern = /^https:\/\/([^/?#]*)[^?#]*(?:\?([^#]*))?(?:#([\s\S]*))?$/iu;
 
 /**
- * Checks a stored base URL no more strictly than Core's write rule: HTTPS with a
- * host and no credentials, query or fragment. Host syntax is Core's to enforce;
- * a value an earlier Core accepted must not fail a whole list.
+ * Checks a stored base URL as Core's write rule does, never more strictly:
+ * HTTPS with a host and no credentials, query or fragment. Host syntax is
+ * Core's to enforce, so one stored value never fails a whole list.
  */
 function safeBaseURL(value: string): boolean {
   const match = baseURLPattern.exec(value);
@@ -48,13 +50,13 @@ export function safeProvider(value: unknown, invalid: Invalid): ModelProviderVie
 }
 
 export function projectExecutionConfiguration(value: unknown, sessionId: string, invalid: Invalid): SessionExecutionConfiguration {
-  if (!isRecord(value) || !exactFields(value, new Set(["object", "schema_version", "session_id", "model", "harness", "model_provider", "harness_config"])) ||
+  if (!isRecord(value) || !exactFields(value, sessionExecutionConfigurationFields) ||
     value.object !== "agent.session.execution_configuration" || value.schema_version !== 1 ||
     typeof value.session_id !== "string" || !canonicalUuid(value.session_id) || !sameResourceId(value.session_id, sessionId) ||
-    !isRecord(value.model_provider) || !exactFields(value.model_provider, new Set(["source", "status", "configuration"]))) return invalid();
+    !isRecord(value.model_provider) || !exactFields(value.model_provider, executionProviderSelectionFields)) return invalid();
   const native = value.harness_config;
-  if (!isRecord(native) || !exactFields(native, selectionFields) || !isRecord(native.value) ||
-    !sources.has(String(native.source)) || (native.source === "unknown" && Object.keys(native.value).length !== 0)) return invalid();
+  if (!isRecord(native) || !exactFields(native, executionHarnessConfigSelectionFields) || !isRecord(native.value) ||
+    !isOneOf(executionSelectionSourceValues, native.source) || (native.source === "unknown" && Object.keys(native.value).length !== 0)) return invalid();
   const provider = value.model_provider;
   let configuration: ModelProviderView | null = null;
   if (provider.status === "available" && (provider.source === "session" || provider.source === "agent" || provider.source === "deployment")) {
@@ -64,7 +66,7 @@ export function projectExecutionConfiguration(value: unknown, sessionId: string,
   return {
     object: "agent.session.execution_configuration", schema_version: 1, session_id: value.session_id,
     model: selection(value.model, invalid), harness: selection(value.harness, invalid),
-    harness_config: { value: { ...native.value }, source: native.source as ExecutionConfigurationSource },
-    model_provider: { source: provider.source as ExecutionConfigurationSource, status: provider.status as SessionExecutionConfiguration["model_provider"]["status"], configuration },
+    harness_config: { value: { ...native.value }, source: native.source as ExecutionSelectionSource },
+    model_provider: { source: provider.source as ExecutionSelectionSource, status: provider.status as SessionExecutionConfiguration["model_provider"]["status"], configuration },
   };
 }
diff --git a/packages/agents-client/src/generated/core-api.ts b/packages/agents-client/src/generated/core-api.ts
new file mode 100644
index 000000000..b930cfad5
--- /dev/null
+++ b/packages/agents-client/src/generated/core-api.ts
@@ -0,0 +1,907 @@
+// Code generated by scripts/generate-public-api.py from contracts/agents-api/core.openapi.yaml; DO NOT EDIT.
+import type { ModelProviderInput, ModelProviderView, TokenUsageResource } from "./public-api";
+
+export interface AddressBindings {
+  hosted_sandboxes: number;
+  nodes: number;
+  nodes_on_other_address: number;
+  self_hosted_executors: number;
+}
+export const addressBindingsFields = ["hosted_sandboxes", "nodes", "nodes_on_other_address", "self_hosted_executors"] as const;
+export interface AdminAssetCounts {
+  agents: number;
+  credentials: number;
+  environment_templates: number;
+  files: number;
+  skills: number;
+  vaults: number;
+}
+export const adminAssetCountsFields = ["agents", "credentials", "environment_templates", "files", "skills", "vaults"] as const;
+export interface AdminRuntimeObservation {
+  observation: AdminRuntimeObservationDetail;
+  project_id: string;
+}
+export const adminRuntimeObservationFields = ["observation", "project_id"] as const;
+export interface AdminRuntimeObservationDetail {
+  allocation_created_at: number | null;
+  cpu: RuntimeCPUObservation | null;
+  disk: RuntimeDiskObservation | null;
+  environment_id: string | null;
+  id: string;
+  instance: RuntimeInstance;
+  lifecycle_state: AdminRuntimeObservationDetailLifecycleState | null;
+  memory: RuntimeMemoryObservation | null;
+  mode: AdminRuntimeObservationDetailMode;
+  object: "agent.runtime_observation";
+  observed_at: number | null;
+  provider_type: string | null;
+  reason: AdminRuntimeObservationDetailReason | null;
+  resolved_at: number;
+  session_id: string;
+  started_at: number | null;
+  status: AdminRuntimeObservationDetailStatus;
+}
+export const adminRuntimeObservationDetailFields = ["allocation_created_at", "cpu", "disk", "environment_id", "id", "instance", "lifecycle_state", "memory", "mode", "object", "observed_at", "provider_type", "reason", "resolved_at", "session_id", "started_at", "status"] as const;
+export const adminRuntimeObservationDetailLifecycleStateValues = ["active", "sleeping", "transitioning", "pending", "stopped"] as const;
+export type AdminRuntimeObservationDetailLifecycleState = (typeof adminRuntimeObservationDetailLifecycleStateValues)[number];
+export const adminRuntimeObservationDetailModeValues = ["none", "self_hosted", "openai_hosted"] as const;
+export type AdminRuntimeObservationDetailMode = (typeof adminRuntimeObservationDetailModeValues)[number];
+export const adminRuntimeObservationDetailReasonValues = ["runtime_mode_not_observable", "allocation_pending", "runtime_not_running", "sample_timeout", "sample_unavailable"] as const;
+export type AdminRuntimeObservationDetailReason = (typeof adminRuntimeObservationDetailReasonValues)[number];
+export const adminRuntimeObservationDetailStatusValues = ["observed", "unsupported", "unavailable"] as const;
+export type AdminRuntimeObservationDetailStatus = (typeof adminRuntimeObservationDetailStatusValues)[number];
+export interface AdminRuntimeObservationList {
+  data: AdminRuntimeObservation[];
+  first_id: string | null;
+  has_more: boolean;
+  last_id: string | null;
+  object: "list";
+}
+export const adminRuntimeObservationListFields = ["data", "first_id", "has_more", "last_id", "object"] as const;
+export interface AdminSessionArchiveRequest {
+  expected_generation: number;
+}
+export const adminSessionArchiveRequestFields = ["expected_generation"] as const;
+export interface AdminSessionCounts {
+  failed: number;
+  idle: number;
+  in_progress: number;
+  requires_action: number;
+  total: number;
+}
+export const adminSessionCountsFields = ["failed", "idle", "in_progress", "requires_action", "total"] as const;
+export interface AdminSummaryResponse {
+  data: AdminSummaryRow[];
+  has_more: boolean;
+  next_cursor: string;
+}
+export const adminSummaryResponseFields = ["data", "has_more", "next_cursor"] as const;
+export interface AdminSummaryRow {
+  agent_id: string | null;
+  assets: AdminAssetCounts | null;
+  coverage: AdminUsageCoverage;
+  key_id: string | null;
+  last_active_at: number | null;
+  project_id: string;
+  sessions: AdminSessionCounts;
+  usage: TokenUsageResource;
+}
+export const adminSummaryRowFields = ["agent_id", "assets", "coverage", "key_id", "last_active_at", "project_id", "sessions", "usage"] as const;
+export interface AdminUsageCoverage {
+  measured_sessions: number;
+  ratio: number | null;
+  total_sessions: number;
+}
+export const adminUsageCoverageFields = ["measured_sessions", "ratio", "total_sessions"] as const;
+export interface AdminauditOperation {
+  action: string;
+  actor_label: string;
+  admin_credential_id: string;
+  created_at: string;
+  id: string;
+  project_id: string | null;
+  request_id: string;
+  resource_id: string;
+  resource_type: string;
+  trace_id: string;
+}
+export const adminauditOperationFields = ["action", "actor_label", "admin_credential_id", "created_at", "id", "project_id", "request_id", "resource_id", "resource_type", "trace_id"] as const;
+export interface AdminauditPage {
+  data: AdminauditOperation[];
+  has_more: boolean;
+  next_cursor: string;
+}
+export const adminauditPageFields = ["data", "has_more", "next_cursor"] as const;
+export interface ConfigurationDiscoveryInput {
+  configuration?: Record<string, unknown>;
+  credential?: Record<string, unknown>;
+  query?: Record<string, unknown>;
+}
+export const configurationDiscoveryInputFields = ["configuration", "credential", "query"] as const;
+export const configurationDiscoveryInputRequired = [] as const;
+export interface CoreAPIError {
+  code?: string | null;
+  details?: Record<string, unknown>;
+  message: string;
+  param?: string | null;
+  type: string;
+}
+export const coreAPIErrorFields = ["code", "details", "message", "param", "type"] as const;
+export const coreAPIErrorRequired = ["message", "type"] as const;
+export interface CoreErrorResponse {
+  error: CoreAPIError;
+}
+export const coreErrorResponseFields = ["error"] as const;
+export interface CoreHarness {
+  default: boolean;
+  enabled: boolean;
+  id: CoreHarnessId;
+  model_configuration: HarnessModelConfiguration | null;
+  model_configuration_support: ModelConfigurationSupport;
+  object: "core.harness";
+}
+export const coreHarnessFields = ["default", "enabled", "id", "model_configuration", "model_configuration_support", "object"] as const;
+export const coreHarnessIdValues = ["claude_sdk", "codex", "mcode"] as const;
+export type CoreHarnessId = (typeof coreHarnessIdValues)[number];
+export interface CoreHarnessList {
+  data: CoreHarness[];
+  object: "list";
+}
+export const coreHarnessListFields = ["data", "object"] as const;
+export interface CoremetricsView {
+  database: Database;
+  execution: Execution;
+  jobs: Job[];
+  object: "core.metrics";
+  process: Process;
+  range: Range;
+  service: ServiceState;
+}
+export const coremetricsViewFields = ["database", "execution", "jobs", "object", "process", "range", "service"] as const;
+export interface Database {
+  ping_ms: Latency;
+  pool: Pool;
+  series: DatabaseBucket[];
+  size_bytes: number | null;
+}
+export const databaseFields = ["ping_ms", "pool", "series", "size_bytes"] as const;
+export interface DatabaseBucket {
+  ping_p95_ms: number | null;
+  pool_in_use: number | null;
+  start: string;
+}
+export const databaseBucketFields = ["ping_p95_ms", "pool_in_use", "start"] as const;
+export interface DeploymentResources {
+  allocations: number;
+  pending: number;
+}
+export const deploymentResourcesFields = ["allocations", "pending"] as const;
+export interface DeploymentSpec {
+  resources: SandboxResources;
+  runtime?: RuntimeRelease;
+}
+export const deploymentSpecFields = ["resources", "runtime"] as const;
+export const deploymentSpecRequired = ["resources"] as const;
+export interface DeploymentView {
+  configuration?: Record<string, unknown>;
+  core_url: string;
+  credential_configured: boolean;
+  generation: number;
+  installation_id: string;
+  metadata?: Record<string, unknown>;
+  mode: DeploymentViewMode;
+  owner_epoch: number;
+  provider: string;
+  reset: Reset | null;
+  resources: DeploymentResources;
+  rollout: Rollout;
+  specification?: DeploymentSpec;
+  specification_digest?: string;
+  suspension: Suspension | null;
+}
+export const deploymentViewFields = ["configuration", "core_url", "credential_configured", "generation", "installation_id", "metadata", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "specification", "specification_digest", "suspension"] as const;
+export const deploymentViewRequired = ["core_url", "credential_configured", "generation", "installation_id", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "suspension"] as const;
+export const deploymentViewModeValues = ["", "nodes", "direct"] as const;
+export type DeploymentViewMode = (typeof deploymentViewModeValues)[number];
+export interface DiagnosticFailure {
+  code: DiagnosticFailureCode;
+  failed_at: string | null;
+  params: Record<string, unknown>;
+}
+export const diagnosticFailureFields = ["code", "failed_at", "params"] as const;
+export const diagnosticFailureCodeValues = ["harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error", "environment_connection_timeout", "environment_unavailable", "environment_provisioning_failed", "authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed"] as const;
+export type DiagnosticFailureCode = (typeof diagnosticFailureCodeValues)[number];
+export interface EnvironmentExecutorCredentialRequest {
+  key_id: string;
+  rotate?: boolean;
+}
+export const environmentExecutorCredentialRequestFields = ["key_id", "rotate"] as const;
+export const environmentExecutorCredentialRequestRequired = ["key_id"] as const;
+export interface Execution {
+  connected_daemons: number;
+  in_progress_turns: number | null;
+  interrupted: number | null;
+  oldest_queued_seconds: number | null;
+  queue_wait_ms: Latency;
+  queued_turns: number | null;
+  series: ExecutionBucket[];
+  slots_in_use: number;
+  slots_total: number;
+  unavailable: number | null;
+  waiting_for_daemon: number | null;
+}
+export const executionFields = ["connected_daemons", "in_progress_turns", "interrupted", "oldest_queued_seconds", "queue_wait_ms", "queued_turns", "series", "slots_in_use", "slots_total", "unavailable", "waiting_for_daemon"] as const;
+export interface ExecutionBucket {
+  in_progress: number | null;
+  queue_wait_p95_ms: number | null;
+  queued: number | null;
+  start: string;
+}
+export const executionBucketFields = ["in_progress", "queue_wait_p95_ms", "queued", "start"] as const;
+export interface ExecutionHarnessConfigSelection {
+  source: ExecutionHarnessConfigSelectionSource;
+  value: Record<string, unknown>;
+}
+export const executionHarnessConfigSelectionFields = ["source", "value"] as const;
+export const executionHarnessConfigSelectionSourceValues = ["session", "agent", "deployment", "unknown"] as const;
+export type ExecutionHarnessConfigSelectionSource = (typeof executionHarnessConfigSelectionSourceValues)[number];
+export interface ExecutionProviderSelection {
+  configuration: ModelProviderView | null;
+  source: ExecutionProviderSelectionSource;
+  status: ExecutionProviderSelectionStatus;
+}
+export const executionProviderSelectionFields = ["configuration", "source", "status"] as const;
+export const executionProviderSelectionSourceValues = ["session", "agent", "deployment", "unknown"] as const;
+export type ExecutionProviderSelectionSource = (typeof executionProviderSelectionSourceValues)[number];
+export const executionProviderSelectionStatusValues = ["available", "redacted", "unavailable"] as const;
+export type ExecutionProviderSelectionStatus = (typeof executionProviderSelectionStatusValues)[number];
+export interface ExecutionSelection {
+  source: ExecutionSelectionSource;
+  value: string | null;
+}
+export const executionSelectionFields = ["source", "value"] as const;
+export const executionSelectionSourceValues = ["session", "agent", "deployment", "unknown"] as const;
+export type ExecutionSelectionSource = (typeof executionSelectionSourceValues)[number];
+export interface ExecutorConnection {
+  bound_key_id: string | null;
+  enrolled_at: string | null;
+  last_seen_at: string | null;
+  status: ExecutorConnectionStatus;
+}
+export const executorConnectionFields = ["bound_key_id", "enrolled_at", "last_seen_at", "status"] as const;
+export const executorConnectionStatusValues = ["never_enrolled", "connected", "disconnected"] as const;
+export type ExecutorConnectionStatus = (typeof executorConnectionStatusValues)[number];
+export interface ExecutorCredential {
+  created_at: string;
+  key_id: string;
+  revoked_at: string | null;
+}
+export const executorCredentialFields = ["created_at", "key_id", "revoked_at"] as const;
+export interface ExecutorCredentialList {
+  connection: ExecutorConnection;
+  data: ExecutorCredential[];
+}
+export const executorCredentialListFields = ["connection", "data"] as const;
+export interface HarnessModelConfiguration {
+  harness: HarnessModelConfigurationHarness;
+  harness_config: Record<string, unknown>;
+  last_error_at: string | null;
+  last_error_code: HarnessModelConfigurationLastErrorCode | null;
+  last_used_at: string | null;
+  model: string;
+  model_provider: ModelProviderView;
+  object: "core.model_configuration";
+  updated_at: string;
+}
+export const harnessModelConfigurationFields = ["harness", "harness_config", "last_error_at", "last_error_code", "last_used_at", "model", "model_provider", "object", "updated_at"] as const;
+export const harnessModelConfigurationHarnessValues = ["claude_sdk", "codex", "mcode"] as const;
+export type HarnessModelConfigurationHarness = (typeof harnessModelConfigurationHarnessValues)[number];
+export const harnessModelConfigurationLastErrorCodeValues = ["authentication_error", "connection_failed", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "resource_not_found", "request_timeout", "invalid_request"] as const;
+export type HarnessModelConfigurationLastErrorCode = (typeof harnessModelConfigurationLastErrorCodeValues)[number];
+export interface HostHistory {
+  points: HostHistoryPoint[];
+  resolution_seconds: number;
+}
+export const hostHistoryFields = ["points", "resolution_seconds"] as const;
+export interface HostHistoryPoint {
+  available_disk_bytes_min: number | null;
+  cpu_utilization_max: number | null;
+  memory_used_bytes_max: number | null;
+  start: string;
+}
+export const hostHistoryPointFields = ["available_disk_bytes_min", "cpu_utilization_max", "memory_used_bytes_max", "start"] as const;
+export interface Installation {
+  address_bindings: AddressBindings;
+  api_base_url: string;
+  configuration: InstallationConfiguration;
+  installation_id: string;
+  local_only: boolean;
+  object: "core.installation";
+  public_url: string;
+  source_commit: string | null;
+}
+export const installationFields = ["address_bindings", "api_base_url", "configuration", "installation_id", "local_only", "object", "public_url", "source_commit"] as const;
+export interface InstallationConfiguration {
+  settings: InstallationSetting[];
+}
+export const installationConfigurationFields = ["settings"] as const;
+export interface InstallationSetting {
+  changeable: boolean;
+  configured?: boolean;
+  default: unknown | null;
+  key: string;
+  restarts: InstallationSettingRestarts[];
+  sensitive: boolean;
+  value: unknown | null;
+}
+export const installationSettingFields = ["changeable", "configured", "default", "key", "restarts", "sensitive", "value"] as const;
+export const installationSettingRequired = ["changeable", "default", "key", "restarts", "sensitive", "value"] as const;
+export const installationSettingRestartsValues = ["core", "web"] as const;
+export type InstallationSettingRestarts = (typeof installationSettingRestartsValues)[number];
+export interface IssuedAPIKey {
+  created_at: string;
+  id: string;
+  key: string;
+  name: string;
+  prefix: string;
+  project_id: string;
+  revoked_at: string | null;
+}
+export const issuedAPIKeyFields = ["created_at", "id", "key", "name", "prefix", "project_id", "revoked_at"] as const;
+export interface IssuedExecutorCredential {
+  environment_id?: string;
+  executor_token: string;
+  key_id: string;
+}
+export const issuedExecutorCredentialFields = ["environment_id", "executor_token", "key_id"] as const;
+export const issuedExecutorCredentialRequired = ["executor_token", "key_id"] as const;
+export interface ItemDiagnosticTiming {
+  completed_at: string | null;
+  item_id: string;
+  observed_duration_ms: number | null;
+  started_at: string;
+}
+export const itemDiagnosticTimingFields = ["completed_at", "item_id", "observed_duration_ms", "started_at"] as const;
+export interface Job {
+  failed: number | null;
+  id: string;
+  last_run_at: string | null;
+  processed: number | null;
+  status: JobStatus;
+}
+export const jobFields = ["failed", "id", "last_run_at", "processed", "status"] as const;
+export const jobStatusValues = ["ok", "failing", "stopped", "unknown"] as const;
+export type JobStatus = (typeof jobStatusValues)[number];
+export interface KeyPage {
+  data: ProjectsAPIKey[];
+  has_more: boolean;
+}
+export const keyPageFields = ["data", "has_more"] as const;
+export interface Latency {
+  p50: number | null;
+  p95: number | null;
+}
+export const latencyFields = ["p50", "p95"] as const;
+export interface ManagedArchive {
+  environment_id: string;
+  session_id: string;
+  state: ManagedArchiveState;
+}
+export const managedArchiveFields = ["environment_id", "session_id", "state"] as const;
+export const managedArchiveStateValues = ["active", "cleanup_pending", "released"] as const;
+export type ManagedArchiveState = (typeof managedArchiveStateValues)[number];
+export interface ModelConfigurationInput {
+  harness_config?: Record<string, unknown>;
+  model: string;
+  model_provider: ModelProviderInput;
+}
+export const modelConfigurationInputFields = ["harness_config", "model", "model_provider"] as const;
+export const modelConfigurationInputRequired = ["model", "model_provider"] as const;
+export interface ModelConfigurationSupport {
+  accepts_harness_config: boolean;
+  protocols: string[];
+  token_limits_required: boolean;
+}
+export const modelConfigurationSupportFields = ["accepts_harness_config", "protocols", "token_limits_required"] as const;
+export interface Node {
+  active: number;
+  available_disk_bytes: number | null;
+  available_memory_bytes: number | null;
+  cleanup_pending: number;
+  core_url: string;
+  cpu_count: number | null;
+  created_at: string;
+  diagnostic?: NodeDiagnostic;
+  enrollment_id: string | null;
+  id: string;
+  last_seen_at: string | null;
+  max_active: number;
+  max_retained: number;
+  name: string;
+  online: boolean;
+  provider: string;
+  provider_ready: boolean;
+  reserved: number;
+  retained: number;
+  rollout: NodeRollout;
+  running: number;
+  snapshots: number;
+}
+export const nodeFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "diagnostic", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeRequired = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export interface NodeAllocation {
+  compute_phase: string;
+  compute_phase_changed_at: string | null;
+  created_at: string;
+  deployment_generation: number;
+  diagnostic: NodeAllocationDiagnostic;
+  environment_id: string;
+  id: string;
+  initialization: string;
+  node_id: string;
+  session_id: string;
+  state: string;
+  tenant_id: string;
+}
+export const nodeAllocationFields = ["compute_phase", "compute_phase_changed_at", "created_at", "deployment_generation", "diagnostic", "environment_id", "id", "initialization", "node_id", "session_id", "state", "tenant_id"] as const;
+export const nodeAllocationDiagnosticValues = ["", "node_unavailable", "resource_missing", "compute_unconfirmed", "ownership_mismatch", "provider_unavailable"] as const;
+export type NodeAllocationDiagnostic = (typeof nodeAllocationDiagnosticValues)[number];
+export interface NodeDetail {
+  active: number;
+  available_disk_bytes: number | null;
+  available_memory_bytes: number | null;
+  cleanup_pending: number;
+  core_url: string;
+  cpu_count: number | null;
+  created_at: string;
+  diagnostic?: NodeDetailDiagnostic;
+  enrollment_id: string | null;
+  history: HostHistory;
+  host: NodeHost;
+  id: string;
+  last_seen_at: string | null;
+  max_active: number;
+  max_retained: number;
+  name: string;
+  online: boolean;
+  provider: string;
+  provider_ready: boolean;
+  reserved: number;
+  retained: number;
+  rollout: NodeRollout;
+  running: number;
+  snapshots: number;
+}
+export const nodeDetailFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "diagnostic", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeDetailRequired = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeDetailDiagnosticValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export type NodeDetailDiagnostic = (typeof nodeDetailDiagnosticValues)[number];
+export const nodeDiagnosticValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export type NodeDiagnostic = (typeof nodeDiagnosticValues)[number];
+export interface NodeHost {
+  available_disk_bytes: number | null;
+  available_memory_bytes: number | null;
+  cpu_utilization: number | null;
+  effective_cpu_cores: number | null;
+  observed_at: string | null;
+  total_memory_bytes: number | null;
+}
+export const nodeHostFields = ["available_disk_bytes", "available_memory_bytes", "cpu_utilization", "effective_cpu_cores", "observed_at", "total_memory_bytes"] as const;
+export interface NodeRollout {
+  diagnostic?: NodeRolloutDiagnostic;
+  ready_generation: number | null;
+  state: NodeRolloutState;
+}
+export const nodeRolloutFields = ["diagnostic", "ready_generation", "state"] as const;
+export const nodeRolloutRequired = ["ready_generation", "state"] as const;
+export const nodeRolloutDiagnosticValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export type NodeRolloutDiagnostic = (typeof nodeRolloutDiagnosticValues)[number];
+export const nodeRolloutStateValues = ["ready", "preparing", "failed", "update_required", "unknown"] as const;
+export type NodeRolloutState = (typeof nodeRolloutStateValues)[number];
+export interface NodeUpdate {
+  max_active: number;
+  max_retained?: number;
+  name: string;
+}
+export const nodeUpdateFields = ["max_active", "max_retained", "name"] as const;
+export const nodeUpdateRequired = ["max_active", "name"] as const;
+export interface Pool {
+  idle: number | null;
+  in_use: number | null;
+  max: number | null;
+}
+export const poolFields = ["idle", "in_use", "max"] as const;
+export interface Process {
+  cpu_cores: number | null;
+  cpu_limit_cores: number | null;
+  goroutines: number | null;
+  memory_bytes: number | null;
+  memory_limit_bytes: number | null;
+  rss_bytes: number | null;
+  series: ProcessBucket[];
+}
+export const processFields = ["cpu_cores", "cpu_limit_cores", "goroutines", "memory_bytes", "memory_limit_bytes", "rss_bytes", "series"] as const;
+export interface ProcessBucket {
+  cpu_cores: number | null;
+  rss_bytes: number | null;
+  start: string;
+}
+export const processBucketFields = ["cpu_cores", "rss_bytes", "start"] as const;
+export interface Project {
+  active_key_count: number;
+  archived_at: string | null;
+  created_at: string;
+  id: string;
+  name: string;
+}
+export const projectFields = ["active_key_count", "archived_at", "created_at", "id", "name"] as const;
+export interface ProjectAPIKeyRequest {
+  name: string;
+}
+export const projectAPIKeyRequestFields = ["name"] as const;
+export interface ProjectRequest {
+  name: string;
+}
+export const projectRequestFields = ["name"] as const;
+export interface ProjectsAPIKey {
+  created_at: string;
+  id: string;
+  name: string;
+  prefix: string;
+  project_id: string;
+  revoked_at: string | null;
+}
+export const projectsAPIKeyFields = ["created_at", "id", "name", "prefix", "project_id", "revoked_at"] as const;
+export interface ProjectsPage {
+  data: Project[];
+  has_more: boolean;
+}
+export const projectsPageFields = ["data", "has_more"] as const;
+export interface Range {
+  end: string;
+  resolution_seconds: number;
+  start: string;
+}
+export const rangeFields = ["end", "resolution_seconds", "start"] as const;
+export interface Reset {
+  clear: ResetClear;
+  deadline_at: string | null;
+  forced_at: string | null;
+  remaining: ResetRemaining;
+  requested_at: string;
+}
+export const resetFields = ["clear", "deadline_at", "forced_at", "remaining", "requested_at"] as const;
+export const resetClearValues = ["auto", "force"] as const;
+export type ResetClear = (typeof resetClearValues)[number];
+export interface ResetOfflineNode {
+  name: string;
+  node_id: string;
+  resources: number;
+}
+export const resetOfflineNodeFields = ["name", "node_id", "resources"] as const;
+export interface ResetRemaining {
+  busy: number;
+  cleanup: number;
+  idle: number;
+  offline_nodes: ResetOfflineNode[];
+  on_offline_nodes: number;
+}
+export const resetRemainingFields = ["busy", "cleanup", "idle", "offline_nodes", "on_offline_nodes"] as const;
+export interface ResetRequest {
+  clear: ResetRequestClear;
+  deadline_seconds?: number;
+  expected_generation: number;
+}
+export const resetRequestFields = ["clear", "deadline_seconds", "expected_generation"] as const;
+export const resetRequestRequired = ["clear", "expected_generation"] as const;
+export const resetRequestClearValues = ["auto", "force"] as const;
+export type ResetRequestClear = (typeof resetRequestClearValues)[number];
+export interface ResourceOwner {
+  api_key: WriteauditAPIKey | null;
+  resource_id: string;
+}
+export const resourceOwnerFields = ["api_key", "resource_id"] as const;
+export interface ResourceOwnerList {
+  data: ResourceOwner[];
+}
+export const resourceOwnerListFields = ["data"] as const;
+export interface Rollout {
+  nodes: RolloutNodes | null;
+  previous_generation_sandboxes: number;
+  state: RolloutState;
+}
+export const rolloutFields = ["nodes", "previous_generation_sandboxes", "state"] as const;
+export interface RolloutNodes {
+  failed: number;
+  preparing: number;
+  ready: number;
+  unknown: number;
+  update_required: number;
+}
+export const rolloutNodesFields = ["failed", "preparing", "ready", "unknown", "update_required"] as const;
+export const rolloutStateValues = ["settled", "preparing"] as const;
+export type RolloutState = (typeof rolloutStateValues)[number];
+export interface RuntimeCPUObservation {
+  capacity_cores: number | null;
+  usage_cores: number | null;
+  usage_seconds_total: number | null;
+  utilization_ratio: number | null;
+}
+export const runtimeCPUObservationFields = ["capacity_cores", "usage_cores", "usage_seconds_total", "utilization_ratio"] as const;
+export interface RuntimeDiskObservation {
+  limit_bytes: number | null;
+  usage_bytes: number | null;
+}
+export const runtimeDiskObservationFields = ["limit_bytes", "usage_bytes"] as const;
+export interface RuntimeHistory {
+  coverage: RuntimeHistoryCoverage;
+  generated_at: number;
+  object: "agent.runtime_history";
+  requested_range: RuntimeHistoryRange;
+  resolution_seconds: number;
+  series: RuntimeHistorySeries[];
+  session_id: string;
+  source: "durable";
+  token_usage: RuntimeHistoryTokenUsagePoint[];
+}
+export const runtimeHistoryFields = ["coverage", "generated_at", "object", "requested_range", "resolution_seconds", "series", "session_id", "source", "token_usage"] as const;
+export interface RuntimeHistoryCPU {
+  capacity_cores: number | null;
+  contributor_count: number;
+  utilization_ratio: number | null;
+}
+export const runtimeHistoryCPUFields = ["capacity_cores", "contributor_count", "utilization_ratio"] as const;
+export interface RuntimeHistoryCoverage {
+  buckets: RuntimeHistoryCoveragePoint[];
+  expected_sample_count: number;
+  first_sample_at: number | null;
+  last_sample_at: number | null;
+  retained_start: number;
+  sample_count: number;
+}
+export const runtimeHistoryCoverageFields = ["buckets", "expected_sample_count", "first_sample_at", "last_sample_at", "retained_start", "sample_count"] as const;
+export interface RuntimeHistoryCoveragePoint {
+  end: number;
+  first_observed_at: number | null;
+  last_observed_at: number | null;
+  observation_count: number;
+  observed_count: number;
+  start: number;
+  unavailable_count: number;
+}
+export const runtimeHistoryCoveragePointFields = ["end", "first_observed_at", "last_observed_at", "observation_count", "observed_count", "start", "unavailable_count"] as const;
+export interface RuntimeHistoryMemory {
+  contributor_count: number;
+  limit_bytes: number | null;
+  usage_bytes: number | null;
+}
+export const runtimeHistoryMemoryFields = ["contributor_count", "limit_bytes", "usage_bytes"] as const;
+export interface RuntimeHistoryPoint {
+  cpu: RuntimeHistoryCPU | null;
+  end: number;
+  first_observed_at: number | null;
+  last_observed_at: number | null;
+  memory: RuntimeHistoryMemory | null;
+  observation_count: number;
+  observed_count: number;
+  start: number;
+  unavailable_count: number;
+}
+export const runtimeHistoryPointFields = ["cpu", "end", "first_observed_at", "last_observed_at", "memory", "observation_count", "observed_count", "start", "unavailable_count"] as const;
+export interface RuntimeHistoryRange {
+  end: number;
+  start: number;
+}
+export const runtimeHistoryRangeFields = ["end", "start"] as const;
+export interface RuntimeHistorySeries {
+  allocation_id: string;
+  environment_id: string;
+  points: RuntimeHistoryPoint[];
+  provider_type: string;
+  started_at: RuntimeHistoryTime;
+}
+export const runtimeHistorySeriesFields = ["allocation_id", "environment_id", "points", "provider_type", "started_at"] as const;
+export interface RuntimeHistoryTime {
+  nanoseconds: number;
+  seconds: number;
+}
+export const runtimeHistoryTimeFields = ["nanoseconds", "seconds"] as const;
+export interface RuntimeHistoryTokenUsagePoint {
+  end: number;
+  input_tokens: number;
+  output_tokens: number;
+  sampled_at: number;
+  start: number;
+}
+export const runtimeHistoryTokenUsagePointFields = ["end", "input_tokens", "output_tokens", "sampled_at", "start"] as const;
+export interface RuntimeInstance {
+  allocation_id: string | null;
+  connection_generation: string | null;
+  device_id: string | null;
+  kind: RuntimeInstanceKind;
+}
+export const runtimeInstanceFields = ["allocation_id", "connection_generation", "device_id", "kind"] as const;
+export const runtimeInstanceKindValues = ["managed_allocation", "self_hosted_connection", "none"] as const;
+export type RuntimeInstanceKind = (typeof runtimeInstanceKindValues)[number];
+export interface RuntimeMemoryObservation {
+  limit_bytes: number | null;
+  usage_bytes: number | null;
+}
+export const runtimeMemoryObservationFields = ["limit_bytes", "usage_bytes"] as const;
+export interface RuntimeObservation {
+  allocation_created_at: number | null;
+  cpu: RuntimeCPUObservation | null;
+  environment_id: string | null;
+  id: string;
+  instance: RuntimeInstance;
+  lifecycle_state: RuntimeObservationLifecycleState | null;
+  memory: RuntimeMemoryObservation | null;
+  mode: RuntimeObservationMode;
+  object: "agent.runtime_observation";
+  observed_at: number | null;
+  provider_type: string | null;
+  reason: RuntimeObservationReason | null;
+  resolved_at: number;
+  session_id: string;
+  started_at: number | null;
+  status: RuntimeObservationStatus;
+}
+export const runtimeObservationFields = ["allocation_created_at", "cpu", "environment_id", "id", "instance", "lifecycle_state", "memory", "mode", "object", "observed_at", "provider_type", "reason", "resolved_at", "session_id", "started_at", "status"] as const;
+export const runtimeObservationLifecycleStateValues = ["active", "sleeping", "transitioning", "pending", "stopped"] as const;
+export type RuntimeObservationLifecycleState = (typeof runtimeObservationLifecycleStateValues)[number];
+export const runtimeObservationModeValues = ["none", "self_hosted", "openai_hosted"] as const;
+export type RuntimeObservationMode = (typeof runtimeObservationModeValues)[number];
+export const runtimeObservationReasonValues = ["runtime_mode_not_observable", "allocation_pending", "runtime_not_running", "sample_timeout", "sample_unavailable"] as const;
+export type RuntimeObservationReason = (typeof runtimeObservationReasonValues)[number];
+export const runtimeObservationStatusValues = ["observed", "unsupported", "unavailable"] as const;
+export type RuntimeObservationStatus = (typeof runtimeObservationStatusValues)[number];
+export interface RuntimeRelease {
+  firmware_sha256: string;
+  image_id: string;
+  image_manifest_digest: string;
+  microsandbox_ref: string;
+  runtime_sha256: string;
+  source_commit: string;
+}
+export const runtimeReleaseFields = ["firmware_sha256", "image_id", "image_manifest_digest", "microsandbox_ref", "runtime_sha256", "source_commit"] as const;
+export interface SandboxAllocationList {
+  data: NodeAllocation[];
+}
+export const sandboxAllocationListFields = ["data"] as const;
+export interface SandboxDeploymentChangeInput {
+  configuration?: Record<string, unknown>;
+  credential?: Record<string, unknown>;
+  expected_generation: number;
+  provider?: string;
+  resources?: SandboxResources;
+  runtime?: RuntimeRelease;
+}
+export const sandboxDeploymentChangeInputFields = ["configuration", "credential", "expected_generation", "provider", "resources", "runtime"] as const;
+export const sandboxDeploymentChangeInputRequired = ["expected_generation"] as const;
+export interface SandboxDeploymentInput {
+  configuration?: Record<string, unknown>;
+  credential?: Record<string, unknown>;
+  expected_generation: number;
+  provider?: string;
+  resources?: SandboxResources;
+  runtime?: RuntimeRelease;
+}
+export const sandboxDeploymentInputFields = ["configuration", "credential", "expected_generation", "provider", "resources", "runtime"] as const;
+export const sandboxDeploymentInputRequired = ["expected_generation"] as const;
+export interface SandboxEnrollmentToken {
+  enrollment_id: string;
+  expires_at: string;
+  token: string;
+}
+export const sandboxEnrollmentTokenFields = ["enrollment_id", "expires_at", "token"] as const;
+export interface SandboxEnrollmentTokenRequest {
+  max_active?: number;
+  max_retained?: number;
+}
+export const sandboxEnrollmentTokenRequestFields = ["max_active", "max_retained"] as const;
+export const sandboxEnrollmentTokenRequestRequired = [] as const;
+export interface SandboxMutationResponse {
+  deleted?: boolean;
+  id: string;
+  updated?: boolean;
+}
+export const sandboxMutationResponseFields = ["deleted", "id", "updated"] as const;
+export const sandboxMutationResponseRequired = ["id"] as const;
+export interface SandboxNodeList {
+  data: Node[];
+}
+export const sandboxNodeListFields = ["data"] as const;
+export interface SandboxResources {
+  cpus: number;
+  environment_disk_mib?: number;
+  memory_mib: number;
+  root_disk_mib?: number;
+}
+export const sandboxResourcesFields = ["cpus", "environment_disk_mib", "memory_mib", "root_disk_mib"] as const;
+export const sandboxResourcesRequired = ["cpus", "memory_mib"] as const;
+export interface ServiceState {
+  execution_owner: boolean | null;
+  revision: string | null;
+  started_at: string | null;
+  status: ServiceStateStatus;
+}
+export const serviceStateFields = ["execution_owner", "revision", "started_at", "status"] as const;
+export const serviceStateStatusValues = ["running", "degraded"] as const;
+export type ServiceStateStatus = (typeof serviceStateStatusValues)[number];
+export interface SessionDiagnosticFailure {
+  code: SessionDiagnosticFailureCode;
+  failed_at: string | null;
+  params: Record<string, unknown>;
+  source: SessionDiagnosticFailureSource;
+  turn_id?: string;
+}
+export const sessionDiagnosticFailureFields = ["code", "failed_at", "params", "source", "turn_id"] as const;
+export const sessionDiagnosticFailureRequired = ["code", "failed_at", "params", "source"] as const;
+export const sessionDiagnosticFailureCodeValues = ["harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error", "environment_connection_timeout", "environment_unavailable", "environment_provisioning_failed", "authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed"] as const;
+export type SessionDiagnosticFailureCode = (typeof sessionDiagnosticFailureCodeValues)[number];
+export const sessionDiagnosticFailureSourceValues = ["turn", "environment", "environment_input"] as const;
+export type SessionDiagnosticFailureSource = (typeof sessionDiagnosticFailureSourceValues)[number];
+export interface SessionDiagnostics {
+  failure: SessionDiagnosticFailure | null;
+  object: "core.session_diagnostics";
+  session_id: string;
+  status: SessionDiagnosticsStatus;
+}
+export const sessionDiagnosticsFields = ["failure", "object", "session_id", "status"] as const;
+export const sessionDiagnosticsStatusValues = ["idle", "in_progress", "requires_action", "failed"] as const;
+export type SessionDiagnosticsStatus = (typeof sessionDiagnosticsStatusValues)[number];
+export interface SessionExecutionConfiguration {
+  harness: ExecutionSelection;
+  harness_config: ExecutionHarnessConfigSelection;
+  model: ExecutionSelection;
+  model_provider: ExecutionProviderSelection;
+  object: "agent.session.execution_configuration";
+  schema_version: 1;
+  session_id: string;
+}
+export const sessionExecutionConfigurationFields = ["harness", "harness_config", "model", "model_provider", "object", "schema_version", "session_id"] as const;
+export interface Suspension {
+  idle_seconds: number;
+  retention_seconds: number;
+}
+export const suspensionFields = ["idle_seconds", "retention_seconds"] as const;
+export interface TurnDiagnostics {
+  failure: DiagnosticFailure | null;
+  items: ItemDiagnosticTiming[];
+  items_truncated: boolean;
+  object: "core.turn_diagnostics";
+  session_id: string;
+  status: string;
+  turn_id: string;
+}
+export const turnDiagnosticsFields = ["failure", "items", "items_truncated", "object", "session_id", "status", "turn_id"] as const;
+export interface WriteauditAPIKey {
+  id: string;
+  kind: "issued";
+  name: string;
+  prefix: string;
+  revoked_at: string | null;
+}
+export const writeauditAPIKeyFields = ["id", "kind", "name", "prefix", "revoked_at"] as const;
+export interface WriteauditOperation {
+  action: WriteauditOperationAction;
+  api_key: WriteauditAPIKey;
+  created_at: string;
+  id: string;
+  parent_id: string;
+  request_id: string;
+  resource_id: string;
+  resource_type: WriteauditOperationResourceType;
+  trace_id: string;
+}
+export const writeauditOperationFields = ["action", "api_key", "created_at", "id", "parent_id", "request_id", "resource_id", "resource_type", "trace_id"] as const;
+export const writeauditOperationActionValues = ["create", "update", "delete", "send_events", "upload_file", "upload_version", "update_default_version"] as const;
+export type WriteauditOperationAction = (typeof writeauditOperationActionValues)[number];
+export const writeauditOperationResourceTypeValues = ["agent", "session", "environment", "environment_template", "skill", "skill_version", "file", "vault", "credential", "artifact"] as const;
+export type WriteauditOperationResourceType = (typeof writeauditOperationResourceTypeValues)[number];
+export interface WriteauditPage {
+  data: WriteauditOperation[];
+  has_more: boolean;
+  next_cursor: string;
+}
+export const writeauditPageFields = ["data", "has_more", "next_cursor"] as const;
diff --git a/packages/agents-client/src/index.ts b/packages/agents-client/src/index.ts
index 18711e960..c902b2b43 100644
--- a/packages/agents-client/src/index.ts
+++ b/packages/agents-client/src/index.ts
@@ -12,7 +12,8 @@ export { isEnvironmentTemplateName, isRecognizedEnvironmentTemplate } from "./en
 export { isOpenAIHostedSessionEnvironment } from "./session-environment-projection";
 export { compareSkillVersionNumbers, isSkillId, isSkillUploadPath, isSkillVersionId, isSkillVersionNumber } from "./skill-projection";
 export { AdminClient } from "./admin-client";
-// Skill and SkillVersion come from ./types; the admin projections use the same shapes.
-export type { AdminClientOptions, AdminProject, CreateAdminProjectInput, RenameAdminProjectInput, AdminAPIKey, AdminIssuedAPIKey, IssueAdminAPIKeyInput, AdminPage, AdminDeleted, SessionArtifact, AdminContent, AdminResourceType, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperation, AdminWriteOperationOptions, AdminWriteOperationPage, AdminSummaryOptions, AdminSummaryEntry, AdminSummary, AdminRuntimeObservation, AdminAuditOptions, AdminAuditEntry, AdminAuditPage, ExecutorCredential, ExecutorConnection, ExecutorCredentialList, IssueExecutorCredentialInput, IssuedExecutorCredential, CoreInstallation, CoreInstallationConfiguration, CoreInstallationSetting, CoreAddressBindings } from "./admin-types";
+// Skill, SkillVersion and SessionArtifact come from ./types; the admin projections use the same shapes.
+export { adminResourceTypes } from "./admin-types";
+export type { AdminClientOptions, AdminProject, CreateAdminProjectInput, RenameAdminProjectInput, AdminAPIKey, AdminIssuedAPIKey, IssueAdminAPIKeyInput, AdminPage, AdminDeleted, AdminContent, AdminResourceType, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperation, AdminWriteOperationOptions, AdminWriteOperationPage, AdminSummaryOptions, AdminSummaryEntry, AdminSummary, AdminRuntimeObservation, AdminAuditOptions, AdminAuditEntry, AdminAuditPage, ExecutorCredential, ExecutorConnection, ExecutorCredentialList, IssueExecutorCredentialInput, IssuedExecutorCredential, CoreInstallation, CoreInstallationConfiguration, CoreInstallationSetting, CoreAddressBindings } from "./admin-types";
 
-export type { DiagnosticFailureCode, NativeFailureCode, ConnectionFailureParams, ProvisioningFailureParams, DiagnosticFailure, SessionDiagnosticFailure, SessionDiagnostics, ItemDiagnosticTiming, TurnDiagnostics } from "./session-diagnostics";
+export type { DiagnosticFailureCode, ConnectionFailureParams, ProvisioningFailureParams, DiagnosticFailure, SessionDiagnosticFailure, SessionDiagnostics, ItemDiagnosticTiming, TurnDiagnostics } from "./session-diagnostics";
diff --git a/packages/agents-client/src/runtime-history-projection.ts b/packages/agents-client/src/runtime-history-projection.ts
index 82dfea325..6cc2040ec 100644
--- a/packages/agents-client/src/runtime-history-projection.ts
+++ b/packages/agents-client/src/runtime-history-projection.ts
@@ -1,33 +1,14 @@
-import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, sameResourceId } from "./response-projection";
-import type {
-  RuntimeHistory,
-  RuntimeHistoryCPU,
-  RuntimeHistoryCoveragePoint,
-  RuntimeHistoryMemory,
-  RuntimeHistoryPoint,
-  RuntimeHistoryQuery,
-  RuntimeHistorySeries,
-  RuntimeHistoryTokenUsagePoint,
-} from "./types";
+import {
+  runtimeHistoryCPUFields, runtimeHistoryCoverageFields, runtimeHistoryCoveragePointFields, runtimeHistoryFields, runtimeHistoryMemoryFields,
+  runtimeHistoryPointFields, runtimeHistoryRangeFields, runtimeHistorySeriesFields, runtimeHistoryTimeFields, runtimeHistoryTokenUsagePointFields,
+  type RuntimeHistoryCPU, type RuntimeHistoryCoveragePoint, type RuntimeHistoryMemory, type RuntimeHistoryPoint, type RuntimeHistorySeries,
+  type RuntimeHistoryTokenUsagePoint,
+} from "./generated/core-api";
+import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, sameResourceId, type FieldNames } from "./response-projection";
+import type { RuntimeHistory, RuntimeHistoryQuery } from "./types";
 
 type InvalidRuntimeHistory = (message?: string) => never;
 
-const historyFields = new Set([
-  "object", "source", "session_id", "requested_range", "resolution_seconds", "generated_at", "coverage", "series", "token_usage",
-]);
-const rangeFields = new Set(["start", "end"]);
-const coverageFields = new Set([
-  "retained_start", "first_sample_at", "last_sample_at", "sample_count", "expected_sample_count", "buckets",
-]);
-const coveragePointFields = new Set([
-  "start", "end", "first_observed_at", "last_observed_at", "observation_count", "observed_count", "unavailable_count",
-]);
-const seriesFields = new Set(["environment_id", "allocation_id", "started_at", "provider_type", "points"]);
-const timeFields = new Set(["seconds", "nanoseconds"]);
-const pointFields = new Set([...coveragePointFields, "cpu", "memory"]);
-const cpuFields = new Set(["contributor_count", "utilization_ratio", "capacity_cores"]);
-const memoryFields = new Set(["contributor_count", "usage_bytes", "limit_bytes"]);
-const tokenUsageFields = new Set(["start", "end", "sampled_at", "input_tokens", "output_tokens"]);
 const providerTypePattern = /^[a-z][a-z0-9_]{0,31}$/;
 const maximumSeries = 1_000;
 const maximumTotalPoints = 100_000;
@@ -62,7 +43,7 @@ function nullablePositiveNumber(value: unknown, invalid: InvalidRuntimeHistory):
 
 function projectCoveragePoint(
   value: unknown,
-  fields: Set<string>,
+  fields: FieldNames,
   requestedStart: number,
   requestedEnd: number,
   resolution: number,
@@ -96,7 +77,7 @@ function projectCoveragePoint(
 
 function projectCPU(value: unknown, observedCount: number, invalid: InvalidRuntimeHistory): RuntimeHistoryCPU | null {
   if (value === null) return null;
-  if (!isRecord(value) || !exactFields(value, cpuFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
+  if (!isRecord(value) || !exactFields(value, runtimeHistoryCPUFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
   const utilization = nullableNonnegativeNumber(value.utilization_ratio, invalid);
   const capacity = nullablePositiveNumber(value.capacity_cores, invalid);
   if (utilization === null && capacity === null) return invalid();
@@ -105,7 +86,7 @@ function projectCPU(value: unknown, observedCount: number, invalid: InvalidRunti
 
 function projectMemory(value: unknown, observedCount: number, invalid: InvalidRuntimeHistory): RuntimeHistoryMemory | null {
   if (value === null) return null;
-  if (!isRecord(value) || !exactFields(value, memoryFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
+  if (!isRecord(value) || !exactFields(value, runtimeHistoryMemoryFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
   const usage = nullableNonnegativeInteger(value.usage_bytes, invalid);
   const limit = nullablePositiveInteger(value.limit_bytes, invalid);
   if (usage === null && limit === null) return invalid();
@@ -120,7 +101,7 @@ function projectPoint(
   startedAt: number,
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistoryPoint {
-  const coverage = projectCoveragePoint(value, pointFields, requestedStart, requestedEnd, resolution, invalid);
+  const coverage = projectCoveragePoint(value, runtimeHistoryPointFields, requestedStart, requestedEnd, resolution, invalid);
   if (!isRecord(value) || coverage.end <= startedAt || (coverage.first_observed_at !== null && coverage.first_observed_at < startedAt)) return invalid();
   const cpu = projectCPU(value.cpu, coverage.observed_count, invalid);
   const memory = projectMemory(value.memory, coverage.observed_count, invalid);
@@ -141,7 +122,7 @@ function projectTokenUsagePoint(
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistoryTokenUsagePoint {
   if (
-    !isRecord(value) || !exactFields(value, tokenUsageFields) ||
+    !isRecord(value) || !exactFields(value, runtimeHistoryTokenUsagePointFields) ||
     !isNonnegativeInteger(value.start) || !positiveInteger(value.end) ||
     value.start < requestedStart || value.end <= value.start || value.end > requestedEnd || value.end - value.start > resolution ||
     !isNonnegativeInteger(value.sampled_at) || value.sampled_at < value.start || value.sampled_at >= value.end || value.sampled_at > generatedAt ||
@@ -165,10 +146,10 @@ function projectSeries(
   maximumPoints: number,
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistorySeries {
-  if (!isRecord(value) || !exactFields(value, seriesFields) || !Array.isArray(value.points)) return invalid();
+  if (!isRecord(value) || !exactFields(value, runtimeHistorySeriesFields) || !Array.isArray(value.points)) return invalid();
   const environmentId = canonicalUuid(value.environment_id);
   const allocationId = canonicalUuid(value.allocation_id);
-  if (!isRecord(value.started_at) || !exactFields(value.started_at, timeFields)) return invalid();
+  if (!isRecord(value.started_at) || !exactFields(value.started_at, runtimeHistoryTimeFields)) return invalid();
   const startedAtSeconds = value.started_at.seconds;
   const startedAtNanoseconds = value.started_at.nanoseconds;
   if (
@@ -197,12 +178,12 @@ export function projectRuntimeHistory(
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistory {
   if (
-    !isRecord(value) || !exactFields(value, historyFields) || value.object !== "agent.runtime_history" || value.source !== "durable" ||
+    !isRecord(value) || !exactFields(value, runtimeHistoryFields) || value.object !== "agent.runtime_history" || value.source !== "durable" ||
     typeof value.session_id !== "string" || !sameResourceId(value.session_id, expectedSessionId) ||
-    !isRecord(value.requested_range) || !exactFields(value.requested_range, rangeFields) ||
+    !isRecord(value.requested_range) || !exactFields(value.requested_range, runtimeHistoryRangeFields) ||
     value.requested_range.start !== requested.start || value.requested_range.end !== requested.end ||
     !positiveInteger(value.resolution_seconds) || !isNonnegativeInteger(value.generated_at) ||
-    !isRecord(value.coverage) || !exactFields(value.coverage, coverageFields) || !Array.isArray(value.coverage.buckets) ||
+    !isRecord(value.coverage) || !exactFields(value.coverage, runtimeHistoryCoverageFields) || !Array.isArray(value.coverage.buckets) ||
     !Array.isArray(value.series) || !Array.isArray(value.token_usage)
   ) return invalid();
   const sessionId = canonicalUuid(value.session_id);
@@ -221,7 +202,7 @@ export function projectRuntimeHistory(
     (firstSample !== null && (firstSample < retainedStart || lastSample! < firstSample || lastSample! >= requested.end || lastSample! > generatedAt))
   ) return invalid();
   const buckets = value.coverage.buckets.map((point) => projectCoveragePoint(
-    point, coveragePointFields, requested.start, requested.end, value.resolution_seconds as number, invalid,
+    point, runtimeHistoryCoveragePointFields, requested.start, requested.end, value.resolution_seconds as number, invalid,
   ));
   if (!ordered(buckets)) return invalid();
   const sampleCount = buckets.reduce((sum, point) => sum + point.observation_count, 0);
diff --git a/packages/agents-client/src/sandbox-client.test.ts b/packages/agents-client/src/sandbox-client.test.ts
index 9bea39776..1f32f2173 100644
--- a/packages/agents-client/src/sandbox-client.test.ts
+++ b/packages/agents-client/src/sandbox-client.test.ts
@@ -157,7 +157,7 @@ describe("Core sandbox credential boundaries", () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ data: [unready, { ...unready, diagnostic: "future_code" }, node] }));
     const { data } = await new SandboxAdminClient({ baseUrl: "/core/v1/sandbox", fetch }).listNodes();
     expect(data.map((entry) => entry.diagnostic)).toEqual(["host_unsupported", "provider_unavailable", undefined]);
-    expectTypeOf<SandboxNode["diagnostic"]>().toEqualTypeOf<undefined | "" | "provider_unavailable" | "host_unsupported" | "artifacts_unavailable" | "runtime_download_failed" | "runtime_image_unavailable" | "capacity_insufficient">();
+    expectTypeOf<SandboxNode["diagnostic"]>().toEqualTypeOf<undefined | "provider_unavailable" | "host_unsupported" | "artifacts_unavailable" | "runtime_download_failed" | "runtime_image_unavailable" | "capacity_insufficient">();
   });
   it("requires each node's enrollment ID: a string, or null for nodes enrolled before Core recorded it", async () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ data: [node, unready] }));
diff --git a/packages/agents-client/src/sandbox-client.ts b/packages/agents-client/src/sandbox-client.ts
index ef1cafcb8..1cdc84d2d 100644
--- a/packages/agents-client/src/sandbox-client.ts
+++ b/packages/agents-client/src/sandbox-client.ts
@@ -1,26 +1,27 @@
 import { AgentCoreError } from "./client";
 import { CoreRequester, type CoreClientOptions } from "./core-request";
 import { deploymentContract } from "./deployment-contract";
-import { hasOwn, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import { hasOwn, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResourceId, schemaFields } from "./response-projection";
+import {
+  deploymentResourcesFields, deploymentSpecFields, deploymentSpecRequired, deploymentViewFields, deploymentViewModeValues, deploymentViewRequired,
+  hostHistoryFields, hostHistoryPointFields, nodeAllocationDiagnosticValues, nodeAllocationFields, nodeDetailFields, nodeDetailRequired,
+  nodeDiagnosticValues, nodeFields, nodeHostFields, nodeRequired, nodeRolloutFields, nodeRolloutRequired, nodeRolloutStateValues, resetClearValues,
+  resetFields, resetOfflineNodeFields, resetRemainingFields, rolloutFields, rolloutNodesFields, rolloutStateValues, runtimeReleaseFields,
+  sandboxAllocationListFields, sandboxNodeListFields, sandboxResourcesFields, sandboxResourcesRequired, suspensionFields,
+  type DeploymentSpec, type DeploymentView, type HostHistoryPoint, type Node, type NodeAllocation, type NodeDetail, type NodeDiagnostic,
+  type NodeHost, type NodeRollout, type NodeUpdate, type Reset, type ResetOfflineNode, type ResetRequest, type Rollout, type RuntimeRelease,
+  type SandboxDeploymentInput, type SandboxEnrollmentToken, type SandboxResources as SandboxResourcesResource,
+} from "./generated/core-api";
 import type { ReadOptions } from "./types";
 
-export type SandboxDiagnostic = "" | "node_unavailable" | "resource_missing" | "compute_unconfirmed" | "ownership_mismatch" | "provider_unavailable";
 /** Checked against Core's shared node-diagnostics.json fixture. */
-export const sandboxNodeDiagnostics = [
-  "provider_unavailable",
-  "host_unsupported",
-  "artifacts_unavailable",
-  "runtime_download_failed",
-  "runtime_image_unavailable",
-  "capacity_insufficient",
-] as const;
+export const sandboxNodeDiagnostics = nodeDiagnosticValues;
 /** Fixed reason a node's provider is not ready. Core omits the field while the provider is ready, so read it as falsy (undefined) then. The client reads an unknown future value as provider_unavailable. */
-export type SandboxNodeDiagnostic = "" | typeof sandboxNodeDiagnostics[number];
-const nodeDiagnostics: ReadonlySet<string> = new Set(sandboxNodeDiagnostics);
+export type SandboxNodeDiagnostic = NodeDiagnostic;
 
 /** Keep a known readiness cause; never expose unclassified node-supplied text. */
-export function normalizeSandboxNodeDiagnostic(value: string): Exclude<SandboxNodeDiagnostic, ""> {
-  return nodeDiagnostics.has(value) ? value as Exclude<SandboxNodeDiagnostic, ""> : "provider_unavailable";
+export function normalizeSandboxNodeDiagnostic(value: string): SandboxNodeDiagnostic {
+  return isOneOf(nodeDiagnosticValues, value) ? value : "provider_unavailable";
 }
 
 /** A registered Provider kind; deploymentContract.providers holds each one's declaration. */
@@ -28,68 +29,46 @@ export type SandboxProvider = keyof typeof deploymentContract.providers;
 /** Client-generated, never a Core code: a deployment write whose rejection could echo the key and is withheld. */
 export const sandboxConfigurationUnconfirmed = "sandbox_configuration_unconfirmed";
 const sandboxConfigurationParams = new Set<unknown>(["runtime", ...deploymentContract.resources.map(({ name }) => `resources.${name}`)]);
+
+// Generated types keep their schema names in ./generated/core-api; these are the client's names for them.
 /** CPU and MiB limits for each sandbox, not node concurrency. */
-export interface SandboxResources { cpus: number; memory_mib: number; root_disk_mib?: number; environment_disk_mib?: number }
-export interface SandboxRuntimeRelease { source_commit: string; image_id: string; image_manifest_digest: string; microsandbox_ref: string; runtime_sha256: string; firmware_sha256: string }
-export interface SandboxSpecification { resources: SandboxResources; runtime?: SandboxRuntimeRelease }
-/** Core derives the deployment's address from the installation public URL; a `core_url` member is rejected. */
-export interface InitializeSandboxDeployment {
+export type SandboxResources = SandboxResourcesResource;
+export type SandboxRuntimeRelease = RuntimeRelease;
+export type SandboxSpecification = DeploymentSpec;
+export type SandboxRollout = Rollout;
+/** `state` is target preparation, which never invalidates a qualified older serving pin; `ready_generation` is that durable pin and alone does not imply connection readiness. */
+export type SandboxNodeRollout = NodeRollout;
+export type StartSandboxReset = ResetRequest;
+export type SandboxReset = Reset;
+/** `provider_ready` is the last provider report, so combine it with `online`; `diagnostic` is absent while the provider is ready. A `core_url` other than the installation public URL means the node receives no new sandboxes and must be re-added. */
+export type SandboxNode = Node;
+/** A one-time node enrollment command; `enrollment_id` is its public handle, never a credential. */
+export type SandboxEnrollment = SandboxEnrollmentToken;
+/** One node with its host observation and complete UTC buckets of host history. */
+export type SandboxNodeDetail = NodeDetail;
+/** A node's name and sandbox limits, with a retained limit of at least the active one. Under Docker, Core sets the retained limit to the active one. */
+export type SandboxNodeUpdate = NodeUpdate;
+export type SandboxAllocation = NodeAllocation;
+
+// The schema types each Provider's configuration, credential and metadata as free-form objects; the client names E2B's.
+/**
+ * Core derives the deployment's address from the installation public URL; a `core_url` member is rejected.
+ * `expected_generation` is required, zero for first setup. Docker and microsandbox require `resources` and `runtime`;
+ * E2B may omit `resources` to adopt its template build's CPU and memory, and always runs that build.
+ */
+export type InitializeSandboxDeployment = Omit<SandboxDeploymentInput, "provider" | "configuration" | "credential"> & {
   provider: SandboxProvider;
-  /** Required, including zero for first setup; read it from GET before submitting once. */
-  expected_generation: number;
-  /** Required for Docker/microsandbox. E2B may omit it to adopt its validated template build's CPU and memory. */
-  resources?: SandboxResources;
-  /** Required for Docker/microsandbox; E2B uses its fixed template build. */
-  runtime?: SandboxRuntimeRelease;
-  configuration?: { template?: string; api_url?: string; domain?: string };
+  configuration?: SandboxE2BConfiguration;
   /** Write-only. Omission on update preserves the current credential. */
   credential?: { api_key: string };
-}
-export interface UpdateSandboxDeployment extends InitializeSandboxDeployment {}
-export interface SandboxRollout {
-  /** Poll at high frequency only while preparing, independently of old Session retention. */
-  state: "settled" | "preparing";
-  previous_generation_sandboxes: number;
-  nodes: { ready: number; preparing: number; failed: number; update_required: number; unknown: number } | null;
-}
-export interface SandboxNodeRollout {
-  /** Target preparation; unknown/failed/preparing does not invalidate a qualified old serving pin. */
-  state: "ready" | "preparing" | "failed" | "update_required" | "unknown";
-  /** Durable serving pin; this alone does not imply current connection readiness. */
-  ready_generation: number | null;
-  diagnostic?: SandboxNodeDiagnostic;
-}
-export interface StartSandboxReset { expected_generation: number; clear: "auto" | "force"; deadline_seconds?: number }
-export interface SandboxReset {
-  clear: "auto" | "force";
-  requested_at: string;
-  deadline_at: string | null;
-  forced_at: string | null;
-  remaining: {
-    busy: number; idle: number; cleanup: number; on_offline_nodes: number;
-    offline_nodes: Array<{ node_id: string; name: string; resources: number }>;
-  };
-}
-
-export interface SandboxDeployment {
-  rollout: SandboxRollout;
-  specification?: SandboxSpecification;
-  specification_digest?: string;
-  installation_id: string;
+};
+export type UpdateSandboxDeployment = InitializeSandboxDeployment;
+export type SandboxDeployment = Omit<DeploymentView, "provider" | "configuration" | "metadata"> & {
   provider: SandboxProvider | "";
-  /** Read-only: the installation public URL, which nodes and sandboxes use to reach Core. Present before configuration. */
-  readonly core_url: string;
-  reset: SandboxReset | null;
-  owner_epoch: number;
-  generation: number;
-  mode: "nodes" | "direct" | "";
-  resources: { allocations: number; pending: number };
-  configuration?: { template?: string; api_url?: string; domain?: string };
+  configuration?: SandboxE2BConfiguration;
   metadata?: { template_build?: SandboxE2BTemplateBuild };
-  credential_configured: boolean;
-  /** Idle suspension policy; null unless the Provider declares checkpoint support. */
-  suspension: { idle_seconds: number; retention_seconds: number } | null;
-}
+};
+export interface SandboxE2BConfiguration { template?: string; api_url?: string; domain?: string }
 /** The fixed E2B build as Core read it when the selection was saved; unknown values are null. */
 export interface SandboxE2BTemplateBuild {
   status: string | null;
@@ -98,95 +77,15 @@ export interface SandboxE2BTemplateBuild {
 export interface SandboxE2BDiscoveryInput { api_key: string; api_url?: string; domain?: string }
 export interface SandboxE2BTemplate { id: string; names: string[] }
 export interface SandboxE2BReadyBuild { id: string; cpus: number; memory_mib: number }
-export interface SandboxNode {
-  rollout: SandboxNodeRollout;
-  id: string;
-  name: string;
-  provider: string;
-  online: boolean;
-  /** Last provider report; combine with online. Target rollout state is independent of serving readiness. */
-  provider_ready: boolean;
-  /** Absent while the provider is ready. */
-  diagnostic?: SandboxNodeDiagnostic;
-  cpu_count: number | null;
-  available_memory_bytes: number | null;
-  available_disk_bytes: number | null;
-  running: number;
-  snapshots: number;
-  last_seen_at: string | null;
-  max_active: number;
-  max_retained: number;
-  active: number;
-  reserved: number;
-  retained: number;
-  cleanup_pending: number;
-  created_at: string;
-  /** Read-only: the Core address this node enrolled with. When it differs from the installation public URL, the node receives no new sandboxes and must be re-added. */
-  readonly core_url: string;
-  /** Read-only: the `enrollment_id` of the command that registered this node; null for nodes enrolled before Core recorded it. Core always sends the member. */
-  readonly enrollment_id: string | null;
-}
-/** A one-time node enrollment command issued by Core. */
-export interface SandboxEnrollment {
-  /** The one-use secret the node registers with. */
-  token: string;
-  expires_at: string;
-  /** Public, non-secret handle of this command; never a credential. The node it registers reports the same `enrollment_id`. */
-  enrollment_id: string;
-}
-/** The node machine's last heartbeat observation; unavailable measurements are null. */
-export interface SandboxNodeHost {
-  effective_cpu_cores: number | null;
-  /** Busy share of the whole host's CPU between heartbeats, 0–1. */
-  cpu_utilization: number | null;
-  total_memory_bytes: number | null;
-  available_memory_bytes: number | null;
-  available_disk_bytes: number | null;
-  observed_at: string | null;
-}
-export interface SandboxNodeHostPoint {
-  start: string;
-  cpu_utilization_max: number | null;
-  memory_used_bytes_max: number | null;
-  available_disk_bytes_min: number | null;
-}
 export type SandboxNodeHistoryRange = "1h" | "6h" | "24h";
-/** One node with its host observation and complete UTC buckets of host history. */
-export interface SandboxNodeDetail extends SandboxNode {
-  host: SandboxNodeHost;
-  history: { resolution_seconds: number; points: SandboxNodeHostPoint[] };
-}
-/** A node's name and sandbox limits; Core takes all three, with a retained limit of at least the active one. Under Docker, Core sets the retained limit to the active one. */
-export interface SandboxNodeUpdate {
-  name: string;
-  max_active: number;
-  max_retained: number;
-}
-export interface SandboxAllocation {
-  deployment_generation: number;
-  id: string;
-  node_id: string;
-  tenant_id: string;
-  session_id: string;
-  environment_id: string;
-  state: string;
-  compute_phase: string;
-  /** When the allocation entered its current compute_phase, or null when unknown; an allocation that existed before Core recorded it reports null until its next phase change. */
-  compute_phase_changed_at: string | null;
-  diagnostic: SandboxDiagnostic;
-  initialization: string;
-  created_at: string;
-}
+
 function invalidSandboxResponse(): never {
   throw new AgentCoreError("Core returned an invalid sandbox administration response.", 502, "invalid_admin_response");
 }
 
-/**
- * The object has every required member, optional ones only where listed, and nothing else. The projections below
- * follow Core's deployment.View, deployment.Node, deployment.NodeDetail and deployment.NodeAllocation serialization.
- */
-function members(value: unknown, required: readonly string[], optional: readonly string[] = []): Record<string, unknown> {
-  if (!isRecord(value) || !required.every((field) => hasOwn(value, field)) || !onlyFields(value, new Set([...required, ...optional]))) return invalidSandboxResponse();
+/** The object has every required field, optional ones only where the schema lists them, and nothing else. */
+function members(value: unknown, fields: readonly string[], required: readonly string[] = fields): Record<string, unknown> {
+  if (!isRecord(value) || !schemaFields(value, fields, required)) return invalidSandboxResponse();
   return value;
 }
 function valid(condition: boolean): void {
@@ -197,22 +96,20 @@ const measure = (value: unknown) => typeof value === "number" && Number.isFinite
 const nullable = (test: (value: unknown) => boolean) => (value: unknown) => value === null || test(value);
 const strings = (value: Record<string, unknown>, fields: readonly string[]) => fields.every((field) => typeof value[field] === "string");
 
-const modes = new Set(["", "nodes", "direct"]);
-const releaseFields = ["source_commit", "image_id", "image_manifest_digest", "microsandbox_ref", "runtime_sha256", "firmware_sha256"];
 function projectSpecification(value: unknown): SandboxSpecification {
-  const specification = members(value, ["resources"], ["runtime"]);
-  const resources = members(specification.resources, ["cpus", "memory_mib"], ["root_disk_mib", "environment_disk_mib"]);
+  const specification = members(value, deploymentSpecFields, deploymentSpecRequired);
+  const resources = members(specification.resources, sandboxResourcesFields, sandboxResourcesRequired);
   valid(Object.values(resources).every(isNonnegativeInteger));
   if (!hasOwn(specification, "runtime")) return { resources: { ...resources } as unknown as SandboxResources };
-  const runtime = members(specification.runtime, releaseFields);
-  valid(strings(runtime, releaseFields));
+  const runtime = members(specification.runtime, runtimeReleaseFields);
+  valid(strings(runtime, runtimeReleaseFields));
   return { resources: { ...resources } as unknown as SandboxResources, runtime: { ...runtime } as unknown as SandboxRuntimeRelease };
 }
 /** The adapter's public projection has no credential member. */
 function projectE2B(configuration: unknown, metadata: unknown): Pick<SandboxDeployment, "configuration" | "metadata"> {
   const config = members(configuration, ["template", "api_url", "domain"]);
   valid(strings(config, ["template", "api_url", "domain"]));
-  const facts = members(metadata, [], ["template_build"]);
+  const facts = members(metadata, ["template_build"], []);
   if (!hasOwn(facts, "template_build")) return { configuration: { ...config }, metadata: {} };
   const build = members(facts.template_build, ["status", "resources"]);
   const resources = members(build.resources, ["cpus", "memory_mib", "root_disk_mib"]);
@@ -222,16 +119,16 @@ function projectE2B(configuration: unknown, metadata: unknown): Pick<SandboxDepl
 /** Counts and blocker identities are one Core snapshot, never reconstructed from node lists. */
 function projectReset(value: unknown, held: number): SandboxReset | null {
   if (value === null) return null;
-  const reset = members(value, ["clear", "requested_at", "deadline_at", "forced_at", "remaining"]);
-  const remaining = members(reset.remaining, ["busy", "idle", "cleanup", "on_offline_nodes", "offline_nodes"]);
-  valid((reset.clear === "auto" || reset.clear === "force") && timestamp(reset.requested_at) &&
+  const reset = members(value, resetFields);
+  const remaining = members(reset.remaining, resetRemainingFields);
+  valid(isOneOf(resetClearValues, reset.clear) && timestamp(reset.requested_at) &&
     nullable(timestamp)(reset.deadline_at) && nullable(timestamp)(reset.forced_at) &&
     (reset.clear === "auto" ? reset.deadline_at !== null && reset.forced_at === null : reset.forced_at !== null) &&
     [remaining.busy, remaining.idle, remaining.cleanup, remaining.on_offline_nodes].every(isNonnegativeInteger) && Array.isArray(remaining.offline_nodes));
   const nodes = (remaining.offline_nodes as unknown[]).map(value => {
-    const node = members(value, ["node_id", "name", "resources"]);
+    const node = members(value, resetOfflineNodeFields);
     valid(strings(node, ["node_id", "name"]) && node.node_id !== "" && isNonnegativeInteger(node.resources) && Number(node.resources) > 0);
-    return { ...node } as SandboxReset["remaining"]["offline_nodes"][number];
+    return { ...node } as unknown as ResetOfflineNode;
   });
   valid(Number(remaining.busy) + Number(remaining.idle) + Number(remaining.cleanup) === held &&
     Number(remaining.on_offline_nodes) <= held && nodes.reduce((sum, node) => sum + node.resources, 0) === remaining.on_offline_nodes &&
@@ -239,15 +136,15 @@ function projectReset(value: unknown, held: number): SandboxReset | null {
   return { ...reset, remaining: { ...remaining, offline_nodes: nodes } } as unknown as SandboxReset;
 }
 function projectRollout(value: unknown, mode: unknown, held: number): SandboxRollout {
-  const rollout = members(value, ["state", "previous_generation_sandboxes", "nodes"]);
-  valid((rollout.state === "settled" || rollout.state === "preparing") && isNonnegativeInteger(rollout.previous_generation_sandboxes) && Number(rollout.previous_generation_sandboxes) <= held);
-  const nodes = rollout.nodes === null ? null : members(rollout.nodes, ["ready", "preparing", "failed", "update_required", "unknown"]);
+  const rollout = members(value, rolloutFields);
+  valid(isOneOf(rolloutStateValues, rollout.state) && isNonnegativeInteger(rollout.previous_generation_sandboxes) && Number(rollout.previous_generation_sandboxes) <= held);
+  const nodes = rollout.nodes === null ? null : members(rollout.nodes, rolloutNodesFields);
   valid((nodes !== null) === (mode === "nodes") && (nodes === null || Object.values(nodes).every(isNonnegativeInteger)) && (rollout.state === "preparing") === (nodes !== null && Number(nodes.preparing) > 0));
   return { ...rollout, nodes: nodes && { ...nodes } } as unknown as SandboxRollout;
 }
 function projectNodeRollout(value: unknown, online: unknown): SandboxNodeRollout {
-  const rollout = members(value, ["state", "ready_generation"], ["diagnostic"]);
-  valid(["ready", "preparing", "failed", "update_required", "unknown"].includes(rollout.state as string) && nullable(isNonnegativeInteger)(rollout.ready_generation) &&
+  const rollout = members(value, nodeRolloutFields, nodeRolloutRequired);
+  valid(isOneOf(nodeRolloutStateValues, rollout.state) && nullable(isNonnegativeInteger)(rollout.ready_generation) &&
     (online !== false || rollout.state === "unknown") && (rollout.state !== "ready" || rollout.ready_generation !== null) &&
     (rollout.diagnostic === undefined || (typeof rollout.diagnostic === "string" && rollout.diagnostic !== "" && rollout.state === "failed")));
   return { ...rollout, ...(rollout.diagnostic !== undefined ? { diagnostic: normalizeSandboxNodeDiagnostic(rollout.diagnostic as string) } : {}) } as unknown as SandboxNodeRollout;
@@ -255,26 +152,26 @@ function projectNodeRollout(value: unknown, online: unknown): SandboxNodeRollout
 /** Configured deployments carry a validated public configuration and observation object. */
 function projectDeployment(value: unknown): SandboxDeployment {
   const e2b = isRecord(value) && value.provider === "e2b";
-  const fields = ["installation_id", "provider", "core_url", "reset", "rollout", "owner_epoch", "generation", "mode", "resources", "suspension", "credential_configured"];
-  const deployment = members(value, isRecord(value) && value.provider !== "" ? [...fields, "configuration", "metadata"] : fields, ["specification", "specification_digest"]);
+  // A selected Provider always has its configuration and metadata; no Provider has neither.
+  const selected = isRecord(value) && value.provider !== "";
+  const deployment = members(value, deploymentViewFields, selected ? [...deploymentViewRequired, "configuration", "metadata"] : deploymentViewRequired);
+  valid(selected || (!hasOwn(deployment, "configuration") && !hasOwn(deployment, "metadata")));
   valid(typeof deployment.credential_configured === "boolean");
   if (!e2b && deployment.provider !== "") { members(deployment.configuration, []); members(deployment.metadata, []); valid(deployment.credential_configured === false); }
-  const resources = members(deployment.resources, ["allocations", "pending"]);
-  const suspension = deployment.suspension === null ? null : members(deployment.suspension, ["idle_seconds", "retention_seconds"]);
+  const resources = members(deployment.resources, deploymentResourcesFields);
+  const suspension = deployment.suspension === null ? null : members(deployment.suspension, suspensionFields);
   const configured = hasOwn(deployment, "specification");
-  valid(strings(deployment, ["installation_id", "core_url"]) && (deployment.provider === "" || (typeof deployment.provider === "string" && hasOwn(deploymentContract.providers, deployment.provider))) && modes.has(deployment.mode as string) &&
+  valid(strings(deployment, ["installation_id", "core_url"]) && (deployment.provider === "" || (typeof deployment.provider === "string" && hasOwn(deploymentContract.providers, deployment.provider))) && isOneOf(deploymentViewModeValues, deployment.mode) &&
     [deployment.owner_epoch, deployment.generation, resources.allocations, resources.pending].every(isNonnegativeInteger) &&
     (suspension === null || [suspension.idle_seconds, suspension.retention_seconds].every(isNonnegativeInteger)) &&
     configured === hasOwn(deployment, "specification_digest") && (!configured || (typeof deployment.specification_digest === "string" && deployment.specification_digest !== "")));
   return {
-    ...deployment, rollout: projectRollout(deployment.rollout, deployment.mode, Number(resources.allocations) + Number(resources.pending)), reset: projectReset(deployment.reset, Number(resources.allocations) + Number(resources.pending)), resources: { ...resources } as SandboxDeployment["resources"], suspension: suspension && { ...suspension } as SandboxDeployment["suspension"],
+    ...deployment, rollout: projectRollout(deployment.rollout, deployment.mode, Number(resources.allocations) + Number(resources.pending)), reset: projectReset(deployment.reset, Number(resources.allocations) + Number(resources.pending)), resources: { ...resources } as unknown as SandboxDeployment["resources"], suspension: suspension && { ...suspension } as unknown as SandboxDeployment["suspension"],
     ...(configured ? { specification: projectSpecification(deployment.specification) } : {}),
     ...(e2b ? projectE2B(deployment.configuration, deployment.metadata) : {}),
   } as unknown as SandboxDeployment;
 }
 
-const nodeFields = ["rollout", "id", "name", "provider", "online", "provider_ready", "cpu_count", "available_memory_bytes", "available_disk_bytes", "running", "snapshots",
-  "last_seen_at", "max_active", "max_retained", "active", "reserved", "retained", "cleanup_pending", "created_at", "core_url", "enrollment_id"];
 /** Core omits an empty `diagnostic`, so a present one is a code; an unknown code reads as provider_unavailable. */
 function projectNode(node: Record<string, unknown>): SandboxNode {
   const { diagnostic, rollout, ...rest } = node;
@@ -288,35 +185,34 @@ function projectNode(node: Record<string, unknown>): SandboxNode {
   return { ...fields, diagnostic: normalizeSandboxNodeDiagnostic(diagnostic as string) } as unknown as SandboxNode;
 }
 function projectNodeList(value: unknown): { data: SandboxNode[] } {
-  const list = members(value, ["data"]);
+  const list = members(value, sandboxNodeListFields);
   valid(Array.isArray(list.data));
-  return { data: (list.data as unknown[]).map((entry) => projectNode(members(entry, nodeFields, ["diagnostic"]))) };
+  return { data: (list.data as unknown[]).map((entry) => projectNode(members(entry, nodeFields, nodeRequired))) };
 }
 /** A never-observed host is all null; the history lists every bucket of the range. */
 function projectNodeDetail(value: unknown, nodeId: string): SandboxNodeDetail {
-  const { host, history, ...fields } = members(value, [...nodeFields, "host", "history"], ["diagnostic"]);
+  const { host, history, ...fields } = members(value, nodeDetailFields, nodeDetailRequired);
   const node = projectNode(fields);
-  const observed = members(host, ["effective_cpu_cores", "cpu_utilization", "total_memory_bytes", "available_memory_bytes", "available_disk_bytes", "observed_at"]);
-  const buckets = members(history, ["resolution_seconds", "points"]);
+  const observed = members(host, nodeHostFields);
+  const buckets = members(history, hostHistoryFields);
   valid(sameResourceId(node.id, nodeId) && [observed.effective_cpu_cores, observed.cpu_utilization].every(nullable(measure)) &&
     [observed.total_memory_bytes, observed.available_memory_bytes, observed.available_disk_bytes].every(nullable(isNonnegativeInteger)) &&
     nullable(timestamp)(observed.observed_at) && isNonnegativeInteger(buckets.resolution_seconds) && buckets.resolution_seconds > 0 && Array.isArray(buckets.points));
   const points = (buckets.points as unknown[]).map((entry) => {
-    const point = members(entry, ["start", "cpu_utilization_max", "memory_used_bytes_max", "available_disk_bytes_min"]);
+    const point = members(entry, hostHistoryPointFields);
     valid(timestamp(point.start) && nullable(measure)(point.cpu_utilization_max) && [point.memory_used_bytes_max, point.available_disk_bytes_min].every(nullable(isNonnegativeInteger)));
-    return { ...point } as unknown as SandboxNodeHostPoint;
+    return { ...point } as unknown as HostHistoryPoint;
   });
-  return { ...node, host: { ...observed } as unknown as SandboxNodeHost, history: { resolution_seconds: buckets.resolution_seconds as number, points } };
+  return { ...node, host: { ...observed } as unknown as NodeHost, history: { resolution_seconds: buckets.resolution_seconds as number, points } };
 }
 
-const allocationFields = ["id", "node_id", "tenant_id", "session_id", "environment_id", "state", "compute_phase", "initialization", "diagnostic"];
-const allocationDiagnostics = new Set(["", "node_unavailable", "resource_missing", "compute_unconfirmed", "ownership_mismatch", "provider_unavailable"]);
+const allocationStrings = ["id", "node_id", "tenant_id", "session_id", "environment_id", "state", "compute_phase", "initialization", "diagnostic"];
 function projectAllocations(value: unknown, nodeId: string): { data: SandboxAllocation[] } {
-  const list = members(value, ["data"]);
+  const list = members(value, sandboxAllocationListFields);
   valid(Array.isArray(list.data));
   return { data: (list.data as unknown[]).map((entry) => {
-    const allocation = members(entry, [...allocationFields, "deployment_generation", "compute_phase_changed_at", "created_at"]);
-    valid(isNonnegativeInteger(allocation.deployment_generation) && strings(allocation, allocationFields) && sameResourceId(allocation.node_id as string, nodeId) && allocationDiagnostics.has(allocation.diagnostic as string) &&
+    const allocation = members(entry, nodeAllocationFields);
+    valid(isNonnegativeInteger(allocation.deployment_generation) && strings(allocation, allocationStrings) && sameResourceId(allocation.node_id as string, nodeId) && isOneOf(nodeAllocationDiagnosticValues, allocation.diagnostic) &&
       nullable(timestamp)(allocation.compute_phase_changed_at) && timestamp(allocation.created_at));
     return { ...allocation } as unknown as SandboxAllocation;
   }) };
diff --git a/packages/agents-client/src/session-diagnostics.ts b/packages/agents-client/src/session-diagnostics.ts
index c8af4468e..f2793ca82 100644
--- a/packages/agents-client/src/session-diagnostics.ts
+++ b/packages/agents-client/src/session-diagnostics.ts
@@ -1,27 +1,35 @@
-import { canonicalUuid, exactFields, isRecord, sameResourceId } from "./response-projection";
+import { canonicalUuid, exactFields, isOneOf, isRecord, sameResourceId } from "./response-projection";
 import { invalidAdminResponse } from "./admin-projection";
+import { turnStatusResourceValues } from "./generated/public-api";
+import {
+  diagnosticFailureFields, itemDiagnosticTimingFields, sessionDiagnosticFailureFields, sessionDiagnosticFailureRequired,
+  sessionDiagnosticFailureSourceValues, sessionDiagnosticsFields, sessionDiagnosticsStatusValues, turnDiagnosticsFields,
+  type DiagnosticFailure as DiagnosticFailureResource, type DiagnosticFailureCode, type ItemDiagnosticTiming,
+  type SessionDiagnosticFailure as SessionDiagnosticFailureResource, type SessionDiagnostics as SessionDiagnosticsResource,
+  type TurnDiagnostics as TurnDiagnosticsResource,
+} from "./generated/core-api";
 
-export type NativeFailureCode = "authentication_error" | "rate_limit_exceeded" | "usage_limit_exceeded" | "server_overloaded" | "server_error" | "invalid_request" | "resource_not_found" | "request_timeout" | "context_length_exceeded" | "cyber_policy" | "connection_failed";
-export type DiagnosticFailureCode = NativeFailureCode | "harness_error" | "model_provider_required" | "runtime_unavailable" | "runtime_disconnected" | "runtime_preparation_failed" | "execution_interrupted" | "delivery_unconfirmed" | "input_rejected" | "executor_protocol_error" | "core_storage_failed" | "internal_error" | "environment_connection_timeout" | "environment_unavailable" | "environment_provisioning_failed";
+// ItemDiagnosticTiming holds Core receipt intervals, distinct from the public tool-reported duration_ms.
+export type { DiagnosticFailureCode, ItemDiagnosticTiming };
+// The schema types params as a free-form object; each code that carries params has one of these shapes.
 export type ProvisioningFailureParams = { step: "setup" | "python" | "npm" | "system" | "file" | "skill" | null; index: number | null; exit_code: number | null };
 export type ConnectionFailureParams = { http_status: number | null };
-export type DiagnosticFailure = { code: DiagnosticFailureCode; params: Record<string, never> | ProvisioningFailureParams | ConnectionFailureParams; failed_at: string | null };
-export type SessionDiagnosticFailure = DiagnosticFailure & { source: "turn" | "environment" | "environment_input"; turn_id?: string };
-export type SessionDiagnostics = { object: "core.session_diagnostics"; session_id: string; status: "idle" | "in_progress" | "requires_action" | "failed"; failure: SessionDiagnosticFailure | null };
-/** Core receipt intervals, distinct from the public tool-reported duration_ms. */
-export type ItemDiagnosticTiming = { item_id: string; started_at: string; completed_at: string | null; observed_duration_ms: number | null };
-export type TurnDiagnostics = { object: "core.turn_diagnostics"; session_id: string; turn_id: string; status: string; failure: DiagnosticFailure | null; items: ItemDiagnosticTiming[]; items_truncated: boolean };
+export type DiagnosticFailure = Omit<DiagnosticFailureResource, "params"> & { params: Record<string, never> | ProvisioningFailureParams | ConnectionFailureParams };
+export type SessionDiagnosticFailure = DiagnosticFailure & Pick<SessionDiagnosticFailureResource, "source" | "turn_id">;
+export type SessionDiagnostics = Omit<SessionDiagnosticsResource, "failure"> & { failure: SessionDiagnosticFailure | null };
+export type TurnDiagnostics = Omit<TurnDiagnosticsResource, "failure"> & { failure: DiagnosticFailure | null };
 
-const turnCodes = new Set(["authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed", "harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error"]);
-const inputCodes = new Set(["environment_connection_timeout", "environment_unavailable", "model_provider_required", "internal_error"]);
-const turnStatuses = new Set(["queued", "in_progress", "waiting", "completed", "failed", "cancelled"]);
+// The schema's one code enum covers every failure source; each source produces only its subset.
+const turnCodes: readonly DiagnosticFailureCode[] = ["authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed", "harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error"];
+const inputCodes: readonly DiagnosticFailureCode[] = ["environment_connection_timeout", "environment_unavailable", "model_provider_required", "internal_error"];
+const environmentCodes: readonly DiagnosticFailureCode[] = ["environment_provisioning_failed"];
 const fields = (...values: string[]) => new Set(values);
 function timestamp(value: unknown): value is string {
   return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/u.test(value) && Number.isFinite(Date.parse(value));
 }
-function failure(value: unknown, codes: Set<string>, session = false): DiagnosticFailure {
-  if (!isRecord(value) || !exactFields(value, fields("code", "params", "failed_at", ...(session ? ["source", ...(value.source === "turn" ? ["turn_id"] : [])] : []))) ||
-      typeof value.code !== "string" || !codes.has(value.code) || !isRecord(value.params) || (value.failed_at !== null && !timestamp(value.failed_at))) return invalidAdminResponse();
+function failure(value: unknown, codes: readonly DiagnosticFailureCode[], session = false): DiagnosticFailure {
+  if (!isRecord(value) || !exactFields(value, !session ? diagnosticFailureFields : value.source === "turn" ? sessionDiagnosticFailureFields : sessionDiagnosticFailureRequired) ||
+      !isOneOf(codes, value.code) || !isRecord(value.params) || (value.failed_at !== null && !timestamp(value.failed_at))) return invalidAdminResponse();
   let params: DiagnosticFailure["params"] = {};
   if (value.code === "environment_provisioning_failed") {
     const p = value.params;
@@ -34,40 +42,40 @@ function failure(value: unknown, codes: Set<string>, session = false): Diagnosti
     if (!exactFields(p, fields("http_status")) || (p.http_status !== null && (!Number.isSafeInteger(p.http_status) || (p.http_status as number) < 100 || (p.http_status as number) > 599))) return invalidAdminResponse();
     params = { http_status: p.http_status as number | null };
   } else if (Object.keys(value.params).length !== 0) return invalidAdminResponse();
-  return { code: value.code as DiagnosticFailureCode, params, failed_at: value.failed_at as string | null };
+  return { code: value.code, params, failed_at: value.failed_at as string | null };
 }
 
 export function projectSessionDiagnostics(value: unknown, sessionId: string): SessionDiagnostics {
-  if (!isRecord(value) || !exactFields(value, fields("object", "session_id", "status", "failure")) || value.object !== "core.session_diagnostics" ||
-      canonicalUuid(value.session_id) === null || !sameResourceId(value.session_id as string, sessionId) || typeof value.status !== "string" || !["idle", "in_progress", "requires_action", "failed"].includes(value.status)) return invalidAdminResponse();
+  if (!isRecord(value) || !exactFields(value, sessionDiagnosticsFields) || value.object !== "core.session_diagnostics" ||
+      canonicalUuid(value.session_id) === null || !sameResourceId(value.session_id as string, sessionId) || !isOneOf(sessionDiagnosticsStatusValues, value.status)) return invalidAdminResponse();
   let projected: SessionDiagnosticFailure | null = null;
   if (value.status === "failed") {
-    if (!isRecord(value.failure) || typeof value.failure.source !== "string" || !["turn", "environment", "environment_input"].includes(value.failure.source)) return invalidAdminResponse();
+    if (!isRecord(value.failure) || !isOneOf(sessionDiagnosticFailureSourceValues, value.failure.source)) return invalidAdminResponse();
     const f = value.failure;
-    const source = f.source as SessionDiagnosticFailure["source"];
-    projected = { ...failure(f, source === "turn" ? turnCodes : source === "environment_input" ? inputCodes : new Set(["environment_provisioning_failed"]), true), source };
+    const source = value.failure.source;
+    projected = { ...failure(f, source === "turn" ? turnCodes : source === "environment_input" ? inputCodes : environmentCodes, true), source };
     if (source === "turn") {
       if (canonicalUuid(f.turn_id) === null) return invalidAdminResponse();
       projected.turn_id = f.turn_id as string;
     }
   } else if (value.failure !== null) return invalidAdminResponse();
-  return { object: "core.session_diagnostics", session_id: value.session_id as string, status: value.status as SessionDiagnostics["status"], failure: projected };
+  return { object: "core.session_diagnostics", session_id: value.session_id as string, status: value.status, failure: projected };
 }
 
 export function projectTurnDiagnostics(value: unknown, sessionId: string, turnId: string): TurnDiagnostics {
-  if (!isRecord(value) || !exactFields(value, fields("object", "session_id", "turn_id", "status", "failure", "items", "items_truncated")) || value.object !== "core.turn_diagnostics" ||
+  if (!isRecord(value) || !exactFields(value, turnDiagnosticsFields) || value.object !== "core.turn_diagnostics" ||
       canonicalUuid(value.session_id) === null || !sameResourceId(value.session_id as string, sessionId) || canonicalUuid(value.turn_id) === null || !sameResourceId(value.turn_id as string, turnId) ||
-      typeof value.status !== "string" || !turnStatuses.has(value.status) || !Array.isArray(value.items) || value.items.length > 1000 || typeof value.items_truncated !== "boolean" || (value.items_truncated && value.items.length !== 1000)) return invalidAdminResponse();
+      !isOneOf(turnStatusResourceValues, value.status) || !Array.isArray(value.items) || value.items.length > 1000 || typeof value.items_truncated !== "boolean" || (value.items_truncated && value.items.length !== 1000)) return invalidAdminResponse();
   const projected = value.status === "failed" ? failure(value.failure, turnCodes) : null;
   if (value.status !== "failed" && value.failure !== null) return invalidAdminResponse();
   const seen = new Set<string>();
   const items: ItemDiagnosticTiming[] = value.items.map((item: unknown) => {
-    if (!isRecord(item) || !exactFields(item, fields("item_id", "started_at", "completed_at", "observed_duration_ms")) || canonicalUuid(item.item_id) === null || !timestamp(item.started_at) ||
+    if (!isRecord(item) || !exactFields(item, itemDiagnosticTimingFields) || canonicalUuid(item.item_id) === null || !timestamp(item.started_at) ||
         (item.completed_at !== null && !timestamp(item.completed_at)) || (item.completed_at === null ? item.observed_duration_ms !== null : !Number.isSafeInteger(item.observed_duration_ms))) return invalidAdminResponse();
     const id = canonicalUuid(item.item_id)!;
     if (seen.has(id)) return invalidAdminResponse();
     seen.add(id);
     return { item_id: item.item_id as string, started_at: item.started_at, completed_at: item.completed_at as string | null, observed_duration_ms: item.observed_duration_ms as number | null };
   });
-  return { object: "core.turn_diagnostics", session_id: value.session_id as string, turn_id: value.turn_id as string, status: value.status as string, failure: projected, items, items_truncated: value.items_truncated };
+  return { object: "core.turn_diagnostics", session_id: value.session_id as string, turn_id: value.turn_id as string, status: value.status, failure: projected, items, items_truncated: value.items_truncated };
 }
diff --git a/packages/agents-client/src/types.ts b/packages/agents-client/src/types.ts
index 56a9b0f89..c9e056007 100644
--- a/packages/agents-client/src/types.ts
+++ b/packages/agents-client/src/types.ts
@@ -11,7 +11,7 @@ import type {
   PersistedAgentToolConfigParamToolSearch, PersistedAgentToolConfigParamWebSearch, ReasoningEffortResource,
   ReasoningParam, ReasoningResource, ReasoningSummaryResource, RotateVaultCredentialAuthParamStaticBearer,
   RotateVaultCredentialParams, ServiceTierResource, SessionEnvironmentStateResource, SessionEnvironmentStatusResource,
-  SessionErrorResource, SessionInputParam, SessionInputParamAgentSessionInputCancel,
+  SessionArtifactResource, SessionErrorResource, SessionInputParam, SessionInputParamAgentSessionInputCancel,
   SessionInputParamAgentSessionInputMessage, SessionInputParamAgentSessionInputToolResult,
   SessionRequiredActionResource, SessionRequiredActionResourceEnvironmentConnection,
   SessionRequiredActionResourceFunctionCall, SessionStatusResource, SkillResource, SkillVersionResource,
@@ -19,6 +19,10 @@ import type {
   VaultCredentialAuthResourceMcpOauth, VaultCredentialAuthResourceStaticBearer, VaultCredentialResource,
   VaultResource, VaultStatusParam, WebSearchLocationParam,
 } from "./generated/public-api";
+import type {
+  CoreHarness as CoreHarnessResource, ModelConfigurationSupport as ModelConfigurationSupportResource, RuntimeCPUObservation,
+  RuntimeMemoryObservation, RuntimeObservationLifecycleState, RuntimeObservationReason,
+} from "./generated/core-api";
 
 // Generated types keep their schema names in ./generated/public-api; these are the client's names for them.
 export type PageOrder = ListOrderParam;
@@ -468,6 +472,8 @@ export type SkillDeleted = DeletedSkillResource;
 /** Deleting the only remaining version also deletes its Skill. */
 export type SkillVersionDeleted = DeletedSkillVersionResource;
 
+export type SessionArtifact = SessionArtifactResource;
+
 /** Skill lists accept 0 through 100 entries; `after` is a Skill ID, or a version resource ID for version lists. */
 export type SkillListOptions = PageOptions;
 
@@ -776,29 +782,14 @@ export interface CreateSessionStreamOptions extends StreamOptions {
   onSession: (session: AgentSession) => void;
 }
 
-export type RuntimeObservationStatus = "observed" | "unsupported" | "unavailable";
-export type RuntimeLifecycleState = "active" | "sleeping" | "transitioning" | "pending" | "stopped";
-export type RuntimeObservationReason =
-  | "runtime_mode_not_observable"
-  | "allocation_pending"
-  | "runtime_not_running"
-  | "sample_timeout"
-  | "sample_unavailable";
+// Generated /core/v1 types keep their schema names in ./generated/core-api.
+export type {
+  HarnessModelConfiguration, RuntimeCPUObservation, RuntimeHistory, RuntimeMemoryObservation, RuntimeObservationReason, SessionExecutionConfiguration,
+} from "./generated/core-api";
 
 export type RuntimeUnavailableReason = Exclude<RuntimeObservationReason, "runtime_mode_not_observable">;
 
-export interface RuntimeCPUObservation {
-  usage_seconds_total: number | null;
-  capacity_cores: number | null;
-  usage_cores: number | null;
-  utilization_ratio: number | null;
-}
-
-export interface RuntimeMemoryObservation {
-  usage_bytes: number | null;
-  limit_bytes: number | null;
-}
-
+// The schema's flat observation cannot state each mode's null rules; this union does, and the client validates them.
 interface RuntimeObservationBase {
   id: string;
   object: "agent.runtime_observation";
@@ -816,7 +807,7 @@ export interface RuntimeObservedObservation extends RuntimeObservationBase {
     device_id: string | null;
     connection_generation: null;
   };
-  lifecycle_state: RuntimeLifecycleState;
+  lifecycle_state: RuntimeObservationLifecycleState;
   status: "observed";
   reason: null;
   allocation_created_at: number | null;
@@ -836,7 +827,7 @@ export interface RuntimeUnavailableObservation extends RuntimeObservationBase {
     device_id: string | null;
     connection_generation: null;
   };
-  lifecycle_state: RuntimeLifecycleState;
+  lifecycle_state: RuntimeObservationLifecycleState;
   status: "unavailable";
   reason: RuntimeUnavailableReason;
   allocation_created_at: number | null;
@@ -896,83 +887,9 @@ export interface RuntimeHistoryQuery extends ReadOptions {
   maxPoints?: number;
 }
 
-export interface RuntimeHistoryRange {
-  start: number;
-  end: number;
-}
-
-export interface RuntimeHistoryCoveragePoint {
-  start: number;
-  end: number;
-  first_observed_at: number | null;
-  last_observed_at: number | null;
-  observation_count: number;
-  observed_count: number;
-  unavailable_count: number;
-}
-
-export interface RuntimeHistoryCPU {
-  contributor_count: number;
-  utilization_ratio: number | null;
-  capacity_cores: number | null;
-}
-
-export interface RuntimeHistoryMemory {
-  contributor_count: number;
-  usage_bytes: number | null;
-  limit_bytes: number | null;
-}
-
-export interface RuntimeHistoryPoint extends RuntimeHistoryCoveragePoint {
-  cpu: RuntimeHistoryCPU | null;
-  memory: RuntimeHistoryMemory | null;
-}
-
-export interface RuntimeHistorySeries {
-  environment_id: string;
-  allocation_id: string;
-  /** Earliest retained provider start estimate for compatible uptime display. */
-  started_at: RuntimeHistoryTime;
-  provider_type: string;
-  points: RuntimeHistoryPoint[];
-}
-
-export interface RuntimeHistoryTime {
-  seconds: number;
-  nanoseconds: number;
-}
-
-export interface RuntimeHistoryCoverage {
-  retained_start: number;
-  first_sample_at: number | null;
-  last_sample_at: number | null;
-  sample_count: number;
-  expected_sample_count: number;
-  buckets: RuntimeHistoryCoveragePoint[];
-}
-
-export interface RuntimeHistoryTokenUsagePoint {
-  start: number;
-  end: number;
-  sampled_at: number;
-  input_tokens: number;
-  output_tokens: number;
-}
-
-export interface RuntimeHistory {
-  object: "agent.runtime_history";
-  source: "durable";
-  session_id: string;
-  requested_range: RuntimeHistoryRange;
-  resolution_seconds: number;
-  generated_at: number;
-  coverage: RuntimeHistoryCoverage;
-  series: RuntimeHistorySeries[];
-  token_usage: RuntimeHistoryTokenUsagePoint[];
-}
-
 export type { CoreHarnessKind, ModelProviderProtocol } from "./harness-catalog";
 
+// The model provider shapes keep `never` guards so an input and a view can never be mistaken for each other.
 /** A complete replacement bundle. API keys are write-only. */
 export interface ModelProviderInput {
   protocol: ModelProviderProtocol;
@@ -992,9 +909,6 @@ export interface ModelProviderView {
   api_key?: never;
 }
 
-/** A harness's deployment default model provider in Core. The key is never returned. */
-export type ProviderObservationErrorCode = "authentication_error" | "connection_failed" | "rate_limit_exceeded" | "usage_limit_exceeded" | "server_overloaded" | "server_error" | "resource_not_found" | "request_timeout" | "invalid_request";
-
 /** Native model parameters validated by the selected harness. An empty object clears them. */
 export type HarnessConfig = Record<string, unknown>;
 
@@ -1010,35 +924,15 @@ export interface ModelConfigurationView {
   harness_config: HarnessConfig;
 }
 
-export interface HarnessModelConfiguration extends ModelConfigurationView {
-  last_used_at: string | null;
-  last_error_code: ProviderObservationErrorCode | null;
-  last_error_at: string | null;
-  object: "core.model_configuration";
-  harness: CoreHarnessKind;
-  updated_at: string;
-}
-
-/** Adapter build support, independent of runtime readiness or model availability. */
-export interface ModelConfigurationSupport {
-  /** Ordered supported native protocols; the first is the default. */
-  protocols: ModelProviderInput["protocol"][];
-  accepts_harness_config: boolean;
-  token_limits_required: boolean;
-}
+// The schema declares protocols as plain strings; the harness catalog names them.
+/** Adapter build support, independent of runtime readiness or model availability. Ordered protocols; the first is the default. */
+export type ModelConfigurationSupport = Omit<ModelConfigurationSupportResource, "protocols"> & { protocols: ModelProviderProtocol[] };
 
 /**
  * A harness this Core build supports. `enabled` and `default` are read-only views of
  * the process configuration; `model_configuration` is the deployment default, or null.
  */
-export interface CoreHarness {
-  object: "core.harness";
-  id: CoreHarnessKind;
-  enabled: boolean;
-  default: boolean;
-  model_configuration: HarnessModelConfiguration | null;
-  model_configuration_support: ModelConfigurationSupport;
-}
+export type CoreHarness = Omit<CoreHarnessResource, "model_configuration_support"> & { model_configuration_support: ModelConfigurationSupport };
 
 /** Native parameter inheritance follows the extension contract; null provider clears it. */
 export interface SavedAgentCoreInput {
@@ -1055,23 +949,6 @@ export interface SavedAgentCore {
 
 export type AgentsCoreSelection = AgentsCore;
 
-export type ExecutionConfigurationSource = "session" | "agent" | "deployment" | "unknown";
-
-/** Immutable committed selections, not live execution health. */
-export interface SessionExecutionConfiguration {
-  object: "agent.session.execution_configuration";
-  schema_version: 1;
-  session_id: string;
-  model: { value: string | null; source: ExecutionConfigurationSource };
-  harness: { value: string | null; source: ExecutionConfigurationSource };
-  harness_config: { value: HarnessConfig; source: ExecutionConfigurationSource };
-  model_provider: {
-    source: ExecutionConfigurationSource;
-    status: "available" | "redacted" | "unavailable";
-    configuration: ModelProviderView | null;
-  };
-}
-
 export interface AgentCore {
   listAgents(options?: PageOptions): Promise<ListPage<SavedAgent>>;
   createAgent(input: CreateAgentInput): Promise<SavedAgent>;
diff --git a/scripts/generate-public-api.py b/scripts/generate-public-api.py
index f6b778cab..8b92496ff 100644
--- a/scripts/generate-public-api.py
+++ b/scripts/generate-public-api.py
@@ -12,6 +12,7 @@
 CONTRACT = ROOT / 'contracts/agents-api'
 SHAPES = ROOT / 'services/core/internal/api/official_shapes.gen.go'
 CLIENT_TYPES = ROOT / 'packages/agents-client/src/generated/public-api.ts'
+CORE_CLIENT_TYPES = ROOT / 'packages/agents-client/src/generated/core-api.ts'
 # Agent configuration request bodies checked by Core's shape walker.
 REQUEST_SHAPES = ('CreateAgentParams', 'UpdateAgentParams', 'SessionAgentConfigParam')
 HTTP_METHODS = {'get', 'post', 'put', 'patch', 'delete', 'head', 'options'}
@@ -350,16 +351,16 @@ def ts_type(schema):
     return {'string': 'string', 'integer': 'number', 'number': 'number', 'boolean': 'boolean', 'null': 'null'}.get(kind, 'unknown')
 
 
-def ts_module(schemas, source):
+def ts_module(schemas, source, header=()):
     """Project parsed schemas (OpenAPI components.schemas or Swagger definitions) onto TypeScript.
 
     Each enum X gets xValues; each object X gets xFields, plus xRequired when some
     fields are optional; each discriminated union X maps its tags to the variants'
-    field names in xFields.
+    field names in xFields. Header lines follow the generated-file notice.
     """
     if len({ts_name(name) for name in schemas}) != len(schemas):
         raise ValueError('TypeScript names collide')
-    lines = [f'// Code generated by scripts/generate-public-api.py from {source}; DO NOT EDIT.', '']
+    lines = [f'// Code generated by scripts/generate-public-api.py from {source}; DO NOT EDIT.', *header, '']
     unions = []
     for name, schema in sorted(schemas.items(), key=lambda item: ts_name(item[0])):
         typ = ts_name(name)
@@ -381,6 +382,44 @@ def ts_module(schemas, source):
     return ('\n'.join(lines + unions) + '\n').encode()
 
 
+def core_module(document, public, bindings):
+    """Project the Swagger definitions the Core document's paths reach onto TypeScript beside the public types.
+
+    The v1 types the public schema owns are imported under their public names. A
+    name that collides once ts_name strips the Go package keeps the package as a
+    prefix, and each inline enum becomes a definition named after its owner and
+    field, so that it gets its values.
+    """
+    definitions, names, refs = document['definitions'], {}, re.compile(r'"#/definitions/([^"]+)"')
+    for name in definitions:
+        sources = bindings.get(name.removeprefix('v1.'), {}).get('sources', [])
+        if name in public:
+            names[name] = ts_name(name)
+        elif name.startswith('v1.') and len(sources) == 1 and sources[0].split('/')[-1] in public:
+            names[name] = ts_name(sources[0])
+    imported, local, pending = set(names.values()), [], [document['paths']]
+    while pending:
+        for ref in refs.findall(json.dumps(pending.pop())):
+            if ref not in names and ref not in local:
+                local.append(ref)
+                pending.append(definitions[ref])
+    taken = [ts_name(name) for name in local] + list(imported)
+    for name in local:
+        names[name] = ts_name(name) if taken.count(ts_name(name)) == 1 else name.split('.')[0].capitalize() + ts_name(name)
+    schemas = {}
+    for name in local:
+        schema = schemas[names[name]] = json.loads(refs.sub(lambda ref: f'"#/definitions/{names[ref[1]]}"', json.dumps(definitions[name])))
+        for field, member in schema.get('properties', {}).items():
+            target = member.get('items', member)
+            if len(target.get('enum', [])) > 1:
+                enum = names[name] + ''.join(part.capitalize() for part in field.split('_'))
+                schemas[enum] = {'type': target.pop('type'), 'enum': target.pop('enum')}
+                target['$ref'] = '#/definitions/' + enum
+    used = sorted(imported.intersection(refs.findall(json.dumps(schemas))))
+    header = ['import type { ' + ', '.join(used) + ' } from "./public-api";'] if used else []
+    return ts_module(schemas, 'contracts/agents-api/core.openapi.yaml', header)
+
+
 def write(path, data, check):
     if check:
         if not path.exists() or path.read_bytes() != data:
@@ -395,7 +434,10 @@ def main():
     stage = parser.add_mutually_exclusive_group(required=True)
     stage.add_argument('--swag-roots', type=Path, help='Temporary entry points for Go-owned extension types')
     stage.add_argument('--extensions', type=Path, help='JSON definitions projected from Core extension types')
+    parser.add_argument('--core', type=Path, help='The /core/v1 document as JSON, required with --extensions')
     args = parser.parse_args()
+    if args.extensions and not args.core:
+        parser.error('--extensions requires --core')
     source, pin = read_source()
     bindings = json.loads((CONTRACT / 'go-bindings.json').read_text())
     owners = extension_owners(bindings)
@@ -409,6 +451,7 @@ def main():
         # JSON is a YAML subset and keeps generation independent of PyYAML.
         write(CONTRACT / 'openapi.yaml', (json.dumps(doc, indent=2, ensure_ascii=False) + '\n').encode(), args.check)
         write(CLIENT_TYPES, ts_module(doc['components']['schemas'], 'contracts/agents-api/openapi.yaml'), args.check)
+        write(CORE_CLIENT_TYPES, core_module(json.loads(args.core.read_text()), doc['components']['schemas'], bindings), args.check)
         routes = sorted(method.upper() + ' ' + re.sub(r'\{[^}]*\}', '{}', path) for path, item in doc['paths'].items() for method in item if method in HTTP_METHODS)
         write(CONTRACT / 'upstream-routes.json', (json.dumps({'openapi_commit': pin['openapi']['commit'], 'generator': 'scripts/generate-public-api.py', 'routes': routes}, indent=2) + '\n').encode(), args.check)
 
diff --git a/scripts/generate-public-api.test.py b/scripts/generate-public-api.test.py
index 83d346df1..ca05c253b 100644
--- a/scripts/generate-public-api.test.py
+++ b/scripts/generate-public-api.test.py
@@ -112,6 +112,28 @@ def test_client_types_project_values_fields_and_unions(self):
         ):
             self.assertIn(line, generated)
 
+    def test_core_types_import_public_names_and_hoist_inline_enums(self):
+        ref = '#/definitions/'
+        document = {'paths': {'/things': {'get': {'responses': {'200': {'schema': {'$ref': ref + 'api.Thing'}}}}}}, 'definitions': {
+            'api.Thing': {'type': 'object', 'required': ['color'], 'properties': {
+                'color': {'type': 'string', 'enum': ['red', 'blue']}, 'tags': {'type': 'array', 'items': {'type': 'string', 'enum': ['a', 'b']}},
+                'shared': {'$ref': ref + 'v1.Shared'}, 'first': {'$ref': ref + 'one.Page'}, 'second': {'$ref': ref + 'two.Page'},
+            }},
+            'one.Page': {'type': 'object', 'properties': {'id': {'type': 'string'}}},
+            'two.Page': {'type': 'object', 'properties': {'id': {'type': 'string'}}},
+            'v1.Shared': {'type': 'object'},
+            'api.Unused': {'type': 'object'},
+        }}
+        bindings = {'Shared': {'sources': ['#/components/schemas/SharedResource']}}
+        generated = generator.core_module(document, {'SharedResource': {}}, bindings).decode()
+        for line in (
+            'import type { SharedResource } from "./public-api";', '  color: ThingColor;', '  tags?: ThingTags[];',
+            'export const thingColorValues = ["red", "blue"] as const;', '  shared?: SharedResource;',
+            '  first?: OnePage;', '  second?: TwoPage;',
+        ):
+            self.assertIn(line, generated)
+        self.assertNotIn('Unused', generated)
+
     def test_every_public_reference_resolves_and_no_other_apis_leak(self):
         self.assertEqual({p.split('/')[1] for p in self.public['paths']}, {'agents', 'vaults', 'files', 'skills'})
         generator.prune_components(copy.deepcopy(self.public))
diff --git a/scripts/openapi-split/main.go b/scripts/openapi-split/main.go
index 66d4f7438..64cf47796 100644
--- a/scripts/openapi-split/main.go
+++ b/scripts/openapi-split/main.go
@@ -1,5 +1,5 @@
 // Command openapi-split emits internal contracts and exports Go definitions
-// for the public contract extension overlay.
+// for the public contract extension overlay and the Core client types.
 package main
 
 import (
@@ -22,19 +22,20 @@ const (
 func main() {
 	check := flag.Bool("check", false, "check generated internal contracts without changing them")
 	flag.Parse()
-	if flag.NArg() != 4 {
-		fmt.Fprintln(os.Stderr, "usage: openapi-split [--check] INPUT EXTENSIONS_OUTPUT CORE_OUTPUT RUNTIME_OUTPUT")
+	if flag.NArg() != 5 {
+		fmt.Fprintln(os.Stderr, "usage: openapi-split [--check] INPUT EXTENSIONS_OUTPUT CORE_JSON_OUTPUT CORE_OUTPUT RUNTIME_OUTPUT")
 		os.Exit(1)
 	}
-	if err := run(flag.Arg(0), flag.Arg(1), flag.Arg(2), flag.Arg(3), *check); err != nil {
+	if err := run(flag.Arg(0), flag.Arg(1), flag.Arg(2), flag.Arg(3), flag.Arg(4), *check); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 
-// run exports Go-owned definitions for the public extension overlay and emits
-// the two internal contracts. Public operations come only from official OpenAPI.
-func run(input, extensionOutput, coreOutput, runtimeOutput string, check bool) error {
+// run exports Go-owned definitions for the public extension overlay and the
+// Core client types, and emits the two internal contracts. Public operations
+// come only from official OpenAPI.
+func run(input, extensionOutput, coreJSONOutput, coreOutput, runtimeOutput string, check bool) error {
 	raw, err := os.ReadFile(input)
 	if err != nil {
 		return err
@@ -43,23 +44,17 @@ func run(input, extensionOutput, coreOutput, runtimeOutput string, check bool) e
 	if err := yaml.Unmarshal(raw, &source); err != nil {
 		return err
 	}
-	var definitions map[string]any
-	if err := field(source.Content[0], "definitions").Decode(&definitions); err != nil {
-		return err
-	}
-	extensionJSON, err := json.Marshal(definitions)
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(extensionOutput, extensionJSON, 0644); err != nil {
+	if err := writeJSON(field(source.Content[0], "definitions"), extensionOutput); err != nil {
 		return err
 	}
 	for _, output := range []struct {
 		path, title, description string
 		surface                  int
+		// jsonOutput, when set, receives the document as JSON.
+		jsonOutput string
 	}{
-		{coreOutput, "OpenAgentCore Core API", "Deployment and operations routes under /core/v1 for Core Web's server and operator scripts. Every operation requires the Core key; Project API keys and machine credentials are not accepted.", coreSurface},
-		{runtimeOutput, "OpenAgentCore Machine Connections", "Machine connection routes under /api/v1. Sandbox nodes authenticate with a one-use enrollment token or their node credential; Project API keys and the Core key are not accepted. See each operation's security requirements.", runtimeSurface},
+		{coreOutput, "OpenAgentCore Core API", "Deployment and operations routes under /core/v1 for Core Web's server and operator scripts. Every operation requires the Core key; Project API keys and machine credentials are not accepted.", coreSurface, coreJSONOutput},
+		{runtimeOutput, "OpenAgentCore Machine Connections", "Machine connection routes under /api/v1. Sandbox nodes authenticate with a one-use enrollment token or their node credential; Project API keys and the Core key are not accepted. See each operation's security requirements.", runtimeSurface, ""},
 	} {
 		var doc yaml.Node
 		if err := yaml.Unmarshal(raw, &doc); err != nil {
@@ -84,9 +79,28 @@ func run(input, extensionOutput, coreOutput, runtimeOutput string, check bool) e
 		if err := writeGenerated(output.path, buf.Bytes(), check); err != nil {
 			return err
 		}
+		if output.jsonOutput != "" {
+			if err := writeJSON(root, output.jsonOutput); err != nil {
+				return err
+			}
+		}
 	}
 	return nil
 }
+
+// writeJSON writes a YAML node as JSON, which scripts/generate-public-api.py
+// reads without a YAML parser.
+func writeJSON(node *yaml.Node, path string) error {
+	var value map[string]any
+	if err := node.Decode(&value); err != nil {
+		return err
+	}
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(path, raw, 0644)
+}
 func field(n *yaml.Node, key string) *yaml.Node {
 	if n != nil {
 		for i := 0; i+1 < len(n.Content); i += 2 {
diff --git a/scripts/openapi-split/main_test.go b/scripts/openapi-split/main_test.go
index fa8b65ea7..542d47ca5 100644
--- a/scripts/openapi-split/main_test.go
+++ b/scripts/openapi-split/main_test.go
@@ -14,6 +14,7 @@ func TestInternalContractsAndExtensionDefinitions(t *testing.T) {
 	d := t.TempDir()
 	input := filepath.Join(d, "combined.yaml")
 	project := filepath.Join(d, "extensions.json")
+	coreJSON := filepath.Join(d, "core.json")
 	core := filepath.Join(d, "core.yaml")
 	machine := filepath.Join(d, "runtime.yaml")
 	raw := `swagger: "2.0"
@@ -72,7 +73,7 @@ securityDefinitions:
 	if err := os.WriteFile(input, []byte(raw), 0600); err != nil {
 		t.Fatal(err)
 	}
-	if err := run(input, project, core, machine, false); err != nil {
+	if err := run(input, project, coreJSON, core, machine, false); err != nil {
 		t.Fatal(err)
 	}
 	for _, check := range []struct{ path, base, own, other, definition, absent string }{
@@ -98,16 +99,20 @@ securityDefinitions:
 			t.Fatal("reference closure was not preserved")
 		}
 	}
-	rawDefinitions, err := os.ReadFile(project)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var definitions map[string]any
-	if err := json.Unmarshal(rawDefinitions, &definitions); err != nil {
-		t.Fatal(err)
+	// Extensions keep every definition; the Core document as JSON only its own.
+	var extensions map[string]any
+	var coreDocument struct{ Definitions map[string]any }
+	for path, value := range map[string]any{project: &extensions, coreJSON: &coreDocument} {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := json.Unmarshal(raw, value); err != nil {
+			t.Fatal(err)
+		}
 	}
-	if len(definitions) != 4 {
-		t.Fatalf("missing extension dependencies: %v", definitions)
+	if len(extensions) != 4 || len(coreDocument.Definitions) != 2 || coreDocument.Definitions["Node"] == nil {
+		t.Fatalf("definitions: extensions %v, core %v", extensions, coreDocument.Definitions)
 	}
 	// Every internal document keeps only the schemes its operations use.
 	for path, want := range map[string]string{core: "DeploymentAdminAuth", machine: "NodeAuth"} {
diff --git a/services/core/internal/adminaudit/reader.go b/services/core/internal/adminaudit/reader.go
index 81265e682..921e68e57 100644
--- a/services/core/internal/adminaudit/reader.go
+++ b/services/core/internal/adminaudit/reader.go
@@ -29,22 +29,22 @@ type Filter struct {
 // Operation is one administrator write. ProjectID is null for
 // deployment-wide writes, such as deployment default model providers.
 type Operation struct {
-	ID                string    `json:"id"`
-	CreatedAt         time.Time `json:"created_at"`
-	AdminCredentialID string    `json:"admin_credential_id"`
-	ActorLabel        string    `json:"actor_label"`
-	Action            string    `json:"action"`
-	ProjectID         *string   `json:"project_id" extensions:"x-nullable"`
-	ResourceType      string    `json:"resource_type"`
-	ResourceID        string    `json:"resource_id"`
-	RequestID         string    `json:"request_id"`
-	TraceID           string    `json:"trace_id"`
+	ID                string    `json:"id" binding:"required"`
+	CreatedAt         time.Time `json:"created_at" binding:"required"`
+	AdminCredentialID string    `json:"admin_credential_id" binding:"required"`
+	ActorLabel        string    `json:"actor_label" binding:"required"`
+	Action            string    `json:"action" binding:"required"`
+	ProjectID         *string   `json:"project_id" extensions:"x-nullable" binding:"required"`
+	ResourceType      string    `json:"resource_type" binding:"required"`
+	ResourceID        string    `json:"resource_id" binding:"required"`
+	RequestID         string    `json:"request_id" binding:"required"`
+	TraceID           string    `json:"trace_id" binding:"required"`
 }
 
 type Page struct {
-	Data       []Operation `json:"data"`
-	HasMore    bool        `json:"has_more"`
-	NextCursor string      `json:"next_cursor"`
+	Data       []Operation `json:"data" binding:"required"`
+	HasMore    bool        `json:"has_more" binding:"required"`
+	NextCursor string      `json:"next_cursor" binding:"required"`
 }
 
 // Validate checks f and returns it with the default page size applied. The
diff --git a/services/core/internal/api/admin_runtime.go b/services/core/internal/api/admin_runtime.go
index c11dae6aa..77f96d043 100644
--- a/services/core/internal/api/admin_runtime.go
+++ b/services/core/internal/api/admin_runtime.go
@@ -10,8 +10,8 @@ import (
 )
 
 type AdminRuntimeObservation struct {
-	ProjectID   string                        `json:"project_id"`
-	Observation AdminRuntimeObservationDetail `json:"observation"`
+	ProjectID   string                        `json:"project_id" binding:"required"`
+	Observation AdminRuntimeObservationDetail `json:"observation" binding:"required"`
 }
 
 // AdminRuntimeObservationDetail adds administrator-only measurements to the
@@ -29,11 +29,11 @@ type RuntimeDiskObservation struct {
 	LimitBytes *uint64 `json:"limit_bytes" extensions:"x-nullable" binding:"required" minimum:"1"`
 }
 type AdminRuntimeObservationList struct {
-	Object  string                    `json:"object"`
-	Data    []AdminRuntimeObservation `json:"data"`
-	HasMore bool                      `json:"has_more"`
-	FirstID *string                   `json:"first_id"`
-	LastID  *string                   `json:"last_id"`
+	Object  string                    `json:"object" enums:"list" binding:"required"`
+	Data    []AdminRuntimeObservation `json:"data" binding:"required"`
+	HasMore bool                      `json:"has_more" binding:"required"`
+	FirstID *string                   `json:"first_id" extensions:"x-nullable" binding:"required"`
+	LastID  *string                   `json:"last_id" extensions:"x-nullable" binding:"required"`
 }
 
 // @Summary List Runtime observations across managed Projects
diff --git a/services/core/internal/api/admin_session_archive.go b/services/core/internal/api/admin_session_archive.go
index 2a7b0e46e..e5354358a 100644
--- a/services/core/internal/api/admin_session_archive.go
+++ b/services/core/internal/api/admin_session_archive.go
@@ -15,7 +15,7 @@ type SessionArchive interface {
 }
 
 type AdminSessionArchiveRequest struct {
-	ExpectedGeneration uint64 `json:"expected_generation"`
+	ExpectedGeneration uint64 `json:"expected_generation" binding:"required"`
 }
 
 // @Summary Release a managed Session's execution resources while retaining history
diff --git a/services/core/internal/api/admin_summary.go b/services/core/internal/api/admin_summary.go
index 83c1a8188..2b2b835da 100644
--- a/services/core/internal/api/admin_summary.go
+++ b/services/core/internal/api/admin_summary.go
@@ -12,31 +12,31 @@ import (
 )
 
 type AdminSessionCounts struct {
-	Total          int64 `json:"total"`
-	Idle           int64 `json:"idle"`
-	InProgress     int64 `json:"in_progress"`
-	RequiresAction int64 `json:"requires_action"`
-	Failed         int64 `json:"failed"`
+	Total          int64 `json:"total" binding:"required"`
+	Idle           int64 `json:"idle" binding:"required"`
+	InProgress     int64 `json:"in_progress" binding:"required"`
+	RequiresAction int64 `json:"requires_action" binding:"required"`
+	Failed         int64 `json:"failed" binding:"required"`
 }
 type AdminUsageCoverage struct {
-	MeasuredSessions int64    `json:"measured_sessions"`
-	TotalSessions    int64    `json:"total_sessions"`
-	Ratio            *float64 `json:"ratio"`
+	MeasuredSessions int64    `json:"measured_sessions" binding:"required"`
+	TotalSessions    int64    `json:"total_sessions" binding:"required"`
+	Ratio            *float64 `json:"ratio" extensions:"x-nullable" binding:"required"`
 }
 type AdminSummaryRow struct {
-	ProjectID    string                     `json:"project_id"`
-	KeyID        *string                    `json:"key_id"`
-	AgentID      *string                    `json:"agent_id"`
-	Assets       *sessions.AdminAssetCounts `json:"assets"`
-	Sessions     AdminSessionCounts         `json:"sessions"`
-	Usage        v1.TokenUsage              `json:"usage"`
-	Coverage     AdminUsageCoverage         `json:"coverage"`
-	LastActiveAt *int64                     `json:"last_active_at"`
+	ProjectID    string                     `json:"project_id" binding:"required"`
+	KeyID        *string                    `json:"key_id" extensions:"x-nullable" binding:"required"`
+	AgentID      *string                    `json:"agent_id" extensions:"x-nullable" binding:"required"`
+	Assets       *sessions.AdminAssetCounts `json:"assets" extensions:"x-nullable" binding:"required"`
+	Sessions     AdminSessionCounts         `json:"sessions" binding:"required"`
+	Usage        v1.TokenUsage              `json:"usage" binding:"required"`
+	Coverage     AdminUsageCoverage         `json:"coverage" binding:"required"`
+	LastActiveAt *int64                     `json:"last_active_at" extensions:"x-nullable" binding:"required"`
 }
 type AdminSummaryResponse struct {
-	Data       []AdminSummaryRow `json:"data"`
-	HasMore    bool              `json:"has_more"`
-	NextCursor string            `json:"next_cursor"`
+	Data       []AdminSummaryRow `json:"data" binding:"required"`
+	HasMore    bool              `json:"has_more" binding:"required"`
+	NextCursor string            `json:"next_cursor" binding:"required"`
 }
 
 func adminSummaryTime(r *http.Request, name string) (*time.Time, error) {
diff --git a/services/core/internal/api/environment_executor_management.go b/services/core/internal/api/environment_executor_management.go
index 5bbb1ee57..8e20745e8 100644
--- a/services/core/internal/api/environment_executor_management.go
+++ b/services/core/internal/api/environment_executor_management.go
@@ -22,7 +22,7 @@ type ExecutorConnections interface {
 }
 
 type EnvironmentExecutorCredentialRequest struct {
-	KeyID  string `json:"key_id" format:"uuid"`
+	KeyID  string `json:"key_id" format:"uuid" binding:"required"`
 	Rotate bool   `json:"rotate,omitempty"`
 }
 
diff --git a/services/core/internal/api/installation.go b/services/core/internal/api/installation.go
index 8d18088ac..e99e574ed 100644
--- a/services/core/internal/api/installation.go
+++ b/services/core/internal/api/installation.go
@@ -10,40 +10,40 @@ import (
 // Installation reports Core's installation facts. Core reads them from its
 // environment and build; configuration is the process settings it loaded.
 type Installation struct {
-	Object string `json:"object" enums:"core.installation"`
+	Object string `json:"object" enums:"core.installation" binding:"required"`
 	// The ID in OAC_INSTALLATION_ID_FILE.
-	InstallationID string `json:"installation_id"`
+	InstallationID string `json:"installation_id" binding:"required"`
 	// OAC_PUBLIC_URL: the origin applications, nodes, sandboxes and self-hosted executors use.
-	PublicURL string `json:"public_url"`
+	PublicURL string `json:"public_url" binding:"required"`
 	// public_url followed by /v1.
-	APIBaseURL string `json:"api_base_url"`
+	APIBaseURL string `json:"api_base_url" binding:"required"`
 	// True when public_url names a loopback host, reachable only from the Core host.
-	LocalOnly bool `json:"local_only"`
+	LocalOnly bool `json:"local_only" binding:"required"`
 	// Full source commit Core was built from; null for development builds.
-	SourceCommit *string `json:"source_commit" extensions:"x-nullable"`
+	SourceCommit *string `json:"source_commit" extensions:"x-nullable" binding:"required"`
 	// The process settings Core loaded.
-	Configuration   InstallationConfiguration  `json:"configuration"`
-	AddressBindings deployment.AddressBindings `json:"address_bindings"`
+	Configuration   InstallationConfiguration  `json:"configuration" binding:"required"`
+	AddressBindings deployment.AddressBindings `json:"address_bindings" binding:"required"`
 }
 
 // InstallationConfiguration is the process settings Core loaded.
 type InstallationConfiguration struct {
-	Settings []InstallationSetting `json:"settings"`
+	Settings []InstallationSetting `json:"settings" binding:"required"`
 }
 
 type InstallationSetting struct {
 	// Dotted config.json key, such as ports.core.
-	Key string `json:"key"`
+	Key string `json:"key" binding:"required"`
 	// Applied value; always null for a sensitive setting.
-	Value   any `json:"value" extensions:"x-nullable"`
-	Default any `json:"default" extensions:"x-nullable"`
+	Value   any `json:"value" extensions:"x-nullable" binding:"required"`
+	Default any `json:"default" extensions:"x-nullable" binding:"required"`
 	// Present only for a sensitive setting: whether it has a value.
 	Configured *bool `json:"configured,omitempty"`
 	// False for settings fixed at installation.
-	Changeable bool `json:"changeable"`
-	Sensitive  bool `json:"sensitive"`
+	Changeable bool `json:"changeable" binding:"required"`
+	Sensitive  bool `json:"sensitive" binding:"required"`
 	// Services that restart when the setting changes.
-	Restarts []string `json:"restarts"`
+	Restarts []string `json:"restarts" enums:"core,web" binding:"required"`
 }
 
 // InstallationBindings counts what is bound to the current public URL.
diff --git a/services/core/internal/api/project_api_keys.go b/services/core/internal/api/project_api_keys.go
index bf36c6b4e..bb37ff844 100644
--- a/services/core/internal/api/project_api_keys.go
+++ b/services/core/internal/api/project_api_keys.go
@@ -32,10 +32,10 @@ type ProjectsReader interface {
 	ResolveAPIKey(context.Context, [sha256.Size]byte) (projects.KeyBinding, error)
 }
 type ProjectRequest struct {
-	Name string `json:"name"`
+	Name string `json:"name" binding:"required"`
 }
 type ProjectAPIKeyRequest struct {
-	Name string `json:"name"`
+	Name string `json:"name" binding:"required"`
 }
 
 func (h *Handler) registerProjectAPIKeyRoutes(r chi.Router) {
diff --git a/services/core/internal/api/sandbox_manager.go b/services/core/internal/api/sandbox_manager.go
index aa1143b3c..57713a257 100644
--- a/services/core/internal/api/sandbox_manager.go
+++ b/services/core/internal/api/sandbox_manager.go
@@ -12,19 +12,19 @@ import (
 )
 
 type SandboxNodeList struct {
-	Data []deployment.Node `json:"data"`
+	Data []deployment.Node `json:"data" binding:"required"`
 }
 type SandboxAllocationList struct {
-	Data []deployment.NodeAllocation `json:"data"`
+	Data []deployment.NodeAllocation `json:"data" binding:"required"`
 }
 type SandboxEnrollmentToken struct {
-	Token     string    `json:"token"`
-	ExpiresAt time.Time `json:"expires_at"`
+	Token     string    `json:"token" binding:"required"`
+	ExpiresAt time.Time `json:"expires_at" binding:"required"`
 	// Public, non-secret handle of this command; never a credential. The node it registers reports the same value as enrollment_id.
-	EnrollmentID string `json:"enrollment_id"`
+	EnrollmentID string `json:"enrollment_id" binding:"required"`
 }
 type SandboxMutationResponse struct {
-	ID      string `json:"id"`
+	ID      string `json:"id" binding:"required"`
 	Deleted bool   `json:"deleted,omitempty"`
 	Updated bool   `json:"updated,omitempty"`
 }
diff --git a/services/core/internal/api/session_diagnostics.go b/services/core/internal/api/session_diagnostics.go
index 9e14f19b5..759e6aab4 100644
--- a/services/core/internal/api/session_diagnostics.go
+++ b/services/core/internal/api/session_diagnostics.go
@@ -11,39 +11,39 @@ import (
 )
 
 type DiagnosticFailure struct {
-	Code     string           `json:"code" enums:"harness_error,model_provider_required,runtime_unavailable,runtime_disconnected,runtime_preparation_failed,execution_interrupted,delivery_unconfirmed,input_rejected,executor_protocol_error,core_storage_failed,internal_error,environment_connection_timeout,environment_unavailable,environment_provisioning_failed,authentication_error,rate_limit_exceeded,usage_limit_exceeded,server_overloaded,server_error,invalid_request,resource_not_found,request_timeout,context_length_exceeded,cyber_policy,connection_failed"`
-	Params   CoreErrorDetails `json:"params" swaggertype:"object"`
-	FailedAt *time.Time       `json:"failed_at" extensions:"x-nullable"`
+	Code     string           `json:"code" binding:"required" enums:"harness_error,model_provider_required,runtime_unavailable,runtime_disconnected,runtime_preparation_failed,execution_interrupted,delivery_unconfirmed,input_rejected,executor_protocol_error,core_storage_failed,internal_error,environment_connection_timeout,environment_unavailable,environment_provisioning_failed,authentication_error,rate_limit_exceeded,usage_limit_exceeded,server_overloaded,server_error,invalid_request,resource_not_found,request_timeout,context_length_exceeded,cyber_policy,connection_failed"`
+	Params   CoreErrorDetails `json:"params" swaggertype:"object" binding:"required"`
+	FailedAt *time.Time       `json:"failed_at" extensions:"x-nullable" binding:"required"`
 }
 
 type SessionDiagnosticFailure struct {
 	DiagnosticFailure
-	Source string `json:"source" enums:"turn,environment,environment_input"`
+	Source string `json:"source" binding:"required" enums:"turn,environment,environment_input"`
 	TurnID string `json:"turn_id,omitempty"`
 }
 
 type SessionDiagnostics struct {
-	Object    string                    `json:"object" enums:"core.session_diagnostics"`
-	SessionID string                    `json:"session_id"`
-	Status    string                    `json:"status" enums:"idle,in_progress,requires_action,failed"`
-	Failure   *SessionDiagnosticFailure `json:"failure" extensions:"x-nullable"`
+	Object    string                    `json:"object" enums:"core.session_diagnostics" binding:"required"`
+	SessionID string                    `json:"session_id" binding:"required"`
+	Status    string                    `json:"status" enums:"idle,in_progress,requires_action,failed" binding:"required"`
+	Failure   *SessionDiagnosticFailure `json:"failure" extensions:"x-nullable" binding:"required"`
 }
 
 type ItemDiagnosticTiming struct {
-	ItemID             string     `json:"item_id"`
-	StartedAt          time.Time  `json:"started_at"`
-	CompletedAt        *time.Time `json:"completed_at" extensions:"x-nullable"`
-	ObservedDurationMS *int64     `json:"observed_duration_ms" extensions:"x-nullable"`
+	ItemID             string     `json:"item_id" binding:"required"`
+	StartedAt          time.Time  `json:"started_at" binding:"required"`
+	CompletedAt        *time.Time `json:"completed_at" extensions:"x-nullable" binding:"required"`
+	ObservedDurationMS *int64     `json:"observed_duration_ms" extensions:"x-nullable" binding:"required"`
 }
 
 type TurnDiagnostics struct {
-	Object         string                 `json:"object" enums:"core.turn_diagnostics"`
-	SessionID      string                 `json:"session_id"`
-	TurnID         string                 `json:"turn_id"`
-	Status         string                 `json:"status"`
-	Failure        *DiagnosticFailure     `json:"failure" extensions:"x-nullable"`
-	Items          []ItemDiagnosticTiming `json:"items"`
-	ItemsTruncated bool                   `json:"items_truncated"`
+	Object         string                 `json:"object" enums:"core.turn_diagnostics" binding:"required"`
+	SessionID      string                 `json:"session_id" binding:"required"`
+	TurnID         string                 `json:"turn_id" binding:"required"`
+	Status         string                 `json:"status" binding:"required"`
+	Failure        *DiagnosticFailure     `json:"failure" extensions:"x-nullable" binding:"required"`
+	Items          []ItemDiagnosticTiming `json:"items" binding:"required"`
+	ItemsTruncated bool                   `json:"items_truncated" binding:"required"`
 }
 
 // SessionAdmin serves the administrator's per-Session reads: Turn diagnostics
diff --git a/services/core/internal/api/write_audit.go b/services/core/internal/api/write_audit.go
index 8f4b8e258..fd1ca82de 100644
--- a/services/core/internal/api/write_audit.go
+++ b/services/core/internal/api/write_audit.go
@@ -20,7 +20,7 @@ type WriteAudit interface {
 }
 
 type ResourceOwnerList struct {
-	Data []writeaudit.ResourceOwner `json:"data"`
+	Data []writeaudit.ResourceOwner `json:"data" binding:"required"`
 }
 
 func (h *Handler) writeAuditScope(w http.ResponseWriter, r *http.Request, allowed ...string) (url.Values, string, bool) {
diff --git a/services/core/internal/coremetrics/types.go b/services/core/internal/coremetrics/types.go
index 9aafca860..611efe657 100644
--- a/services/core/internal/coremetrics/types.go
+++ b/services/core/internal/coremetrics/types.go
@@ -13,84 +13,84 @@ import (
 var ErrInvalidRange = errors.New("invalid Core metrics range")
 
 type Latency struct {
-	P50 *float64 `json:"p50" extensions:"x-nullable"`
-	P95 *float64 `json:"p95" extensions:"x-nullable"`
+	P50 *float64 `json:"p50" extensions:"x-nullable" binding:"required"`
+	P95 *float64 `json:"p95" extensions:"x-nullable" binding:"required"`
 }
 type Range struct {
-	Start             time.Time `json:"start"`
-	End               time.Time `json:"end"`
-	ResolutionSeconds int64     `json:"resolution_seconds"`
+	Start             time.Time `json:"start" binding:"required"`
+	End               time.Time `json:"end" binding:"required"`
+	ResolutionSeconds int64     `json:"resolution_seconds" binding:"required"`
 }
 type ServiceState struct {
-	Status         string     `json:"status"`
-	Revision       *string    `json:"revision" extensions:"x-nullable"`
-	StartedAt      *time.Time `json:"started_at" extensions:"x-nullable"`
-	ExecutionOwner *bool      `json:"execution_owner" extensions:"x-nullable"`
+	Status         string     `json:"status" enums:"running,degraded" binding:"required"`
+	Revision       *string    `json:"revision" extensions:"x-nullable" binding:"required"`
+	StartedAt      *time.Time `json:"started_at" extensions:"x-nullable" binding:"required"`
+	ExecutionOwner *bool      `json:"execution_owner" extensions:"x-nullable" binding:"required"`
 }
 type ExecutionBucket struct {
-	Start          time.Time `json:"start"`
-	Queued         *int64    `json:"queued" extensions:"x-nullable"`
-	InProgress     *int64    `json:"in_progress" extensions:"x-nullable"`
-	QueueWaitP95MS *float64  `json:"queue_wait_p95_ms" extensions:"x-nullable"`
+	Start          time.Time `json:"start" binding:"required"`
+	Queued         *int64    `json:"queued" extensions:"x-nullable" binding:"required"`
+	InProgress     *int64    `json:"in_progress" extensions:"x-nullable" binding:"required"`
+	QueueWaitP95MS *float64  `json:"queue_wait_p95_ms" extensions:"x-nullable" binding:"required"`
 }
 type DatabaseBucket struct {
-	Start     time.Time `json:"start"`
-	PingP95MS *float64  `json:"ping_p95_ms" extensions:"x-nullable"`
-	PoolInUse *int64    `json:"pool_in_use" extensions:"x-nullable"`
+	Start     time.Time `json:"start" binding:"required"`
+	PingP95MS *float64  `json:"ping_p95_ms" extensions:"x-nullable" binding:"required"`
+	PoolInUse *int64    `json:"pool_in_use" extensions:"x-nullable" binding:"required"`
 }
 type Pool struct {
-	InUse *int64 `json:"in_use" extensions:"x-nullable"`
-	Idle  *int64 `json:"idle" extensions:"x-nullable"`
-	Max   *int64 `json:"max" extensions:"x-nullable"`
+	InUse *int64 `json:"in_use" extensions:"x-nullable" binding:"required"`
+	Idle  *int64 `json:"idle" extensions:"x-nullable" binding:"required"`
+	Max   *int64 `json:"max" extensions:"x-nullable" binding:"required"`
 }
 type Execution struct {
-	SlotsInUse          int64             `json:"slots_in_use"`
-	SlotsTotal          int64             `json:"slots_total"`
-	QueuedTurns         *int64            `json:"queued_turns" extensions:"x-nullable"`
-	WaitingForDaemon    *int64            `json:"waiting_for_daemon" extensions:"x-nullable"`
-	InProgressTurns     *int64            `json:"in_progress_turns" extensions:"x-nullable"`
-	OldestQueuedSeconds *float64          `json:"oldest_queued_seconds" extensions:"x-nullable"`
-	ConnectedDaemons    int64             `json:"connected_daemons"`
-	Interrupted         *int64            `json:"interrupted" extensions:"x-nullable"`
-	Unavailable         *int64            `json:"unavailable" extensions:"x-nullable"`
-	QueueWaitMS         Latency           `json:"queue_wait_ms"`
-	Series              []ExecutionBucket `json:"series"`
+	SlotsInUse          int64             `json:"slots_in_use" binding:"required"`
+	SlotsTotal          int64             `json:"slots_total" binding:"required"`
+	QueuedTurns         *int64            `json:"queued_turns" extensions:"x-nullable" binding:"required"`
+	WaitingForDaemon    *int64            `json:"waiting_for_daemon" extensions:"x-nullable" binding:"required"`
+	InProgressTurns     *int64            `json:"in_progress_turns" extensions:"x-nullable" binding:"required"`
+	OldestQueuedSeconds *float64          `json:"oldest_queued_seconds" extensions:"x-nullable" binding:"required"`
+	ConnectedDaemons    int64             `json:"connected_daemons" binding:"required"`
+	Interrupted         *int64            `json:"interrupted" extensions:"x-nullable" binding:"required"`
+	Unavailable         *int64            `json:"unavailable" extensions:"x-nullable" binding:"required"`
+	QueueWaitMS         Latency           `json:"queue_wait_ms" binding:"required"`
+	Series              []ExecutionBucket `json:"series" binding:"required"`
 }
 type Database struct {
-	PingMS    Latency          `json:"ping_ms"`
-	Pool      Pool             `json:"pool"`
-	SizeBytes *int64           `json:"size_bytes" extensions:"x-nullable"`
-	Series    []DatabaseBucket `json:"series"`
+	PingMS    Latency          `json:"ping_ms" binding:"required"`
+	Pool      Pool             `json:"pool" binding:"required"`
+	SizeBytes *int64           `json:"size_bytes" extensions:"x-nullable" binding:"required"`
+	Series    []DatabaseBucket `json:"series" binding:"required"`
 }
 type Job struct {
-	ID        string     `json:"id"`
-	Status    string     `json:"status"`
-	LastRunAt *time.Time `json:"last_run_at" extensions:"x-nullable"`
-	Processed *int64     `json:"processed" extensions:"x-nullable"`
-	Failed    *int64     `json:"failed" extensions:"x-nullable"`
+	ID        string     `json:"id" binding:"required"`
+	Status    string     `json:"status" enums:"ok,failing,stopped,unknown" binding:"required"`
+	LastRunAt *time.Time `json:"last_run_at" extensions:"x-nullable" binding:"required"`
+	Processed *int64     `json:"processed" extensions:"x-nullable" binding:"required"`
+	Failed    *int64     `json:"failed" extensions:"x-nullable" binding:"required"`
 }
 type Process struct {
-	MemoryBytes      *uint64         `json:"memory_bytes" extensions:"x-nullable"`
-	Goroutines       *int64          `json:"goroutines" extensions:"x-nullable"`
-	CPUCores         *float64        `json:"cpu_cores" extensions:"x-nullable"`
-	CPULimitCores    *float64        `json:"cpu_limit_cores" extensions:"x-nullable"`
-	RSSBytes         *uint64         `json:"rss_bytes" extensions:"x-nullable"`
-	MemoryLimitBytes *uint64         `json:"memory_limit_bytes" extensions:"x-nullable"`
-	Series           []ProcessBucket `json:"series"`
+	MemoryBytes      *uint64         `json:"memory_bytes" extensions:"x-nullable" binding:"required"`
+	Goroutines       *int64          `json:"goroutines" extensions:"x-nullable" binding:"required"`
+	CPUCores         *float64        `json:"cpu_cores" extensions:"x-nullable" binding:"required"`
+	CPULimitCores    *float64        `json:"cpu_limit_cores" extensions:"x-nullable" binding:"required"`
+	RSSBytes         *uint64         `json:"rss_bytes" extensions:"x-nullable" binding:"required"`
+	MemoryLimitBytes *uint64         `json:"memory_limit_bytes" extensions:"x-nullable" binding:"required"`
+	Series           []ProcessBucket `json:"series" binding:"required"`
 }
 type ProcessBucket struct {
-	Start    time.Time `json:"start"`
-	CPUCores *float64  `json:"cpu_cores" extensions:"x-nullable"`
-	RSSBytes *uint64   `json:"rss_bytes" extensions:"x-nullable"`
+	Start    time.Time `json:"start" binding:"required"`
+	CPUCores *float64  `json:"cpu_cores" extensions:"x-nullable" binding:"required"`
+	RSSBytes *uint64   `json:"rss_bytes" extensions:"x-nullable" binding:"required"`
 }
 type View struct {
-	Object    string       `json:"object"`
-	Range     Range        `json:"range"`
-	Service   ServiceState `json:"service"`
-	Execution Execution    `json:"execution"`
-	Database  Database     `json:"database"`
-	Jobs      []Job        `json:"jobs"`
-	Process   Process      `json:"process"`
+	Object    string       `json:"object" enums:"core.metrics" binding:"required"`
+	Range     Range        `json:"range" binding:"required"`
+	Service   ServiceState `json:"service" binding:"required"`
+	Execution Execution    `json:"execution" binding:"required"`
+	Database  Database     `json:"database" binding:"required"`
+	Jobs      []Job        `json:"jobs" binding:"required"`
+	Process   Process      `json:"process" binding:"required"`
 }
 
 // Sample contains only measurements, never resource identities or error text.
diff --git a/services/core/internal/deployment/allocation.go b/services/core/internal/deployment/allocation.go
index 02324ff49..c51f2527b 100644
--- a/services/core/internal/deployment/allocation.go
+++ b/services/core/internal/deployment/allocation.go
@@ -127,19 +127,19 @@ type LifecyclePlacement struct {
 
 // NodeAllocation is an unreleased allocation a node serves.
 type NodeAllocation struct {
-	DeploymentGeneration uint64 `json:"deployment_generation"`
-	Diagnostic           string `json:"diagnostic"`
-	ID                   string `json:"id"`
-	NodeID               string `json:"node_id"`
-	TenantID             string `json:"tenant_id"`
-	SessionID            string `json:"session_id"`
-	EnvironmentID        string `json:"environment_id"`
-	State                string `json:"state"`
-	ComputePhase         string `json:"compute_phase"`
+	DeploymentGeneration uint64 `json:"deployment_generation" binding:"required"`
+	Diagnostic           string `json:"diagnostic" enums:",node_unavailable,resource_missing,compute_unconfirmed,ownership_mismatch,provider_unavailable" binding:"required"`
+	ID                   string `json:"id" binding:"required"`
+	NodeID               string `json:"node_id" binding:"required"`
+	TenantID             string `json:"tenant_id" binding:"required"`
+	SessionID            string `json:"session_id" binding:"required"`
+	EnvironmentID        string `json:"environment_id" binding:"required"`
+	State                string `json:"state" binding:"required"`
+	ComputePhase         string `json:"compute_phase" binding:"required"`
 	// The time the allocation entered its current compute_phase, or null when unknown; an allocation that existed before Core recorded it reports null until its next phase change. For a suspended microsandbox allocation, this time plus the deployment's snapshot retention tells roughly when Core reclaims it.
-	ComputePhaseChangedAt *time.Time `json:"compute_phase_changed_at" extensions:"x-nullable"`
-	Initialization        string     `json:"initialization"`
-	CreatedAt             time.Time  `json:"created_at"`
+	ComputePhaseChangedAt *time.Time `json:"compute_phase_changed_at" extensions:"x-nullable" binding:"required"`
+	Initialization        string     `json:"initialization" binding:"required"`
+	CreatedAt             time.Time  `json:"created_at" binding:"required"`
 }
 
 // observationDiagnostics are the diagnostics an observation records; empty
diff --git a/services/core/internal/deployment/node.go b/services/core/internal/deployment/node.go
index 485d464e8..164d54234 100644
--- a/services/core/internal/deployment/node.go
+++ b/services/core/internal/deployment/node.go
@@ -47,39 +47,39 @@ type NodeHealth struct {
 	Host *NodeHost `json:"-"`
 	// Fixed reason for the last reported unreadiness; absent while the provider is ready. Clients treat an unknown value as provider_unavailable.
 	Diagnostic           string `json:"diagnostic,omitempty" enums:"provider_unavailable,host_unsupported,artifacts_unavailable,runtime_download_failed,runtime_image_unavailable,capacity_insufficient"`
-	ProviderReady        bool   `json:"provider_ready"`
-	CPUCount             *int64 `json:"cpu_count"`
-	AvailableMemoryBytes *int64 `json:"available_memory_bytes"`
-	AvailableDiskBytes   *int64 `json:"available_disk_bytes"`
+	ProviderReady        bool   `json:"provider_ready" binding:"required"`
+	CPUCount             *int64 `json:"cpu_count" extensions:"x-nullable" binding:"required"`
+	AvailableMemoryBytes *int64 `json:"available_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytes   *int64 `json:"available_disk_bytes" extensions:"x-nullable" binding:"required"`
 }
 
 type Node struct {
-	Rollout NodeRollout `json:"rollout"`
+	Rollout NodeRollout `json:"rollout" binding:"required"`
 	NodeHealth
-	Running        int64      `json:"running"`
-	Snapshots      int64      `json:"snapshots"`
-	ID             string     `json:"id"`
-	Name           string     `json:"name"`
-	Provider       string     `json:"provider"`
-	Online         bool       `json:"online"`
-	LastSeenAt     *time.Time `json:"last_seen_at"`
-	MaxActive      int        `json:"max_active"`
-	MaxRetained    int        `json:"max_retained"`
-	Active         int64      `json:"active"`
-	Reserved       int64      `json:"reserved"`
-	Retained       int64      `json:"retained"`
-	CleanupPending int64      `json:"cleanup_pending"`
-	CreatedAt      time.Time  `json:"created_at"`
+	Running        int64      `json:"running" binding:"required"`
+	Snapshots      int64      `json:"snapshots" binding:"required"`
+	ID             string     `json:"id" binding:"required"`
+	Name           string     `json:"name" binding:"required"`
+	Provider       string     `json:"provider" binding:"required"`
+	Online         bool       `json:"online" binding:"required"`
+	LastSeenAt     *time.Time `json:"last_seen_at" extensions:"x-nullable" binding:"required"`
+	MaxActive      int        `json:"max_active" binding:"required"`
+	MaxRetained    int        `json:"max_retained" binding:"required"`
+	Active         int64      `json:"active" binding:"required"`
+	Reserved       int64      `json:"reserved" binding:"required"`
+	Retained       int64      `json:"retained" binding:"required"`
+	CleanupPending int64      `json:"cleanup_pending" binding:"required"`
+	CreatedAt      time.Time  `json:"created_at" binding:"required"`
 	// The Core address this node enrolled with. A node whose address differs
 	// from the installation public URL receives no new sandboxes; re-add it.
-	CoreURL string `json:"core_url"`
+	CoreURL string `json:"core_url" binding:"required"`
 	// The enrollment_id of the command that registered this node (POST /core/v1/sandbox/enrollment-tokens); null for nodes enrolled before Core recorded it.
-	EnrollmentID *string `json:"enrollment_id" extensions:"x-nullable"`
+	EnrollmentID *string `json:"enrollment_id" extensions:"x-nullable" binding:"required"`
 }
 
 type NodeUpdate struct {
-	Name      string `json:"name"`
-	MaxActive int    `json:"max_active"`
+	Name      string `json:"name" binding:"required"`
+	MaxActive int    `json:"max_active" binding:"required"`
 	// Docker never suspends, so Core replaces this with max_active; microsandbox uses both limits.
 	MaxRetained int `json:"max_retained"`
 }
@@ -104,28 +104,28 @@ type NodeConfiguration struct {
 
 // NodeHost is deployment telemetry, not sandbox capacity authority.
 type NodeHost struct {
-	EffectiveCPUCores    *float64   `json:"effective_cpu_cores" extensions:"x-nullable"`
-	CPUUtilization       *float64   `json:"cpu_utilization" extensions:"x-nullable"`
-	TotalMemoryBytes     *int64     `json:"total_memory_bytes" extensions:"x-nullable"`
-	AvailableMemoryBytes *int64     `json:"available_memory_bytes" extensions:"x-nullable"`
-	AvailableDiskBytes   *int64     `json:"available_disk_bytes" extensions:"x-nullable"`
-	ObservedAt           *time.Time `json:"observed_at" extensions:"x-nullable"`
+	EffectiveCPUCores    *float64   `json:"effective_cpu_cores" extensions:"x-nullable" binding:"required"`
+	CPUUtilization       *float64   `json:"cpu_utilization" extensions:"x-nullable" binding:"required"`
+	TotalMemoryBytes     *int64     `json:"total_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableMemoryBytes *int64     `json:"available_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytes   *int64     `json:"available_disk_bytes" extensions:"x-nullable" binding:"required"`
+	ObservedAt           *time.Time `json:"observed_at" extensions:"x-nullable" binding:"required"`
 }
 
 type HostHistoryPoint struct {
-	Start                 time.Time `json:"start"`
-	CPUUtilizationMax     *float64  `json:"cpu_utilization_max" extensions:"x-nullable"`
-	MemoryUsedBytesMax    *int64    `json:"memory_used_bytes_max" extensions:"x-nullable"`
-	AvailableDiskBytesMin *int64    `json:"available_disk_bytes_min" extensions:"x-nullable"`
+	Start                 time.Time `json:"start" binding:"required"`
+	CPUUtilizationMax     *float64  `json:"cpu_utilization_max" extensions:"x-nullable" binding:"required"`
+	MemoryUsedBytesMax    *int64    `json:"memory_used_bytes_max" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytesMin *int64    `json:"available_disk_bytes_min" extensions:"x-nullable" binding:"required"`
 }
 
 type HostHistory struct {
-	ResolutionSeconds int64              `json:"resolution_seconds"`
-	Points            []HostHistoryPoint `json:"points"`
+	ResolutionSeconds int64              `json:"resolution_seconds" binding:"required"`
+	Points            []HostHistoryPoint `json:"points" binding:"required"`
 }
 
 type NodeDetail struct {
 	Node
-	Host    NodeHost    `json:"host"`
-	History HostHistory `json:"history"`
+	Host    NodeHost    `json:"host" binding:"required"`
+	History HostHistory `json:"history" binding:"required"`
 }
diff --git a/services/core/internal/deployment/public_url.go b/services/core/internal/deployment/public_url.go
index 1bf556928..e6d947160 100644
--- a/services/core/internal/deployment/public_url.go
+++ b/services/core/internal/deployment/public_url.go
@@ -73,10 +73,10 @@ func (o PublicOrigin) InstallerBase() string { return o.origin + "/api/v1/agent-
 // the address current at the time, and self-hosted executors were installed
 // with an advertised remote_url.
 type AddressBindings struct {
-	Nodes               int64 `json:"nodes"`
-	NodesOnOtherAddress int64 `json:"nodes_on_other_address"`
-	HostedSandboxes     int64 `json:"hosted_sandboxes"`
-	SelfHostedExecutors int64 `json:"self_hosted_executors"`
+	Nodes               int64 `json:"nodes" binding:"required"`
+	NodesOnOtherAddress int64 `json:"nodes_on_other_address" binding:"required"`
+	HostedSandboxes     int64 `json:"hosted_sandboxes" binding:"required"`
+	SelfHostedExecutors int64 `json:"self_hosted_executors" binding:"required"`
 }
 
 // AddressBindings counts what is bound to the installation public URL.
diff --git a/services/core/internal/deployment/view.go b/services/core/internal/deployment/view.go
index 4c6beb6bc..f45b90afe 100644
--- a/services/core/internal/deployment/view.go
+++ b/services/core/internal/deployment/view.go
@@ -9,79 +9,79 @@ import (
 
 // View is the sandbox deployment as administrators read it.
 type View struct {
-	Rollout              Rollout                 `json:"rollout"`
+	Rollout              Rollout                 `json:"rollout" binding:"required"`
 	Specification        *sandbox.DeploymentSpec `json:"specification,omitempty"`
 	SpecificationDigest  string                  `json:"specification_digest,omitempty"`
-	Generation           uint64                  `json:"generation"`
-	Mode                 string                  `json:"mode"`
-	Resources            Resources               `json:"resources"`
+	Generation           uint64                  `json:"generation" binding:"required"`
+	Mode                 string                  `json:"mode" enums:",nodes,direct" binding:"required"`
+	Resources            Resources               `json:"resources" binding:"required"`
 	Configuration        json.RawMessage         `json:"configuration,omitempty" swaggertype:"object"`
 	Metadata             json.RawMessage         `json:"metadata,omitempty" swaggertype:"object"`
-	CredentialConfigured bool                    `json:"credential_configured"`
+	CredentialConfigured bool                    `json:"credential_configured" binding:"required"`
 	// Idle suspension policy; null unless the selected Provider declares checkpoint support.
-	Suspension     *Suspension `json:"suspension" extensions:"x-nullable"`
-	InstallationID string      `json:"installation_id"`
-	Provider       string      `json:"provider"`
-	Reset          *Reset      `json:"reset" extensions:"x-nullable"`
-	OwnerEpoch     uint64      `json:"owner_epoch"`
+	Suspension     *Suspension `json:"suspension" extensions:"x-nullable" binding:"required"`
+	InstallationID string      `json:"installation_id" binding:"required"`
+	Provider       string      `json:"provider" binding:"required"`
+	Reset          *Reset      `json:"reset" extensions:"x-nullable" binding:"required"`
+	OwnerEpoch     uint64      `json:"owner_epoch" binding:"required"`
 	// Read-only: the installation public URL (OAC_PUBLIC_URL), which nodes and sandboxes use to reach Core. The deployment API does not accept it.
-	CoreURL string `json:"core_url"`
+	CoreURL string `json:"core_url" binding:"required"`
 }
 
 // Resources counts what still belongs to the deployment.
 type Resources struct {
-	Allocations int64 `json:"allocations"`
-	Pending     int64 `json:"pending"`
+	Allocations int64 `json:"allocations" binding:"required"`
+	Pending     int64 `json:"pending" binding:"required"`
 }
 
 // Suspension is Core's idle suspension policy, which applies to every Provider
 // that declares checkpoint support.
 type Suspension struct {
-	IdleSeconds      int64 `json:"idle_seconds"`
-	RetentionSeconds int64 `json:"retention_seconds"`
+	IdleSeconds      int64 `json:"idle_seconds" binding:"required"`
+	RetentionSeconds int64 `json:"retention_seconds" binding:"required"`
 }
 
 type NodeRollout struct {
 	// Target preparation, independent of an old pin's serving readiness.
-	State string `json:"state" enums:"ready,preparing,failed,update_required,unknown"`
+	State string `json:"state" enums:"ready,preparing,failed,update_required,unknown" binding:"required"`
 	// Durable serving-generation pin; online and provider_ready still gate placement.
-	ReadyGeneration *uint64 `json:"ready_generation" extensions:"x-nullable"`
+	ReadyGeneration *uint64 `json:"ready_generation" extensions:"x-nullable" binding:"required"`
 	Diagnostic      string  `json:"diagnostic,omitempty" enums:"provider_unavailable,host_unsupported,artifacts_unavailable,runtime_download_failed,runtime_image_unavailable,capacity_insufficient"`
 }
 
 type RolloutNodes struct {
-	Ready          int64 `json:"ready"`
-	Preparing      int64 `json:"preparing"`
-	Failed         int64 `json:"failed"`
-	UpdateRequired int64 `json:"update_required"`
-	Unknown        int64 `json:"unknown"`
+	Ready          int64 `json:"ready" binding:"required"`
+	Preparing      int64 `json:"preparing" binding:"required"`
+	Failed         int64 `json:"failed" binding:"required"`
+	UpdateRequired int64 `json:"update_required" binding:"required"`
+	Unknown        int64 `json:"unknown" binding:"required"`
 }
 
 type Rollout struct {
-	State                       string        `json:"state" enums:"settled,preparing"`
-	PreviousGenerationSandboxes int64         `json:"previous_generation_sandboxes"`
-	Nodes                       *RolloutNodes `json:"nodes" extensions:"x-nullable"`
+	State                       string        `json:"state" enums:"settled,preparing" binding:"required"`
+	PreviousGenerationSandboxes int64         `json:"previous_generation_sandboxes" binding:"required"`
+	Nodes                       *RolloutNodes `json:"nodes" extensions:"x-nullable" binding:"required"`
 }
 
 // Reset contains only durable state and a single-snapshot resource partition.
 type Reset struct {
-	Clear       string         `json:"clear"`
-	RequestedAt time.Time      `json:"requested_at"`
-	DeadlineAt  *time.Time     `json:"deadline_at" extensions:"x-nullable"`
-	ForcedAt    *time.Time     `json:"forced_at" extensions:"x-nullable"`
-	Remaining   ResetRemaining `json:"remaining"`
+	Clear       string         `json:"clear" enums:"auto,force" binding:"required"`
+	RequestedAt time.Time      `json:"requested_at" binding:"required"`
+	DeadlineAt  *time.Time     `json:"deadline_at" extensions:"x-nullable" binding:"required"`
+	ForcedAt    *time.Time     `json:"forced_at" extensions:"x-nullable" binding:"required"`
+	Remaining   ResetRemaining `json:"remaining" binding:"required"`
 }
 
 type ResetRemaining struct {
-	Busy           int64              `json:"busy"`
-	Idle           int64              `json:"idle"`
-	Cleanup        int64              `json:"cleanup"`
-	OnOfflineNodes int64              `json:"on_offline_nodes"`
-	OfflineNodes   []ResetOfflineNode `json:"offline_nodes"`
+	Busy           int64              `json:"busy" binding:"required"`
+	Idle           int64              `json:"idle" binding:"required"`
+	Cleanup        int64              `json:"cleanup" binding:"required"`
+	OnOfflineNodes int64              `json:"on_offline_nodes" binding:"required"`
+	OfflineNodes   []ResetOfflineNode `json:"offline_nodes" binding:"required"`
 }
 
 type ResetOfflineNode struct {
-	NodeID    string `json:"node_id"`
-	Name      string `json:"name"`
-	Resources int64  `json:"resources"`
+	NodeID    string `json:"node_id" binding:"required"`
+	Name      string `json:"name" binding:"required"`
+	Resources int64  `json:"resources" binding:"required"`
 }
diff --git a/services/core/internal/projects/api_key.go b/services/core/internal/projects/api_key.go
index 05c64dc8b..15df1a460 100644
--- a/services/core/internal/projects/api_key.go
+++ b/services/core/internal/projects/api_key.go
@@ -12,18 +12,18 @@ import (
 // APIKey is the safe metadata of a Project API key. Core stores only the
 // secret's SHA-256 digest and its display prefix.
 type APIKey struct {
-	ID        string     `json:"id"`
-	ProjectID string     `json:"project_id"`
-	Name      string     `json:"name"`
-	Prefix    string     `json:"prefix"`
-	CreatedAt time.Time  `json:"created_at"`
-	RevokedAt *time.Time `json:"revoked_at"`
+	ID        string     `json:"id" binding:"required"`
+	ProjectID string     `json:"project_id" binding:"required"`
+	Name      string     `json:"name" binding:"required"`
+	Prefix    string     `json:"prefix" binding:"required"`
+	CreatedAt time.Time  `json:"created_at" binding:"required"`
+	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable" binding:"required"`
 }
 
 // IssuedAPIKey carries the secret once, in the response that issues it.
 type IssuedAPIKey struct {
 	APIKey
-	Key string `json:"key"`
+	Key string `json:"key" binding:"required"`
 }
 
 // KeyBinding is an active key with the principal it authenticates as.
@@ -34,8 +34,8 @@ type KeyBinding struct {
 
 // KeyPage is one page of a Project's keys ordered by ID.
 type KeyPage struct {
-	Data    []APIKey `json:"data"`
-	HasMore bool     `json:"has_more"`
+	Data    []APIKey `json:"data" binding:"required"`
+	HasMore bool     `json:"has_more" binding:"required"`
 }
 
 // keyPrefixLength covers "pc_" and eight secret characters.
diff --git a/services/core/internal/projects/project.go b/services/core/internal/projects/project.go
index 869fc3894..2c2a2d6cc 100644
--- a/services/core/internal/projects/project.go
+++ b/services/core/internal/projects/project.go
@@ -8,11 +8,11 @@ import (
 
 // Project is a Core Project as administrators see it.
 type Project struct {
-	ID             string     `json:"id"`
-	Name           string     `json:"name"`
-	CreatedAt      time.Time  `json:"created_at"`
-	ArchivedAt     *time.Time `json:"archived_at"`
-	ActiveKeyCount int64      `json:"active_key_count"`
+	ID             string     `json:"id" binding:"required"`
+	Name           string     `json:"name" binding:"required"`
+	CreatedAt      time.Time  `json:"created_at" binding:"required"`
+	ArchivedAt     *time.Time `json:"archived_at" extensions:"x-nullable" binding:"required"`
+	ActiveKeyCount int64      `json:"active_key_count" binding:"required"`
 	TenantID       string     `json:"-"`
 }
 
@@ -24,8 +24,8 @@ type Binding struct {
 
 // Page is one page of Projects ordered by ID.
 type Page struct {
-	Data    []Project `json:"data"`
-	HasMore bool      `json:"has_more"`
+	Data    []Project `json:"data" binding:"required"`
+	HasMore bool      `json:"has_more" binding:"required"`
 }
 
 // MaxListLimit bounds one page of Projects or API keys.
diff --git a/services/core/internal/sandbox/deployment.go b/services/core/internal/sandbox/deployment.go
index dbfda8746..4b96acb13 100644
--- a/services/core/internal/sandbox/deployment.go
+++ b/services/core/internal/sandbox/deployment.go
@@ -24,8 +24,8 @@ func validationBound(value uint32) *uint32 { return &value }
 // Resources describes one managed sandbox, independently of node concurrency.
 // Disk bounds are available only where the native provider enforces them.
 type Resources struct {
-	CPUs               uint32 `json:"cpus"`
-	MemoryMiB          uint32 `json:"memory_mib"`
+	CPUs               uint32 `json:"cpus" binding:"required"`
+	MemoryMiB          uint32 `json:"memory_mib" binding:"required"`
 	RootDiskMiB        uint32 `json:"root_disk_mib,omitempty"`
 	EnvironmentDiskMiB uint32 `json:"environment_disk_mib,omitempty"`
 }
@@ -59,12 +59,12 @@ func (r Resources) ValidatePolicy(provider string, rules DeploymentPolicy) error
 // may address the same archive by config ID or OCI manifest digest; microsandbox
 // has its own imported OCI identity. These are not interchangeable hashes.
 type RuntimeRelease struct {
-	SourceCommit        string `json:"source_commit"`
-	ImageID             string `json:"image_id"`
-	ImageManifestDigest string `json:"image_manifest_digest"`
-	MicrosandboxRef     string `json:"microsandbox_ref"`
-	RuntimeSHA256       string `json:"runtime_sha256"`
-	FirmwareSHA256      string `json:"firmware_sha256"`
+	SourceCommit        string `json:"source_commit" binding:"required"`
+	ImageID             string `json:"image_id" binding:"required"`
+	ImageManifestDigest string `json:"image_manifest_digest" binding:"required"`
+	MicrosandboxRef     string `json:"microsandbox_ref" binding:"required"`
+	RuntimeSHA256       string `json:"runtime_sha256" binding:"required"`
+	FirmwareSHA256      string `json:"firmware_sha256" binding:"required"`
 }
 
 func (r RuntimeRelease) Validate() error {
@@ -78,7 +78,7 @@ func (r RuntimeRelease) Validate() error {
 }
 
 type DeploymentSpec struct {
-	Resources Resources       `json:"resources"`
+	Resources Resources       `json:"resources" binding:"required"`
 	Runtime   *RuntimeRelease `json:"runtime,omitempty"`
 }
 
diff --git a/services/core/internal/sessions/admin.go b/services/core/internal/sessions/admin.go
index 3db0ce646..ab9ae4f58 100644
--- a/services/core/internal/sessions/admin.go
+++ b/services/core/internal/sessions/admin.go
@@ -21,12 +21,12 @@ type AdminSummaryFilter struct{ CreatedAfter, CreatedBefore *time.Time }
 
 // AdminAssetCounts counts a tenant's assets.
 type AdminAssetCounts struct {
-	Agents               int64 `json:"agents"`
-	Skills               int64 `json:"skills"`
-	EnvironmentTemplates int64 `json:"environment_templates"`
-	Files                int64 `json:"files"`
-	Vaults               int64 `json:"vaults"`
-	Credentials          int64 `json:"credentials"`
+	Agents               int64 `json:"agents" binding:"required"`
+	Skills               int64 `json:"skills" binding:"required"`
+	EnvironmentTemplates int64 `json:"environment_templates" binding:"required"`
+	Files                int64 `json:"files" binding:"required"`
+	Vaults               int64 `json:"vaults" binding:"required"`
+	Credentials          int64 `json:"credentials" binding:"required"`
 }
 
 // AdminReader reads the administrator's cross-Project Session views.
diff --git a/services/core/internal/sessions/executor_credentials.go b/services/core/internal/sessions/executor_credentials.go
index 9fb1ea412..d7581791f 100644
--- a/services/core/internal/sessions/executor_credentials.go
+++ b/services/core/internal/sessions/executor_credentials.go
@@ -31,17 +31,17 @@ type ExecutorCredentialReader interface {
 }
 
 type IssuedExecutorCredential struct {
-	KeyID         string `json:"key_id"`
+	KeyID         string `json:"key_id" binding:"required"`
 	EnvironmentID string `json:"environment_id,omitempty"`
-	Token         string `json:"executor_token"`
+	Token         string `json:"executor_token" binding:"required"`
 }
 
 // ExecutorCredential is the metadata of one Environment executor credential.
 // Its secret is returned only when issued or rotated.
 type ExecutorCredential struct {
-	KeyID     string     `json:"key_id" format:"uuid"`
-	CreatedAt time.Time  `json:"created_at"`
-	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable"`
+	KeyID     string     `json:"key_id" format:"uuid" binding:"required"`
+	CreatedAt time.Time  `json:"created_at" binding:"required"`
+	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable" binding:"required"`
 }
 
 // ExecutorConnectionState is an internal durable observation, never a wire payload.
diff --git a/services/core/internal/sessions/reads.go b/services/core/internal/sessions/reads.go
index 883dd24b8..9f4a167bd 100644
--- a/services/core/internal/sessions/reads.go
+++ b/services/core/internal/sessions/reads.go
@@ -67,7 +67,7 @@ type TurnDiagnosticsSnapshot struct {
 // ManagedArchive reports resource disposal, not archive request provenance
 // or Turn settlement. Existing expiry and failed provisioning use the same states.
 type ManagedArchive struct {
-	SessionID     string `json:"session_id"`
-	EnvironmentID string `json:"environment_id"`
-	State         string `json:"state"`
+	SessionID     string `json:"session_id" binding:"required"`
+	EnvironmentID string `json:"environment_id" binding:"required"`
+	State         string `json:"state" enums:"active,cleanup_pending,released" binding:"required"`
 }
diff --git a/services/core/internal/writeaudit/reader.go b/services/core/internal/writeaudit/reader.go
index e1a4be872..367f752df 100644
--- a/services/core/internal/writeaudit/reader.go
+++ b/services/core/internal/writeaudit/reader.go
@@ -20,31 +20,31 @@ type Reader interface {
 // APIKey is the recorded identity of the key that made a write, with its
 // current revocation time.
 type APIKey struct {
-	ID        string     `json:"id"`
-	Name      string     `json:"name"`
-	Prefix    string     `json:"prefix"`
-	Kind      string     `json:"kind"`
-	RevokedAt *time.Time `json:"revoked_at"`
+	ID        string     `json:"id" binding:"required"`
+	Name      string     `json:"name" binding:"required"`
+	Prefix    string     `json:"prefix" binding:"required"`
+	Kind      string     `json:"kind" enums:"issued" binding:"required"`
+	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable" binding:"required"`
 }
 
 // ResourceOwner is the recorded creator of one resource. APIKey is null for a
 // resource without recorded creation provenance.
 type ResourceOwner struct {
-	ResourceID string  `json:"resource_id"`
-	APIKey     *APIKey `json:"api_key"`
+	ResourceID string  `json:"resource_id" binding:"required"`
+	APIKey     *APIKey `json:"api_key" extensions:"x-nullable" binding:"required"`
 }
 
 // Operation is one committed write.
 type Operation struct {
-	ID           string    `json:"id"`
-	Action       string    `json:"action"`
-	ResourceType string    `json:"resource_type"`
-	ResourceID   string    `json:"resource_id"`
-	ParentID     string    `json:"parent_id"`
-	RequestID    string    `json:"request_id"`
-	TraceID      string    `json:"trace_id"`
-	APIKey       APIKey    `json:"api_key"`
-	CreatedAt    time.Time `json:"created_at"`
+	ID           string    `json:"id" binding:"required"`
+	Action       string    `json:"action" enums:"create,update,delete,send_events,upload_file,upload_version,update_default_version" binding:"required"`
+	ResourceType string    `json:"resource_type" enums:"agent,session,environment,environment_template,skill,skill_version,file,vault,credential,artifact" binding:"required"`
+	ResourceID   string    `json:"resource_id" binding:"required"`
+	ParentID     string    `json:"parent_id" binding:"required"`
+	RequestID    string    `json:"request_id" binding:"required"`
+	TraceID      string    `json:"trace_id" binding:"required"`
+	APIKey       APIKey    `json:"api_key" binding:"required"`
+	CreatedAt    time.Time `json:"created_at" binding:"required"`
 }
 
 // Filter selects committed writes, newest first. A zero Limit is the default
@@ -56,9 +56,9 @@ type Filter struct {
 }
 
 type Page struct {
-	Data       []Operation `json:"data"`
-	HasMore    bool        `json:"has_more"`
-	NextCursor string      `json:"next_cursor"`
+	Data       []Operation `json:"data" binding:"required"`
+	HasMore    bool        `json:"has_more" binding:"required"`
+	NextCursor string      `json:"next_cursor" binding:"required"`
 }
 
 // Validate checks f and returns it with the default page size applied. The

From d3a58f53560af60674424eaae2e890d0fc8c5134 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Thu, 8 Oct 2026 16:43:28 +0800
Subject: [PATCH 3/3] Settle the generated client review findings (#556)

---
 contracts/agents-api/core.openapi.yaml           |  2 ++
 contracts/agents-api/index.md                    |  2 +-
 contracts/agents-api/runtime.openapi.yaml        |  2 ++
 contracts/agents-api/v1/events.go                |  5 ++++-
 contracts/agents-api/v1/events_test.go           |  6 ++++--
 contracts/agents-api/zh/index.md                 |  4 ++--
 packages/agents-client/src/generated/core-api.ts |  6 +++---
 scripts/generate-public-api.py                   |  7 ++++++-
 scripts/generate-public-api.test.py              | 11 +++++++++++
 services/core/internal/api/core_errors.go        |  4 ++--
 10 files changed, 37 insertions(+), 12 deletions(-)

diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
index 941308164..3d52d068b 100644
--- a/contracts/agents-api/core.openapi.yaml
+++ b/contracts/agents-api/core.openapi.yaml
@@ -292,7 +292,9 @@ definitions:
       type:
         type: string
     required:
+      - code
       - message
+      - param
       - type
     type: object
   api.CoreErrorResponse:
diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index f9ffb2cf9..280696bbb 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -14,7 +14,7 @@ Core targets the complete OpenAI Agents API as pinned below ([public API rule](h
 | [openapi.yaml](./openapi.yaml) | The official public contract with Core's `x_agents_core` extension on Agent and Session request/response objects |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go names, field representations, encoding order and stored projections; it does not define official field membership, enums or constraints |
 
-Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations; the same generator projects the `/core/v1` document into `packages/agents-client/src/generated/core-api.ts`, which imports the public types it references from `public-api.ts`. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
+Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations; the same generator projects the `/core/v1` document into `packages/agents-client/src/generated/core-api.ts`, which imports the public types it references from `public-api.ts`. In those annotations a response field Core always sends carries `binding:"required"`, a field that can be null carries `extensions:"x-nullable"`, and a closed set carries `enums:`; the tags only shape the documents, and the client rejects a response that breaks them. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
 
 The public contract is the official API plus Core extensions. Standard fields are generated into `v1/official.gen.go`; `go-bindings.json` lists types consumed by Core and overrides only the Go representation or field order that existing storage or custom JSON encoding requires. Unspecified fields follow the official schema; shared shapes use one Go type. Selected discriminated unions also generate JSON serializers to retain required nullable fields for each variant. Other union serializers, Core's local limits, execution admission and state transitions remain implementation code. Contract tests verify that the public schema preserves the official definitions, extensions remain in `x_agents_core`, and all documents match registered routes. Official-client and raw HTTP tests verify behavior. Schema generation does not qualify an unimplemented feature; the gaps below still apply. Upstream upgrades update the OpenAPI and SDK pins together after comparison and compatibility tests.
 
diff --git a/contracts/agents-api/runtime.openapi.yaml b/contracts/agents-api/runtime.openapi.yaml
index fb434cab2..64fbc6524 100644
--- a/contracts/agents-api/runtime.openapi.yaml
+++ b/contracts/agents-api/runtime.openapi.yaml
@@ -19,7 +19,9 @@ definitions:
       type:
         type: string
     required:
+      - code
       - message
+      - param
       - type
     type: object
   api.CoreErrorResponse:
diff --git a/contracts/agents-api/v1/events.go b/contracts/agents-api/v1/events.go
index c48a42d93..03205874d 100644
--- a/contracts/agents-api/v1/events.go
+++ b/contracts/agents-api/v1/events.go
@@ -21,7 +21,8 @@ func itemEvent(eventType string) bool {
 
 // MarshalJSON keeps the nullable top-level usage on terminal Turn events only,
 // a nullable output_index on every Item event (EVT-09), a nullable error param
-// on error events and a nullable turn_id on Environment events.
+// on error events and a nullable turn_id on Environment events. Subagent events
+// carry no session_id; their Subagent names the Session.
 func (e SessionEvent) MarshalJSON() ([]byte, error) {
 	type wire SessionEvent
 	switch {
@@ -52,6 +53,8 @@ func (e SessionEvent) MarshalJSON() ([]byte, error) {
 			wire
 			TurnID *string `json:"turn_id"`
 		}{wire(e), turn})
+	case strings.HasPrefix(e.Type, "agent.session.subagent."):
+		e.SessionID = ""
 	}
 	e.Usage = nil
 	return json.Marshal(wire(e))
diff --git a/contracts/agents-api/v1/events_test.go b/contracts/agents-api/v1/events_test.go
index 75374d166..5ede7e496 100644
--- a/contracts/agents-api/v1/events_test.go
+++ b/contracts/agents-api/v1/events_test.go
@@ -45,8 +45,8 @@ func TestSessionEventUsageOnlyOnTerminalTurnEvents(t *testing.T) {
 
 // Error events carry the pinned SessionError, whose param is present and null
 // when unset; Environment state errors keep their observed three fields (HI-01/02)
-// and Environment events carry a null turn_id.
-func TestSessionErrorEventCarriesNullableParam(t *testing.T) {
+// and Environment events carry a null turn_id. Subagent events carry no session_id.
+func TestSessionEventWireFields(t *testing.T) {
 	failure := &StreamError{Type: "environment_error", Code: "sandbox_error", Message: "Failed to provision environment"}
 	param := "input"
 	for _, test := range []struct {
@@ -60,6 +60,8 @@ func TestSessionErrorEventCarriesNullableParam(t *testing.T) {
 		{SessionEvent{Type: "agent.session.environment.failed", EventID: "event", Environment: &SessionEnvironmentState{ID: "environment", Type: "openai_hosted", Status: "failed",
 			Error: &StreamError{Type: "environment_error", Code: "environment_connection_failed", Message: "The environment failed to connect."}}},
 			`{"type":"agent.session.environment.failed","event_id":"event","environment":{"id":"environment","type":"openai_hosted","status":"failed","error":{"code":"environment_connection_failed","type":"environment_error","message":"The environment failed to connect."}},"turn_id":null}`},
+		{SessionEvent{Type: "agent.session.subagent.closed", EventID: "event", SessionID: "session", Subagent: &Subagent{ID: "subagent", Object: "agent.session.subagent", SessionID: "session", ParentAgentID: "root", Status: "closed"}},
+			`{"subagent":{"id":"subagent","object":"agent.session.subagent","session_id":"session","parent_agent_id":"root","opened_at":0,"closed_at":null,"name":null,"instructions":null,"status":"closed"},"type":"agent.session.subagent.closed","event_id":"event"}`},
 	} {
 		raw, err := json.Marshal(test.event)
 		if err != nil || string(raw) != test.want {
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index 04c831d54..9f98d96c2 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "Agents API 覆盖台账"
 source: contracts/agents-api/index.md
-source_hash: b2281fe0f7ab7c4f810b029aca847a11a3a292d367dcacd1ac3f716f511e2814
+source_hash: dc1388f616997b89e298113b7626fac569a9650f9a52710500f96a86c2b1af80
 ---
 
 Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。本台账记录 Core 对各项资源实现了哪些内容、哪些契约保存其详细信息，并列出相对于 OpenAI 服务的所有已知差异和所有未解决缺口。[API namespaces and credentials](../../../docs/zh/api/index.md) 说明谁调用哪些 API；[Agents API guide](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
@@ -16,7 +16,7 @@ Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[publi
 | [openapi.yaml](../openapi.yaml) | 官方公共契约，并在 Agent 和 Session 请求及响应对象上加入 Core 的 `x_agents_core` 扩展 |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go 名称、字段表示、编码顺序和存储投影；不定义官方字段集合、枚举或约束 |
 
-运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成；同一生成器把 `/core/v1` 文档投影为 `packages/agents-client/src/generated/core-api.ts`，其中引用的公共类型从 `public-api.ts` 导入。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
+运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成；同一生成器把 `/core/v1` 文档投影为 `packages/agents-client/src/generated/core-api.ts`，其中引用的公共类型从 `public-api.ts` 导入。在这些注解里，Core 总会发送的响应字段带 `binding:"required"`，可以为 null 的字段带 `extensions:"x-nullable"`，封闭集合带 `enums:`；这些标签只影响文档，客户端会拒绝不符合它们的响应。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
 
 公共契约是官方 API 加上 Core 扩展。标准字段生成到 `v1/official.gen.go`；`go-bindings.json` 只列出 Core 使用的类型，仅在已有存储或自定义 JSON 编码需要时覆盖 Go 表示或字段顺序。未覆盖的字段遵循官方 schema，相同结构复用同一个 Go 类型。部分带判别字段的联合类型也从 schema 生成 JSON 序列化代码，保留每个分支必需的可空字段。其他联合类型序列化、Core 的本地限制、执行准入和状态转换仍由实现代码负责。契约测试验证公共 schema 保留官方定义、扩展位于 `x_agents_core` 中，且所有文档与注册路由一致。官方客户端和原始 HTTP 测试验证行为。生成 schema 不代表某个尚未实现的功能已经得到验证；下方缺口仍然适用。升级上游时，在比对和兼容性测试后一起更新 OpenAPI 和 SDK 固定版本。
 
diff --git a/packages/agents-client/src/generated/core-api.ts b/packages/agents-client/src/generated/core-api.ts
index b930cfad5..34497e5bc 100644
--- a/packages/agents-client/src/generated/core-api.ts
+++ b/packages/agents-client/src/generated/core-api.ts
@@ -120,14 +120,14 @@ export interface ConfigurationDiscoveryInput {
 export const configurationDiscoveryInputFields = ["configuration", "credential", "query"] as const;
 export const configurationDiscoveryInputRequired = [] as const;
 export interface CoreAPIError {
-  code?: string | null;
+  code: string | null;
   details?: Record<string, unknown>;
   message: string;
-  param?: string | null;
+  param: string | null;
   type: string;
 }
 export const coreAPIErrorFields = ["code", "details", "message", "param", "type"] as const;
-export const coreAPIErrorRequired = ["message", "type"] as const;
+export const coreAPIErrorRequired = ["code", "message", "param", "type"] as const;
 export interface CoreErrorResponse {
   error: CoreAPIError;
 }
diff --git a/scripts/generate-public-api.py b/scripts/generate-public-api.py
index 8b92496ff..a9621d7f6 100644
--- a/scripts/generate-public-api.py
+++ b/scripts/generate-public-api.py
@@ -406,15 +406,20 @@ def core_module(document, public, bindings):
     taken = [ts_name(name) for name in local] + list(imported)
     for name in local:
         names[name] = ts_name(name) if taken.count(ts_name(name)) == 1 else name.split('.')[0].capitalize() + ts_name(name)
-    schemas = {}
+    schemas, hoisted = {}, []
     for name in local:
         schema = schemas[names[name]] = json.loads(refs.sub(lambda ref: f'"#/definitions/{names[ref[1]]}"', json.dumps(definitions[name])))
         for field, member in schema.get('properties', {}).items():
             target = member.get('items', member)
             if len(target.get('enum', [])) > 1:
                 enum = names[name] + ''.join(part.capitalize() for part in field.split('_'))
+                hoisted.append(enum)
                 schemas[enum] = {'type': target.pop('type'), 'enum': target.pop('enum')}
                 target['$ref'] = '#/definitions/' + enum
+    # A prefixed or hoisted name must not replace another type.
+    emitted = [*imported, *(names[name] for name in local), *hoisted]
+    if len(emitted) != len(set(emitted)):
+        raise ValueError('TypeScript names collide')
     used = sorted(imported.intersection(refs.findall(json.dumps(schemas))))
     header = ['import type { ' + ', '.join(used) + ' } from "./public-api";'] if used else []
     return ts_module(schemas, 'contracts/agents-api/core.openapi.yaml', header)
diff --git a/scripts/generate-public-api.test.py b/scripts/generate-public-api.test.py
index ca05c253b..dd039c572 100644
--- a/scripts/generate-public-api.test.py
+++ b/scripts/generate-public-api.test.py
@@ -134,6 +134,17 @@ def test_core_types_import_public_names_and_hoist_inline_enums(self):
             self.assertIn(line, generated)
         self.assertNotIn('Unused', generated)
 
+    def test_core_names_never_replace_another_type(self):
+        ref = '#/definitions/'
+        for definitions in (
+            {'api.Reset': {'type': 'object', 'properties': {'clear': {'type': 'string', 'enum': ['auto', 'force']}}}, 'api.ResetClear': {'type': 'object'}},
+            {'one.Node': {'type': 'object'}, 'two.Node': {'type': 'object'}, 'api.OneNode': {'type': 'object'}},
+        ):
+            document = {'paths': {'/x': {'get': {'responses': {'200': {'schema': {'type': 'object', 'properties': {
+                name: {'$ref': ref + name} for name in definitions}}}}}}}, 'definitions': definitions}
+            with self.subTest(sorted(definitions)), self.assertRaisesRegex(ValueError, 'collide'):
+                generator.core_module(document, {}, {})
+
     def test_every_public_reference_resolves_and_no_other_apis_leak(self):
         self.assertEqual({p.split('/')[1] for p in self.public['paths']}, {'agents', 'vaults', 'files', 'skills'})
         generator.prune_components(copy.deepcopy(self.public))
diff --git a/services/core/internal/api/core_errors.go b/services/core/internal/api/core_errors.go
index 50f118da4..f438838ad 100644
--- a/services/core/internal/api/core_errors.go
+++ b/services/core/internal/api/core_errors.go
@@ -15,8 +15,8 @@ type CoreErrorResponse struct {
 type CoreAPIError struct {
 	Message string  `json:"message" binding:"required"`
 	Type    string  `json:"type" binding:"required"`
-	Code    *string `json:"code" extensions:"x-nullable"`
-	Param   *string `json:"param" extensions:"x-nullable"`
+	Code    *string `json:"code" binding:"required" extensions:"x-nullable"`
+	Param   *string `json:"param" binding:"required" extensions:"x-nullable"`
 	// Details contains only documented, Core-owned facts: string, finite number,
 	// boolean, null or string array values. Never include request echoes, secrets
 	// or native/provider error text. Empty or invalid details are omitted.