diff --git a/.gitignore b/.gitignore
index 9012af483..c8059bfec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,8 @@ __pycache__/
/.agents/
/.issue-agent/
/ISSUE_AGENT.md
+
+# Documentation site build output.
+/apps/docs/.next/
+/apps/docs/.source/
+/apps/docs/tsconfig.tsbuildinfo
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bf56154e7..b32f49e9c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -3665,3 +3665,12 @@ unchanged. Persisted credential encryption domains and native-session resume key
also remain stable so existing data can be decrypted and Sessions can resume.
Conversion inputs, retirement diagnostics and historical evidence must still name
the identifiers they reject or migrate; current examples use the new names.
+
+
+Core administration error details are scoped by the `/core/v1` router writer mark,
+not a request path test. Use `writeCoreError` with typed `CoreErrorDetails` values
+and document fixed keys in `contracts/agents-api/core-errors.md` when adding a
+code. Include only safe Core-owned facts; never pass submitted values, secrets,
+native text or provider bodies. Invalid/empty details are omitted. Preserve the
+public and machine error serializers, observer callbacks and streaming interfaces.
+The Core client ignores malformed optional details and never retries a mutation.
diff --git a/Makefile b/Makefile
index 6d6b7e414..b1e3112bf 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ SWAG_VERSION ?= v1.16.4
help:
@printf '%s\n' 'make build-agents-api Build standalone Core commands' 'make build-daemon Build the execution daemon' 'make check Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
-check: check-names check-distribution check-database check-sqlc check-go check-microsandbox-provider check-agents-api check-claude-sdk check-web check-mcode-harness check-agents-executor
+check: check-docs check-names check-distribution check-database check-sqlc check-go check-microsandbox-provider check-agents-api check-claude-sdk check-web check-mcode-harness check-agents-executor
@printf 'OpenAgentCore checks passed.\n'
.PHONY: check-names
@@ -145,3 +145,7 @@ build-e2b-provider:
check-e2b-provider:
PYTHONDONTWRITEBYTECODE=1 $${OAC_TEST_E2B_SDK_PYTHON:-python3} -m unittest discover -s services/agents-api/deploy/e2b -p '*_test.py'
PYTHONDONTWRITEBYTECODE=1 $${OAC_TEST_E2B_SDK_PYTHON:-python3} -m unittest discover -s services/agents-api/tools/e2b-provider -p '*_test.py'
+
+.PHONY: check-docs
+check-docs: node-deps
+ pnpm check:docs
diff --git a/apps/docs/FOLLOW-UP.md b/apps/docs/FOLLOW-UP.md
new file mode 100644
index 000000000..232f913c1
--- /dev/null
+++ b/apps/docs/FOLLOW-UP.md
@@ -0,0 +1,24 @@
+# Feature integration follow-up
+
+This candidate documents the actual maintenance and drain model at source
+`75bf4484ba957344ae374354858bbdfe104f5c4f`. It is not final documentation for design 50.
+The Core error-envelope foundation is included; the later configuration validators and
+diagnostic endpoints are not. Do not replace current procedures with the planned
+behavior before the features land.
+
+| Feature dependency | Site pages to reconcile | Source and verification work |
+| --- | --- | --- |
+| Reset replaces maintenance (design 50 PR-R) | configure, hosted-providers, troubleshooting, admin-api, observability, API reference/core | Regenerate the canonical guides and management contract; describe reset admission, cleanup, failures, archive preconditions and offline-node limits from merged code. Remove retired maintenance instructions only after their replacement exists. |
+| Online generations and E2B changes (design 50 PR-G) | configure, hosted-providers, troubleshooting, execution-model, API reference/core | Document actual generation/rollout states, the supported change matrix and existing-sandbox behavior. Verify PUT examples against the final contract. |
+| Node update protocol (design 50 PR-N) | hosted-providers, troubleshooting, API reference/machine | Explain the implemented update command, old-node handling and ownership preservation. Do not claim an update command now. |
+| Later configuration/error changes (design 40 and remaining installer work) | install, configure, troubleshooting, quickstart | Regenerate current configuration fields and revise diagnostics against merged code; keep secrets out of examples. |
+| Final feature assembly | every Chinese reading note, execution-model diagram, all generated references | Review translations against regenerated English, verify source provenance and links, run contract/route/copy/fact checks, typecheck/build, local browser review and the repository gate. |
+
+English guides are rendered from repository sources. Chinese pages are explicitly
+labelled reading notes, not complete translations; expand them only against the final
+source procedures. API tag pages use the default-language fallback. Release publication,
+remote deployment and preview replacement are outside this reconciliation task.
+
+The source Web guide still carries a pre-rename screenshot. This site copies the
+approved current Web onboarding Monitor image instead, with its own source hash;
+refresh that mapping when the canonical guide image is updated.
diff --git a/apps/docs/README.md b/apps/docs/README.md
new file mode 100644
index 000000000..a526c4fa0
--- /dev/null
+++ b/apps/docs/README.md
@@ -0,0 +1,48 @@
+# OpenAgentCore documentation site
+
+A separate Next.js/Fumadocs documentation app. It starts no Core, database or Runtime.
+English is served at `/`; Chinese reading notes at `/zh`, with English fallback for
+API tag pages. The existing preview is not part of this checkout.
+
+The application reference reads the upstream-constrained public schema. Administration
+and machine references read their own local generated contracts. All three repository
+files currently declare Swagger 2.0; rendering supports Swagger 2 and OpenAPI 3.
+The documentation projection uses OpenAPI 3.1 null unions (including nullable references
+and compositions). Normalization changes documentation servers and bearer presentation, preserving operation
+prose, parameters, response schemas and credential boundaries. Examples use a reserved
+domain. The reference is read-only and must not collect keys or send execution requests.
+
+English guides are generated from the canonical repository docs, not maintained as a
+second installation manual. Edit those sources first, update the Chinese reading notes
+in [guides.json](scripts/guides.json), then regenerate. Source/output hashes fail when
+copies drift; operation and route checks detect missing or mixed API surfaces.
+
+From the repository root:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm --dir apps/docs generate
+pnpm --dir apps/docs verify
+pnpm --dir apps/docs test
+pnpm --dir apps/docs typecheck
+pnpm --dir apps/docs build
+pnpm --dir apps/docs start --port 4275
+```
+
+The route verifier uses the declared `js-yaml` dependency and Python standard library
+only; no ambient PyYAML installation is required. Python checks honor
+`OAC_TEST_OFFICIAL_SDK_PYTHON` when set, otherwise `python3`, and run with `-S`
+to keep site packages out of the gate.
+
+`make check-docs` runs the focused gate and is included in `make check`. After starting
+the built site, run `pnpm --dir apps/docs check:site http://127.0.0.1:4275` and inspect
+both locales in a browser with `pnpm --dir apps/docs check:browser http://127.0.0.1:4275`.
+The check uses installed Playwright Chromium (or `DOCS_BROWSER_EXECUTABLE`), checks
+for credential/request controls and external traffic, and accepts only a local origin.
+Set `DOCS_SITE_ORIGIN` only when preparing actual publication.
+Generation links to the recorded source revision; update that revision after rebasing
+onto later canonical guide changes. Never point samples at an actual deployment by default.
+
+[Feature follow-up inventory](FOLLOW-UP.md) lists the reset and online-generation
+paragraphs that must be reconciled after those implementations land. This candidate
+cannot establish final documentation acceptance for those unfinished features.
diff --git a/apps/docs/app/[lang]/[[...slug]]/page.tsx b/apps/docs/app/[lang]/[[...slug]]/page.tsx
new file mode 100644
index 000000000..941dd8097
--- /dev/null
+++ b/apps/docs/app/[lang]/[[...slug]]/page.tsx
@@ -0,0 +1,78 @@
+import type { Metadata } from "next"
+import { notFound } from "next/navigation"
+import { ImageZoom } from "fumadocs-ui/components/image-zoom"
+import defaultMdxComponents from "fumadocs-ui/mdx"
+import { DocsBody, DocsDescription, DocsPage, DocsTitle } from "fumadocs-ui/page"
+import { APIPage } from "@/components/api-page"
+import { LocaleLink } from "@/components/locale-link"
+import { i18n, type Lang } from "@/lib/i18n"
+import { docsAlternates } from "@/lib/site"
+import { source } from "@/lib/source"
+
+function asLang(value: string): Lang {
+ if (!(i18n.languages as readonly string[]).includes(value)) notFound()
+ return value as Lang
+}
+
+function pageSlug(slug?: string[]) {
+ return slug ?? []
+}
+
+export default async function DocsPageRoute({
+ params,
+}: {
+ params: Promise<{ lang: string; slug?: string[] }>
+}) {
+ const { lang: rawLang, slug } = await params
+ const lang = asLang(rawLang)
+ const page = source.getPage(pageSlug(slug), lang)
+ if (!page) notFound()
+
+ const MDX = page.data.body
+ return (
+
+ {page.data.title}
+ {page.data.description}
+
+
+
+ )
+}
+
+export function generateStaticParams() {
+ return source.generateParams()
+}
+
+export async function generateMetadata({
+ params,
+}: {
+ params: Promise<{ lang: string; slug?: string[] }>
+}): Promise {
+ const { lang: rawLang, slug } = await params
+ const slugs = pageSlug(slug)
+ const page = source.getPage(slugs, asLang(rawLang))
+ if (!page) return {}
+ return {
+ title: page.data.title,
+ description: page.data.description,
+ // Declare the translations as alternates of one article, and name the
+ // canonical URL, so search engines do not index the English and Chinese
+ // pages as duplicates of each other.
+ alternates: docsAlternates(slugs),
+ }
+}
diff --git a/apps/docs/app/[lang]/docs-providers.tsx b/apps/docs/app/[lang]/docs-providers.tsx
new file mode 100644
index 000000000..f7b40a7e4
--- /dev/null
+++ b/apps/docs/app/[lang]/docs-providers.tsx
@@ -0,0 +1,77 @@
+"use client"
+
+import Image from "next/image"
+import Link from "next/link"
+import { useParams, usePathname, useRouter } from "next/navigation"
+import { FrameworkProvider, type Framework } from "fumadocs-core/framework"
+import { RootProvider } from "fumadocs-ui/provider/base"
+import { useCallback, type ReactNode } from "react"
+import { i18n, type Lang } from "@/lib/i18n"
+
+const locales = [
+ { name: "English", locale: "en" },
+ { name: "中文", locale: "zh" },
+]
+
+const translations = {
+ en: {
+ toc: "On this page",
+ chooseLanguage: "Choose language",
+ nextPage: "Next page",
+ previousPage: "Previous page",
+ },
+ zh: {
+ toc: "本页目录",
+ chooseLanguage: "选择语言",
+ nextPage: "下一页",
+ previousPage: "上一页",
+ },
+} as const
+
+function isLocale(segment: string | undefined): boolean {
+ return Boolean(segment) && (i18n.languages as readonly string[]).includes(segment as string)
+}
+
+function pathForLocale(pathname: string, locale: string) {
+ const segments = pathname.split("/").filter(Boolean)
+ // Drop a leading locale segment, whichever language it names — matching on a
+ // literal "en"/"zh" pair here would silently break when a language is added.
+ if (isLocale(segments[0])) segments.shift()
+ const rest = segments.join("/")
+ if (locale === i18n.defaultLanguage) return rest ? `/${rest}` : "/"
+ return rest ? `/${locale}/${rest}` : `/${locale}`
+}
+
+export function DocsProviders({ lang, children }: { lang: Lang; children: ReactNode }) {
+ const router = useRouter()
+ const pathname = pathForLocale(usePathname(), lang)
+ // Navigation must use the public path during both SSR and hydration.
+ const usePublicPathname = useCallback(() => pathname, [pathname])
+
+ return (
+
+ router.push(pathForLocale(pathname, locale)),
+ }}
+ >
+ {children}
+
+
+ )
+}
diff --git a/apps/docs/app/[lang]/layout.tsx b/apps/docs/app/[lang]/layout.tsx
new file mode 100644
index 000000000..91e648c52
--- /dev/null
+++ b/apps/docs/app/[lang]/layout.tsx
@@ -0,0 +1,54 @@
+import "../global.css"
+import type { Metadata } from "next"
+import { notFound } from "next/navigation"
+import type { ReactNode } from "react"
+import { DocsLayout } from "fumadocs-ui/layouts/docs"
+import { baseOptions } from "../layout.config"
+import { source } from "@/lib/source"
+import { i18n, type Lang } from "@/lib/i18n"
+import { DocsProviders } from "./docs-providers"
+
+export const metadata: Metadata = {
+ title: {
+ template: "%s | OpenAgentCore Docs",
+ default: "OpenAgentCore Docs",
+ },
+ description: "Documentation for OpenAgentCore.",
+}
+
+export function generateStaticParams() {
+ return i18n.languages.map((lang) => ({ lang }))
+}
+
+export default async function LangLayout({
+ params,
+ children,
+}: {
+ params: Promise<{ lang: string }>
+ children: ReactNode
+}) {
+ const { lang: rawLang } = await params
+ if (!(i18n.languages as readonly string[]).includes(rawLang)) notFound()
+ const lang = rawLang as Lang
+
+ return (
+
+ {/* Browser extensions may add attributes before React hydrates the body. */}
+
+
+
+ {children}
+
+
+
+
+ )
+}
diff --git a/apps/docs/app/global.css b/apps/docs/app/global.css
new file mode 100644
index 000000000..40503ed92
--- /dev/null
+++ b/apps/docs/app/global.css
@@ -0,0 +1,103 @@
+@import "tailwindcss";
+@import "fumadocs-ui/css/neutral.css";
+@import "fumadocs-ui/css/preset.css";
+@import "fumadocs-openapi/css/preset.css";
+
+:root {
+ --color-fd-primary: hsl(240 5.9% 10%);
+}
+
+/* Keep the active navigation item readable in dark mode. The neutral theme
+ defines a light primary color for dark surfaces; this override must be more
+ specific than the root token declared above. */
+.dark {
+ --color-fd-primary: hsl(0 0% 98%);
+ --color-fd-primary-foreground: hsl(240 5.9% 10%);
+}
+
+body {
+ font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI",
+ "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
+}
+
+/* Medium weight maps to regular in common CJK fonts. */
+.prose :where(strong):not(:where(.not-prose, .not-prose *)) {
+ font-weight: 700;
+}
+
+.prose pre {
+ min-width: 0;
+ width: 100%;
+}
+
+/* Code blocks wrap instead of scrolling sideways. */
+.prose pre,
+.prose pre code {
+ white-space: pre-wrap;
+ overflow-wrap: anywhere;
+}
+
+/* Inline code wraps only when a token cannot fit on a line of its own.
+ `overflow-wrap: anywhere` also reduces the element's min-content width to
+ roughly one character, and the automatic table layout then treats a column
+ as shrinkable to that width: a five-column table collapsed the first column
+ to 49px and split `environment.type` across five lines. `break-word` breaks
+ a long token as a last resort without affecting intrinsic sizing, so a
+ column keeps at least its longest parameter. */
+.prose :not(pre) > code {
+ white-space: pre-wrap;
+ overflow-wrap: break-word;
+}
+
+/* Give every table column a readable floor. The minimum content width of a
+ column that holds only Chinese text is about one character, while a column
+ holding a parameter such as `OAC_DATABASE_URL` cannot shrink below
+ that parameter. The automatic layout satisfies the wider columns first and
+ can crush the Chinese one to about four characters per line. Five columns of
+ 7rem still fit the narrowest content area the layout produces. */
+.prose table :is(th, td) {
+ min-width: 7rem;
+}
+
+/* Make the page-tree separators read as navigation groups, not page links. */
+#nd-sidebar [data-radix-scroll-area-viewport] p {
+ width: 100%;
+ margin-top: 1.25rem;
+ margin-bottom: 0.5rem;
+ padding: 0.35rem 0.5rem;
+ border-bottom: 1px solid var(--color-fd-border);
+ color: var(--color-fd-muted-foreground);
+ font-size: 0.7rem;
+ font-weight: 700;
+ letter-spacing: 0;
+ line-height: 1.25rem;
+}
+
+#nd-sidebar [data-radix-scroll-area-viewport] p:first-of-type {
+ margin-top: 0;
+}
+
+#nd-sidebar [data-radix-scroll-area-viewport] a[href^="/"] {
+ min-height: 2.25rem;
+ font-size: 0.875rem;
+}
+
+/* Keep the language menu compact inside the sidebar and on narrow screens. */
+[role="dialog"][data-side] {
+ width: min(11rem, calc(100vw - 2rem));
+ min-width: 0 !important;
+ /* Radix anchors this bottom-left menu at x=0; keep it off the viewport edge. */
+ margin-left: 0.75rem;
+}
+
+[role="dialog"][data-side] button {
+ width: 100%;
+}
+
+/* Text selection: tint the background with the theme's primary color and keep
+ the original text color, so contrast is inherited from body text in both
+ themes. Forcing --color-fd-primary-foreground here previously produced white
+ text on a mid-gray highlight in light mode. */
+::selection {
+ background: color-mix(in srgb, var(--color-fd-primary) 22%, transparent);
+}
diff --git a/apps/docs/app/icon.png b/apps/docs/app/icon.png
new file mode 100644
index 000000000..83ad57715
Binary files /dev/null and b/apps/docs/app/icon.png differ
diff --git a/apps/docs/app/layout.config.tsx b/apps/docs/app/layout.config.tsx
new file mode 100644
index 000000000..68f3bf2c9
--- /dev/null
+++ b/apps/docs/app/layout.config.tsx
@@ -0,0 +1,11 @@
+import type { BaseLayoutProps } from "fumadocs-ui/layouts/shared"
+
+export const baseOptions: BaseLayoutProps = {
+ i18n: true,
+ nav: {
+ title: "OpenAgentCore Docs",
+ },
+ searchToggle: {
+ enabled: false,
+ },
+}
diff --git a/apps/docs/app/not-found.tsx b/apps/docs/app/not-found.tsx
new file mode 100644
index 000000000..fa0686507
--- /dev/null
+++ b/apps/docs/app/not-found.tsx
@@ -0,0 +1,69 @@
+"use client"
+
+import Link from "next/link"
+import { usePathname } from "next/navigation"
+import { i18n } from "@/lib/i18n"
+
+const COPY = {
+ en: {
+ title: "Page not found",
+ body: "The page you are looking for does not exist, or it moved when the manual was reorganised.",
+ back: "Back to the manual",
+ },
+ zh: {
+ title: "页面不存在",
+ body: "你访问的页面不存在，或已随手册改版移动到别处。",
+ back: "返回手册首页",
+ },
+} as const
+
+/**
+ * 404 for the whole site. Two things about its placement are deliberate.
+ *
+ * It lives at the app root, not at `app/[lang]/`. A `not-found` boundary inside
+ * the segment that also holds the root layout is never compiled as a boundary,
+ * so the version that used to sit there was dead code: every 404 got Next's
+ * built-in notice instead.
+ *
+ * It is a client component that reads the language from the URL. Taking the
+ * language from the request on the server — `headers()`, or any other
+ * request-scoped API — opts *every sibling route* out of static generation,
+ * because the boundary belongs to the `[lang]/[[...slug]]` render tree. That is
+ * not a small regression: it made all 102 docs pages re-render per request, and
+ * the generated API reference pages carry whole OpenAPI surfaces, so a single
+ * navigation took two to three seconds instead of thirty milliseconds.
+ *
+ * The cost of the trade is that this notice arrives with hydration rather than
+ * in the first response, and outside the docs chrome: without a root layout
+ * Next renders a root `not-found` in its own shell. A 404 is `noindex` and a
+ * dead end, so paying there to keep every real page prerendered is the right
+ * way round.
+ *
+ * If this moves back to the server, `pnpm build` must still write prerendered
+ * `.html` files under `.next/server/app/en/` — the build log reporting
+ * `● (SSG)` is not sufficient, it says that either way.
+ */
+export default function NotFound() {
+ const pathname = usePathname()
+ const first = pathname.split("/").filter(Boolean)[0]
+ const locale =
+ first && (i18n.languages as readonly string[]).includes(first)
+ ? first
+ : i18n.defaultLanguage
+
+ const text = COPY[locale as keyof typeof COPY] ?? COPY.en
+ const home = locale === i18n.defaultLanguage ? "/" : `/${locale}`
+
+ return (
+
+ {text.title}
+ {text.body}
+
+ )
+}
diff --git a/apps/docs/app/sitemap.ts b/apps/docs/app/sitemap.ts
new file mode 100644
index 000000000..0600f3c8f
--- /dev/null
+++ b/apps/docs/app/sitemap.ts
@@ -0,0 +1,48 @@
+import type { MetadataRoute } from "next"
+import { i18n } from "@/lib/i18n"
+import { absoluteDocsUrl } from "@/lib/site"
+import { source } from "@/lib/source"
+
+/**
+ * Sitemap for the manual, built from Fumadocs' page list at build time.
+ *
+ * One entry per logical page: every language variant of a page is declared as
+ * an hreflang alternate of the same entry, so a search engine reads the English
+ * and Chinese pages as one article in two languages rather than as duplicates.
+ */
+export default function sitemap(): MetadataRoute.Sitemap {
+ // Collapse the language variants into one group per slug.
+ const bySlug = new Map>()
+
+ for (const { language, pages } of source.getLanguages()) {
+ for (const page of pages) {
+ const slugKey = page.slugs.join("/")
+ const languages = bySlug.get(slugKey) ?? new Map()
+ languages.set(language, page.url)
+ bySlug.set(slugKey, languages)
+ }
+ }
+
+ const entries: MetadataRoute.Sitemap = []
+
+ for (const languages of bySlug.values()) {
+ // Canonical is the default language when it exists, otherwise the first
+ // translation available.
+ const canonicalRelative =
+ languages.get(i18n.defaultLanguage) ?? languages.values().next().value
+ if (!canonicalRelative) continue
+
+ const alternates: Record = {}
+ for (const [lang, relative] of languages) {
+ alternates[lang] = absoluteDocsUrl(relative)
+ }
+ alternates["x-default"] = absoluteDocsUrl(canonicalRelative)
+
+ entries.push({
+ url: absoluteDocsUrl(canonicalRelative),
+ alternates: { languages: alternates },
+ })
+ }
+
+ return entries
+}
\ No newline at end of file
diff --git a/apps/docs/components/api-page.tsx b/apps/docs/components/api-page.tsx
new file mode 100644
index 000000000..3976f2a65
--- /dev/null
+++ b/apps/docs/components/api-page.tsx
@@ -0,0 +1,13 @@
+import { APIPage as OpenAPIPage, type ApiPageProps } from "fumadocs-openapi/ui"
+import { loadSurface } from "@/lib/openapi"
+
+// Registered as `APIPage` for the MDX components map. The generated pages name
+// their API surface by id; the contract itself is loaded through the server
+// instance so the rendered schema and the generated prose stay in step.
+export async function APIPage({
+ document,
+ ...props
+}: Omit & { document: string }) {
+ // References never collect credentials or dispatch requests from the browser.
+ return & {
+ lang: string
+ children?: ReactNode
+}
+
+/**
+ * MDX anchor override for the docs routes.
+ *
+ * The active language is passed in by the route, which knows it from the URL,
+ * so no client-side context is required and this stays a server component. It
+ * renders the same plain anchor Fumadocs uses by default, after adding the
+ * locale prefix — see `prefixLocale`.
+ */
+export function LocaleLink({ lang, href, children, ...rest }: LocaleLinkProps) {
+ return (
+
+ {children}
+
+ )
+}
diff --git a/apps/docs/content/docs/admin-api.mdx b/apps/docs/content/docs/admin-api.mdx
new file mode 100644
index 000000000..1e9b830cc
--- /dev/null
+++ b/apps/docs/content/docs/admin-api.mdx
@@ -0,0 +1,160 @@
+---
+title: "Core administration API"
+description: "Management operations and their server-side credential boundary."
+---
+
+Core Web is an administrator console over `/core/v1`, authorized by the Core key:
+resource inspection, Project and key management, credential issuance, audit, usage
+and sandbox operations. It never calls `/v1` or `/api/v1`, and has no Agent
+execution, copy or arbitrary asset editing operation.
+
+Core request failures use the [Core administration error envelope](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core-errors.md),
+including optional typed safe details. Console sign-in endpoints retain their
+separate error shape described below.
+
+## Browser to console
+
+The browser uses the console's own origin and signs in with the
+[Core key](/troubleshooting#core-key):
+
+| Method and route | Request | Result |
+| --- | --- | --- |
+| `GET /console/auth` | No body | `200 {"mode":"login"}` or `200 {"mode":"authenticated"}` |
+| `POST /console/auth/login` | `Content-Type: application/json`, body `{"core_key":"…"}`; other members are rejected | `200 {"mode":"authenticated"}` and an HttpOnly, SameSite=Strict session cookie (Secure over HTTPS) |
+| `POST /console/auth/logout` | No credential payload | `200 {"mode":"login"}`; clears the cookie and the server-side session |
+| `GET /console/config` | Signed-in session | `node_installer`, `node_installer_sha256`, `self_hosted_installer`, `self_hosted_installer_sha256`, and `node_artifacts`: the providers (`docker`, `microsandbox`) whose node assets this console holds |
+
+Sign-in errors use the console's `{"error": "…"}` envelope: 400 for a malformed
+body, 401 for a wrong key, 415 for a non-JSON body, 429 with `Retry-After` when
+failed attempts are limited or sign-in is busy, and 503 when the console cannot
+start a session. The console compares the submitted key with its configured Core
+key in constant time and never logs or returns it. Only failed attempts count
+toward the limit; the correct key signs in even while failures are limited. The
+console refuses to start with a Core key shorter than 32 characters. Sessions live only in the console's memory; a console restart
+or Core key rotation requires signing in again. There are no console accounts,
+usernames, passwords, account setup or Basic authentication.
+
+Use same-origin browser requests and cookies. Mutations require the same-origin
+request checks; never put the Core key in JavaScript or browser storage.
+
+## Console to Core
+
+After sign-in and the same-origin checks, the console server forwards every
+`/core/v1/*` request with its private Core key as the Bearer credential; Core
+alone decides whether the route exists. It removes browser Authorization and
+forwarding-sensitive headers, and sets `X-Core-Console-Actor: console`. Core
+records the header as the audit `actor_label`. The label is caller-asserted and
+display-only: direct Core key scripts normally send none, which records an empty
+label, but could set any value. Never use it for authorization or as proof of
+origin.
+
+Web calls Core only through the typed Core clients in `packages/agents-client`:
+[AdminClient](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/packages/agents-client/src/admin-client.ts) (`/core/v1`),
+`SandboxAdminClient` (`/core/v1/sandbox`) and `CoreMetricsClient`
+(`/core/v1/metrics`). See [the complete administrator reference](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md)
+for methods, fields, filters, pagination and response shapes.
+Routes below are relative to `/core/v1`:
+
+| Workflow | Routes |
+| --- | --- |
+| Projects | `GET/POST /projects`, `POST /projects/{id}`, `POST /projects/{id}/archive` |
+| Project keys | `GET/POST /projects/{id}/keys`, `DELETE /projects/{id}/keys/{key_id}` |
+| Resource lists/details/deletion | `/projects/{id}/agents`, `/sessions`, `/environment-templates`, `/skills`, `/files`, `/vaults`, including the documented nested reads |
+| Asset ownership | `GET /projects/{id}/resource-owners` with batched resource IDs |
+| Key operation history | `GET /projects/{id}/write-operations` with key/resource/time filters |
+| Executor credentials | `GET/POST /projects/{id}/environments/{environment_id}/executor-credentials`, `DELETE …/executor-credentials/{key_id}` ([contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-executor-credentials.md)) |
+| Deployment model providers | `GET /harnesses`, `GET/PUT/DELETE /harnesses/{harness}/model-provider`; the key is write-only ([contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/model-execution.md#deployment-defaults)) |
+| Usage and health | `GET /summary`, `/sandbox/runtime-observations`, `/metrics` |
+| Administrator audit | `GET /audit-log`; deployment-wide entries have `project_id: null` |
+
+A Project UUID in a management path selects the target; it is not a credential.
+API-key plaintext is returned only by successful issuance, so display it once and
+never cache it. Reconcile uncertain issuance before explicitly issuing another key.
+Deleted/revoked resources retain their audit records. Historical unknown ownership
+stays null. Session usage grouped by key belongs to the Session's creation key;
+it is operational attribution, not per-key billing.
+
+## Sandbox administration
+
+The [deployment configuration contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/sandbox-deployment.md),
+[nodes and sandbox backends reference](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md)
+and [generated OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core.openapi.yaml)
+define deployment and node operations:
+
+- `GET/POST/PUT /core/v1/sandbox/deployment` and
+ `PATCH /core/v1/sandbox/deployment/maintenance`.
+- `GET /core/v1/sandbox/nodes`, `PATCH/DELETE /core/v1/sandbox/nodes/{node_id}`,
+ and `GET /core/v1/sandbox/nodes/{node_id}/allocations`.
+- `POST /core/v1/sandbox/enrollment-tokens` for a one-time node installation command.
+ Its non-secret `enrollment_id` reappears on the node that command registers.
+
+PostgreSQL owns one provider, per-sandbox resource specification and immutable
+Runtime selection. POST initializes it; PUT replaces the complete selection using
+`expected_generation`. Requests carry `resources` and, for Docker/microsandbox,
+`runtime`; safe responses return `specification` and `specification_digest`.
+Response `resources.allocations` and `resources.pending` are cleanup counts, not
+CPU, memory or disk settings. E2B accepts a write-only key and exact template build
+instead of a node Runtime release, and provisions without a node installation. E2B
+may omit `resources` to adopt the validated build's CPU and memory; responses show
+the build as read at selection time in `e2b.template_build`. Microsandbox responses
+return its idle `suspension` policy; other providers return null.
+
+Provider, resource and Runtime changes all require global maintenance and verified
+cleanup of retained/pending resources. Core validates the candidate before commit;
+a rejection preserves the previous configuration. A changed commit advances the
+generation and retires old nodes and enrollment tokens atomically. Explicitly resume
+after success. Neither switching nor editing configuration deletes resources or
+migrates existing Sessions. During maintenance, administrators can explicitly
+[archive each retained hosted Session](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md#administrative-session-archive)
+through the Core administrator API at the current generation, then read its
+resource disposition and recheck deployment counts. Archive preserves history
+and persisted Files/Artifacts; unpersisted workspace contents are lost and the
+original Session cannot resume. This API does not add a console archive control.
+Public Environment Templates, the `/v1` contract and
+caller-owned `self_hosted` provisioning remain unchanged.
+
+`GET /api/v1/sandbox-node/configuration` uses an enrollment Bearer token, or a
+retained node Bearer credential with `X-OAC-Node-ID`. This read does not consume
+enrollment. Retained matching nodes can read their configuration during maintenance.
+Installers must verify the returned generation, specification digest and Runtime
+before registration; local files cannot override the saved limits. A mismatch
+returns `sandbox_specification_mismatch` without replacing node state.
+
+Node configuration, enrollment, identity and connection routes live under
+`/api/v1/sandbox-node`, beside the daemon's `/api/v1/agent-daemon`. The reverse
+proxy sends `/api/v1` directly to Core; the console returns 404 for it and never
+forwards machine traffic. These routes use their own credentials, do not inherit a
+browser login and gain no management authority. E2B credentials are absent
+from node configuration and safe deployment views.
+
+## Frontend handoff and errors
+
+Frontend screen implementation is owned by the separate frontend task. The
+backend provides the `/core/v1` contract, the typed Core clients and the console
+proxy; backend tests do not qualify the screens.
+
+The console returns 404 for `/v1`, `/api/v1` and old `/console/api-keys` routes,
+even with an explicit application or machine Bearer credential. Invalid
+Origin/Host requests are rejected; unavailable Core or rejected upstream redirects
+return 502. Console authentication uses its own error envelope. Management resource
+errors and deletion constraints are documented in the administrator reference and
+generated schema; do not interpret every empty or failed read as an absent resource.
+
+## Core metrics
+
+`GET /core/v1/metrics?range=1h|6h|24h|7d` returns Core process, execution
+queue/slots, PostgreSQL and background-job measurements. It requires the Core key,
+rejects arbitrary query filters and never grants
+Agent execution access. See the [exact measurement contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core-metrics.md)
+for complete buckets, null values, units and process-local retention. Frontend
+implementation is maintained separately; this backend change does not modify
+Agent metrics or the public Agent API.
+
+## Node host history
+
+The Core key reads a node and its host history through
+`GET /core/v1/sandbox/nodes/{node_id}?range=1h|6h|24h`. See the
+[node host history contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/node-host-history.md)
+for nullable observations, freshness and aggregation. The node list is unchanged.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/api/web-management.md)
diff --git a/apps/docs/content/docs/admin-api.zh.mdx b/apps/docs/content/docs/admin-api.zh.mdx
new file mode 100644
index 000000000..a35483936
--- /dev/null
+++ b/apps/docs/content/docs/admin-api.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Core administration API · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+管理员脚本通过 Core 的回环端口调用 /core/v1，并使用 Core key。公网入口的 /core/v1 由 Web 管理会话处理；不能把它当成应用 API 或机器连接的代理。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/admin-api)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/agents-and-tools.mdx b/apps/docs/content/docs/agents-and-tools.mdx
new file mode 100644
index 000000000..ed238409b
--- /dev/null
+++ b/apps/docs/content/docs/agents-and-tools.mdx
@@ -0,0 +1,124 @@
+---
+title: "Agents, tools and harnesses"
+description: "Native harness tools, shared declarations and the limits of execution support."
+---
+
+Assessed against Core `206474a4c10901442b1faa094281bfb5559082b5` on 2026-09-22.
+The contract remains [OpenAI Python 3.13.0 at `d7c41ef`](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream.json), Beta
+`agents=v1`. This matrix records the bounded execution/tools milestone. It does not
+establish complete protocol compatibility; the remaining limits below stay open.
+
+**Implemented** means current source and controlled checks support the operation.
+**Qualified** additionally identifies a real public Core/PostgreSQL/daemon/native
+model workflow in the evidence register below. **Unsupported** describes a current
+admission/native limitation, not a restriction in the official contract.
+**Unverified** means evidence does not establish the stated semantics or profile.
+Qualification never extends automatically to another model, placement or combination.
+
+## Operation matrix
+
+All function rows refer to application-defined functions. Native workspace tools
+and Environment Plugin MCP have separate inventories and qualification.
+
+| Operation | Implemented behavior and real qualification | Unsupported or unverified boundary |
+| --- | --- | --- |
+| Initial message input, `sessions.create` | String input and ordered user-message arrays share atomic admission. Codex/Claude text and inline image execution: M1/M2; ordinary MiniMax text: M1/P1. [Input contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/message-input.md), [initial parser](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/api/session_initial_input.go). | Whitespace-only text is admitted verbatim for Codex and rejected at admission for Claude SDK and MiniMax Code ([text content](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/message-input.md#text-content)). Empty parts beside text (SES-08) and local size-limit parity need upstream evidence. Images are only qualified for inline PNG/JPEG on `none` and Core-managed Docker `openai_hosted`; MiniMax, self-hosted images and remote URLs remain gaps. |
+| Prepared and active messages, `sessions.events.create` | Ordered `input_text`/`input_image` arrays retain original content and distinct public user Items. HTTP 202 confirms persistence; native receipts establish application. Initial/prepared/active Docker PNG/JPEG: M2; active PNG on `none`: M1. [Shared admission](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/api/inputs.go). | Codex flattens native messages with blank-line separators. Claude can fold or queue native turns; it does not promise Codex's same-native-turn behavior. Public durability does not prove native consumption. Claude SDK and MiniMax Code reject messages without an image or non-whitespace text at admission (`unsupported_or_invalid_configuration`); Codex delivers them unchanged. |
+| Structured output, `agent.text.format` | Save/inherit/freeze `{type:json_schema,schema:...}`. Claude SDK object-root, single Agent, medium verbosity, ordinary functions returning text: S1 (`none`) and S2 (Docker, including prepared/active input and Files/Artifacts). Native final text is retained unchanged; its stream follows the official message sequence with the whole text in one `output_text.delta` ([item serialization](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/history-events-usage.md#item-serialization-2026-09-23)). [Contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/structured-output.md), [profile](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/engine/claude.go). | An explicit non-object root type is a protocol error for every harness ([validation](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/official-semantics-alignment.md#agent-configuration-validation--september-23)). Codex/MiniMax, schemas without an object root, schema numbers changed by binary64, self-hosted, Skills/Plugins, MCP, Subagent and discovery combinations reject execution. No output repair, coercion or extra model loop. Arbitrary schema dialects are unverified. |
+| Function configuration, saved/inline Agents | Required name/description/schema; `defer_loading` defaults false. Protocol errors, repeated names and explicit non-object root types reject with the official fields ([validation](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/official-semantics-alignment.md#agent-configuration-validation--september-23)). Saved references resolve into an immutable Session snapshot. Codex/Claude real calls: F1/F2/M2/S1/S2. [Parser](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/api/function_configuration.go), [saved tools](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/api/saved_tools.go). | MiniMax public functions reject. Claude requires an explicit object root. Local nonblank/512-byte name and 64-definition Session bounds are compatibility gaps. Saving configuration alone does not qualify execution. |
+| Function-result admission, `events.create` | Required `turn_id`, `call_id`, `success`; optional nullable `error` and `output`. Output is string or ordered text/image content. Scoped atomic batches retain field presence, original content and retry identity in storage; public result Items and events always carry `output` and `error`, null when not submitted ([item serialization](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/history-events-usage.md#item-serialization-2026-09-23)). Same result retries are accepted; changed results and results after cancellation return 409 `conflict_error`, including after terminal state. In the caller's Session, an unknown call or a call of another Turn returns 400 `invalid_request_error` without changing the pending action; missing and foreign Sessions stay 404 ([error rows](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/official-semantics-alignment.md#session-input-conflicts-and-result-targets--september-23)). F1/F2/M2 plus [controlled SDK/raw checks](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/tests/official_function_inputs.py). [Parser](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/api/function_inputs.go), [Store](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/store/function_inputs.go). | Admission is separate from application and public Item publication. Invalid or unqualified content cannot consume a pending call. Core messages omit the call and executor IDs that official messages name; hosted defaults and publication timing remain unverified. |
+| Function text results and native application | Codex waits for a matching live root dynamic-tool completion; Claude waits for a matching live root native tool result. Text/error results, retry/conflict, cancellation and cold continuation: F1/F2. [Receipt contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/function-result-images.md). | Transport writes alone do not confirm application. Confirmation is not provider consumption, crash recovery or exactly-once external effects. No automatic result replay. |
+| Function image results | Successful ordered inline PNG/JPEG with text, large PNG and image-only JPEG: Codex/Claude `none` F1/F2; Docker M2. Public Items retain submitted bytes. Codex receipt regression: F2. | Claude rejects failed images and remote references before persistence; native resizing may change its image bytes. MiniMax functions and self-hosted image workflows are unqualified. Other Codex image/error/reference combinations cannot be inferred from successful-inline evidence. |
+| Deferred function discovery | Type-only `tool_search` plus mixed eager/deferred functions: Claude SDK 0.3.269/native 2.1.269, Kimi K3, single Agent, medium, `none`, text results; text and PNG input D1. Native provider observations establish lazy schema loading. [Contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/tool-search.md). | A repeated `tool_search` is a protocol error. Codex/MiniMax discovery, search-only/missing-search, workspace, MCP, structured-output and Subagent combinations remain gaps. Opaque native policy changes lack a reliable pre-input deferral signal. Saved tools include `tool_search`; the pinned Session response union excludes it. Exact hosted projection is unverified. |
+| Explicit disabled search/PTC | Saved and inline `web_search.mode=disabled` and `programmatic_tool_calling.enabled=false`; shared native controls on initial and cold execution. All three harnesses on `none`: P1, including native inventory/control evidence. [Contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/tool-policy.md), [parser](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/api/disabled_tools.go). | Unsupported explicit enablement rejects at Session admission; saved Agents keep every pinned search mode as resource data (TV-05), and Sessions from such Agents reject unless they replace the tools. A repeated `web_search` is a protocol error. Omission retains approved native behavior, which does not establish official default-on PTC parity. Enabled search and default/error parity remain gaps; unrelated native utilities are not implicitly removed. |
+| Agent service-origin MCP | Implemented Codex/Claude HTTP `none` profiles, anonymous/static bearer, scoped Vault selection and native `mcp_call` Items. [Configuration and qualification limits](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/README.md#http-mcp-execution), [profiles](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/engine/profile.go). | This closure batch does not requalify MCP/provider combinations. MiniMax, self-hosted/hosted service-origin MCP, OAuth, nonempty inline headers/metadata and other transports/origins reject. Claude requires a static connected inventory; original MCP-envelope fidelity and continuing server health are unverified. |
+| Environment Plugin MCP/native tools | Separate [Docker Plugin transport matrix](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-templates.md#environment-origin-mcp-plugins) and [V1 deployment evidence](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/user-managed-runtime-v1.md). Native tools stay within the existing colocated Runtime. | Plugin MCP is not Agent service-origin MCP or a public function action. No new optional cross-product is qualified here. Native utility inventories need not be identical. |
+| Required action: `function_call` | Session GET/list and Session SSE expose persisted `{arguments,call_id,name,turn_id,type}`. Actions remain pending until native application or cancellation/terminal settlement. [Projection](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/store/function_state.go), [confirmation](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/store/function_results.go); real handling F1/F2/M2/S1/S2/D1; explicit client disconnect/query/reconnect: F3. | Function-call history is not pending-state authority. Client reconnect does not replay events or redo external application effects. |
+| Required action: `environment_connection` | Offline waiting input exposes `{environment_id,type}` before Turn creation. Connect the exact Session Environment through our scoped daemon enrollment. Three-harness Docker/E2B execution: E1; explicit initial pending-input/query/connection/native completion: E2; expiry: [controlled initial-input test](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/tests/official_self_hosted_initial.py). | Idle offline Sessions without pending input request nothing. Registration alone is not connectivity or native readiness. Stock `exec-server`/Noise transport is outside the approved V1 route. Exact upstream registration/action-removal timing remains unverified. |
+| Stream disconnect and execution loss | SSE is live-only. Reconnect, buffer events, retrieve Session/Turn/Items and deduplicate Item IDs. Worker recovery fails previously claimed work without replay; queued work can remain. [Recovery contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md#public-execution-admission), [connection reconciliation](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/store/environment_connection_recovery.go). | Client disconnect and daemon/Core loss are different cases. F3 qualifies client-stream loss and continued pending function handling; F2 qualifies native process loss with an unapplied saved result. Neither promises replay or recovery of unknown external effects. |
+
+## Required-action recovery contract
+
+The fixed [Session union](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agent_session.py)
+defines both variants. The official [Functions](https://developers.openai.com/api/docs/guides/agents-api/tools/functions)
+and [Manage sessions](https://developers.openai.com/api/docs/guides/agents-api/sessions/manage)
+guides, checked on 2026-09-22, direct clients to retrieve `required_actions` after
+restart or stream loss. A historical `function_call` Item alone cannot establish
+that a result is still pending. The fixed SDK governs field/type compatibility;
+current prose does not silently change that pin.
+
+For a pending function, use the returned Session, Turn and call identity. If the
+application already performed the function, keep and submit that saved result;
+do not run an external effect again merely because an action remains visible.
+Core's acknowledgement boundary is native application. For an environment action,
+connect its exact Environment using the existing enrollment authorization.
+[Connection observations](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/store/environment_connections.go)
+fence stale generations; transport connection can clear pre-Turn activity before
+native preparation. Neither registration nor an action disappearing proves that
+a model ran successfully. Query the matching Turn and Items for its outcome.
+
+Two timing questions remain open. Repeated `requires_action` notification order
+and acknowledgement timing are local implementation choices, not proven upstream
+semantics. Also, an admitted result that is cancelled before native observation
+can remain internally saved without a public output Item or `item.added`.
+[Item publication](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/internal/store/item_projection.go) and
+[the existing coverage record](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md#public-function-configuration) preserve
+this gap. Successful retry cannot manufacture the missing observation or establish
+that the model consumed the result.
+
+## Evidence register
+
+Real records below use fixed SDK 3.13.0 and raw HTTP through Core, dedicated
+PostgreSQL, daemon and native harness. Evidence is private under `~/.parsar/remediation/` on `zju_a100_2` and the
+development host. Paths containing `validated/` or `server-evidence/` identify
+downloaded local mirrors; summary files may also live only on the development
+host. Locators identify retained evidence without publishing credentials or
+private launch configuration. Revisions identify the accepted change,
+not a claim that every historical workflow was rerun at the current baseline.
+
+| ID | Exact evidence and accepted scope |
+| --- | --- |
+| M1 | `20260922/message-image-input/public-codex-reviewed.log` (59.41s), `public-claude-reviewed.log` (79.52s), `public-mcode-network-fixed.log` (48.95s); [PR #12](https://github.com/MiniMax-AI/parsar-core/pull/12), merge `37a2923`. Codex/Claude Kimi K3 PNG initial/active inputs, receipts, retries, cancellation, cold continuation and isolation; MiniMax M2.7 ordinary text regression. |
+| M2 | `20260922/workspace-images/validation-summary.json`; Codex `public-run-_lr5uiy_`, Claude `public-run-sb65p9e9`; candidate `2c295116d66ed9aafc808ec49a8cb6dcb5c674c2`, merge `1adb2489bc3415039440224e9a7905c53e68a557` ([#17](https://github.com/MiniMax-AI/parsar-core/pull/17)). Kimi K3, Codex 0.153.4, Claude SDK 0.3.269/native 2.1.269; Docker seven-Turn image/workspace workflow. Codex's receipt conclusion is superseded by F2. |
+| F1 | `20260922/function-result-images/validation-summary.json`, `validated/function-image-public-2567456666/public.json`; candidate `d3cdb225bc7628b968b76c7e1b400101894ce8cd`, merge `fd23f169e1ede1b2f1c39a1d9dcce71886e3c006` ([#16](https://github.com/MiniMax-AI/parsar-core/pull/16)). Claude SDK 0.3.269/native 2.1.269 with Kimi K3 on `none`; success PNG/JPEG, failed text, retries, cancellation, history continuation. Earlier Codex transport-only evidence does not qualify current receipts. |
+| F2 | `20260922/function-result-receipts/validation-summary.json`, `candidate-public-owner-sdk.log`; hosted `public-run-4fn70foy` (104.13s), `none` `function-image-public-945075091` (83.918s). Candidate `6dceb98e1c56469fcc70cd82025ce77fc870ed3d`, merge `206474a4c10901442b1faa094281bfb5559082b5` ([#20](https://github.com/MiniMax-AI/parsar-core/pull/20)); real Kimi, Codex 0.153.4. Qualifies native receipts, not completed provider consumption. |
+| F3 | `20260922/execution-tools-closure/pending-actions/validation-summary.json`; Codex `codex/public-run-8gexf5a8` (65.58s), Claude `claude_sdk/public-run-5f2tr7e_` (74.33s), production source `206474a`. The same [public verifier](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/tests/official_pending_actions_native.py) checks disconnected-client pending queries, success/error/cancel, original results, target isolation, retry/conflict and no implicit call replay with real Kimi on Docker. No Core restart or native-loss injection is claimed by these runs. |
+| S1 | `20260922/structured-output/acceptance-summary.json`, `structured-public-1905281777/public.json`; real candidate `7f533d46c472f3cdf7c16ce9471c225a2ba7eded`, merge `8716e699dbc34904499c94b6b0b03857bbebfaad` ([#11](https://github.com/MiniMax-AI/parsar-core/pull/11)). Claude/Kimi `none` schema/function execution and cold continuation. Schema-specific active steering was not separately qualified here. |
+| S2 | `20260922/hosted-structured-output/validation-summary.json`, `validated/public-inline.log`, `public-run-qvq3csf1` (186.09s); candidate `f6d2c3f2a1dc2ff5f177213bd2b20d78496011d0`, merge `aa85d8ecc60e0a8b7f2494b73caa81216ee197e2` ([#18](https://github.com/MiniMax-AI/parsar-core/pull/18)). Claude SDK 0.3.269/native 2.1.269, real Kimi; Docker saved/inline schema, prepared/active input, native files and four completed structured answers. |
+| D1 | `20260922/deferred-tools/tool-search-public-2039155387/public.json`, `public-image-isolated-tests.log` (86.71s); merge `178507ae7a63d4068e1e82bef9cd256ba398ae00` ([#13](https://github.com/MiniMax-AI/parsar-core/pull/13)). Claude SDK 0.3.269/native 2.1.269/Kimi K3 `none`; text results with initial/active PNGs, cancellation and cold continuation. `claude-native-1790052750` separately records provider schema inventories and native feasibility. |
+| P1 | `20260922/tool-policy/acceptance.json`, `server-evidence/tool-policy-{codex-2495445746,claude_sdk-2539346823,mcode-3747575401}/public.json`; candidate `eeb432c7495265ae3a9309e32f5b4323611c3245`, merge `4b8754a6eda6696d9b18eb8d583953ac16c6800f` ([#14](https://github.com/MiniMax-AI/parsar-core/pull/14)). Codex/Claude Kimi K3, MiniMax M2.7; four `none` Sessions per harness, native disable controls and cold continuation. |
+| E1 | `20260921/self-hosted-onboarding/{source-candidate.json,source-verified.json,live,live-e2b}`; candidate `8f0cd2530d7b58cb7fb3ea124a1fc43dacecca36`. [Exact Docker/E2B run paths and limits](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/user-managed-runtime-v1.md#evidence-and-verification-boundaries): Codex Kimi K3 Responses, Claude Kimi K3 Anthropic-compatible API, MiniMax M2.7, immutable Linux amd64 Runtime builds. Native execution, restart/history, cancellation, Files/Artifacts and isolation; shared credential lifecycle evidence is not a separate live rotation run for every E2B profile. |
+| E2 | `20260922/execution-tools-closure/environment-actions/result.json` contains Codex/Claude Kimi passes (13 checks each) and the retained MiniMax direct-network failure; `mcode-relay-retry/result.json` separately passes MiniMax M2.7 (13 checks) after correcting provider routing. Source `206474a`; same shared SDK/raw workflow, isolated Core/PostgreSQL and user-managed Docker. Covers initial creation SSE, client disconnect, exact pending Environment/no Turn or Items, scoped enrollment, one actual completed model Turn and creation retries preserving history. This is connection-action qualification, not another full lifecycle or E2B regression. |
+
+Controlled tests establish parser, projection, atomicity and race behavior; native
+feasibility probes establish only feasibility. Neither replaces the real records.
+Failed setup, provider and assertion runs remain failures with their original
+scope. The unchanged gate requirements and independent review apply to this batch.
+
+## Milestone closure and remaining limits
+
+1. **Principal function recovery:** F3 directly verifies live client-stream loss
+ while a function is pending on Codex and Claude, authoritative queries, exact
+ targeting, rejection without mutation, original results, retry/conflict,
+ application, cancellation and isolation. F2 separately establishes truthful
+ native-loss settlement without replay. No active execution recovery is promised.
+2. **Principal environment recovery:** E2 explicitly verifies pending
+ `environment_connection` recovery and single initial execution on all three
+ harnesses. E1 retains broader deployment/history/isolation qualification.
+ Registration, connection and preparation remain distinct; no exact upstream
+ timing or arbitrary-provider qualification is inferred.
+3. **Recorded nonblocking timing:** an accepted result cancelled before native
+ application may lack a public result Item. The submitted data remains durable;
+ F2 confirms that native loss does not turn unknown delivery into Applied. The
+ fixed sources do not establish the publication point for this interleaving.
+ Keep it queued rather than inventing a public state or rewriting safe receipt
+ ownership. This limited timing question is not accepted protocol parity and
+ does not invalidate F3's principal pending-result workflow.
+
+Approved native capability differences (including default PTC), unsupported optional
+combinations, arbitrary provider parity and low-frequency error/default edge cases
+remain separate limitations. They do not authorize silently relabeling an unproved
+principal workflow as deferred. OAuth, full Usage, release publication, new tool
+kinds and new execution loops are outside this closure batch.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/execution-tools.md)
diff --git a/apps/docs/content/docs/agents-and-tools.zh.mdx b/apps/docs/content/docs/agents-and-tools.zh.mdx
new file mode 100644
index 000000000..5ed1f6f95
--- /dev/null
+++ b/apps/docs/content/docs/agents-and-tools.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Agents, tools and harnesses · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+保存 Agent 只保存配置，不启动执行。工具声明由所选原生 harness 执行；Codex、Claude Code 与 MiniMax Code 的能力和限制不同。x_agents_core 保留原有扩展字段名称。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/agents-and-tools)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/api-reference/agents.mdx b/apps/docs/content/docs/api-reference/agents.mdx
new file mode 100644
index 000000000..25bd137d4
--- /dev/null
+++ b/apps/docs/content/docs/api-reference/agents.mdx
@@ -0,0 +1,75 @@
+---
+title: Agents
+description: >-
+ Agents. Application API: Project API key. Public schema constrained by the
+ pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core
+ extensions.
+full: true
+_openapi:
+ toc: []
+ structuredData:
+ headings: []
+ contents:
+ - content: >-
+ Lists only the authenticated tenant's saved Agents, independently of
+ Sessions. Limit 0 is treated as 1 and larger limits as 100, as
+ observed on the hosted service. The local default is 20; exact
+ upstream default/cap and empty cursor fields remain unverified. An
+ unknown, malformed or foreign after cursor returns not found.
+ - content: >-
+ Persists configuration independently of execution. Names over 128
+ characters and metadata outside 16 string pairs with 64-character keys
+ and 512-character values return invalid_request_error with the
+ official param; U+0000 in stored strings is rejected as a local
+ storage limit. As on every Agents API JSON route, a non-JSON
+ Content-Type, invalid UTF-8, malformed JSON, a repeated key at any
+ depth or a non-object root returns invalid_request_error with a null
+ param and the official message before other checks; an empty or null
+ body is {}. Missing, unknown, wrongly typed or unsupported enum
+ members of the pinned configuration shapes (tools, text, reasoning,
+ service_tier, multi_agent) return invalid_request_error with the JSON
+ path as param; duplicate function names, repeated web_search or
+ tool_search and non-object schema root types return it with a null
+ param. Supports model/name/instructions/metadata, explicit reasoning
+ and service tiers, multi_agent, text/json_schema,
+ function/tool_search/programmatic_tool_calling/web_search and HTTP MCP
+ with nullable credential_id, service origin (omitted or null on HTTP
+ transport is saved as service) and boolean required defaulting to
+ false. Saving credential_id grants no access: Session admission checks
+ attached Vault ownership and destination. MCP allowed_tools preserves
+ null versus empty; saved HTTP transport includes empty headers.
+ Model-derived reasoning defaults, other MCP variants and public retry
+ conformance remain incomplete. web_search saves every pinned mode:
+ omitted or null mode is saved as live and omitted or null context_size
+ as medium; allowed_domains preserves null versus empty and a present
+ location, including {}, includes all four keys with null for omitted
+ ones, as observed officially (req_db41d2f6261b4abfb69465eafe719ab5,
+ req_165d53b88445490b9146d8272c54134d). Session execution accepts only
+ explicit disabled web_search and disabled programmatic_tool_calling
+ through qualified Runtime controls; saved enabled forms reject at
+ Session admission. Session execution admits only its supported
+ configuration subset.
+ - content: >-
+ Reads the saved resource owned by the authenticated tenant,
+ independently of execution Sessions.
+ - content: >-
+ Preserves omitted fields and replaces supplied fields using shared
+ saved-configuration validation. Null name/instructions clear; null or
+ empty metadata clears all pairs. Name, metadata and configuration
+ validation errors return invalid_request_error with the official
+ param, using the Agent create rules before the Agent lookup. Existing
+ Session snapshots are unchanged. Empty updates advance updated_at
+ without changing saved fields. Nested replacement/null defaults,
+ model-derived reasoning and exact hosted error behavior remain
+ incompletely verified.
+ - content: >-
+ Deletes only the authenticated tenant's saved configuration. Existing
+ Session snapshots, history and recorded creation retry identities
+ remain independent. Missing and repeated deletion locally return404;
+ exact hosted error and in-flight creation/deletion semantics remain
+ unverified.
+---
+
+{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
+
+ param. The
+ inline agent uses the Agent create configuration validation with
+ agent.-prefixed params, reported before the input requirement and
+ saved-Agent lookup; saved configurations with conflicting tools or
+ schema roots reject admission with the same errors, and execution
+ limits keep unsupported_or_invalid_configuration. Hosted network
+ policy rejections return invalid_request_error with a null param.
+ Initial input accepts a string or ordered user-message array. Codex
+ and Claude SDK on none and qualified openai_hosted also accept inline
+ PNG/JPEG image content; other image combinations and remote URLs are
+ unsupported. None initial input atomically starts a Turn; self_hosted
+ initial input is reserved while returning its Environment connection
+ target, with execution deferred to native readiness and Session
+ failure on initial timeout. Initial input is required for none and for
+ streamed creation outside self_hosted. Omitted/null input remains
+ valid for non-streaming hosted and self_hosted creation. With
+ stream=true, returns live Session events starting with the committed
+ creation snapshot and closes right after the first agent.session.idle
+ recorded when a Turn ends or an input reservation stops being pending,
+ or any agent.session.failed, without sending later events. A creation
+ that admitted nothing closes after the snapshot; a settlement that
+ records no event closes after events up to the cursor read with a
+ settled Session projection. Required actions keep it open; disconnect
+ does not cancel execution. The GET events stream remains live-only.
+ New Sessions retain their authenticated creator; all creation retries
+ require the same typed subject, including across key rotation.
+ Saved-Agent retries and inline requests using Vault attachments or
+ credential references retain caller intent independently of later
+ resource changes; new hosted inline requests also freeze caller intent
+ before deployment defaults resolve; unrelated non-hosted inline
+ retries preserve resolved/default equivalences, and their resolved
+ hash leaves out any deployment default. Provider keys enter retry
+ hashes only as fingerprints keyed by the credential key. Unknown
+ historical creators reject retries; known creators without recorded
+ intent retain resolved-snapshot retry rules. These conflict policies
+ are local and not verified hosted parity. A same-key stream=true retry
+ of an existing creation returns 201 with no events and closes at once;
+ retry with stream=false or use the GET events stream to recover.
+ Claude SDK on none and Core-managed Docker openai_hosted supports
+ qualified object-root json_schema output with medium verbosity,
+ single-Agent execution and ordinary functions. Hosted execution reuses
+ native workspace tools and Files/Artifacts; Skills, Plugins,
+ capability directories, HTTP MCP, Subagent and tool_search
+ combinations remain unqualified, including inherited template
+ contents. Other non-text initial input remains unsupported. Basic
+ Codex and Claude SDK openai_hosted creation requires an explicitly
+ configured managed provider. The Claude workspace profile supports
+ non-deferred function tools with text or successful inline PNG/JPEG
+ results alongside native workspace tools; HTTP MCP remains
+ unsupported. Idle Sessions provision automatically; initial
+ provisioning has no caller connection action. Network defaults to
+ enabled; disabled and restricted exact ASCII hostnames are supported.
+ Restricted policy requires 1–100 allowed domains. Unsupported hostname
+ forms and startup installations are rejected. Confidential env,
+ system/npm/Python packages and ordered setup commands use the shared
+ initialization lifecycle; requested network applies after setup.
+ Initial inline and tenant-owned file_id files freeze encrypted bytes
+ before provisioning, then install through the common Core lifecycle
+ before native execution or live Files access. With a template
+ reference, omitted/null files, env, packages and setup_commands
+ inherit. Non-null files and command lists replace; env overlays by
+ key; each package manager inherits on omission/null and otherwise
+ replaces its list. Empty lists clear their selected field.
+ Tenant-owned environment_template_id references inherit omitted/null
+ network and allow only narrowing overrides. Inline hosted network:null
+ retains the enabled default; updating a Template with network:null
+ resets its saved policy to enabled. Core freezes effective
+ configuration; template updates/deletion do not alter Session
+ snapshots or same-intent creation retries. Inline or tenant-owned
+ skill_reference Skills share initialization. Templates preserve
+ default/latest/explicit selectors; Session creation freezes concrete
+ metadata and encrypted content atomically. Skill, Plugin and
+ capability-directory list omission/null inherit; a non-null list
+ replaces, including empty-list clearing. Omitted/null Skill version
+ selectors resolve the default version. Source deletion/default updates
+ cannot change committed Session Skill contents. Deferred function
+ discovery uses type-only tool_search and per-function defer_loading in
+ the qualified single-agent Claude environment:none function profile,
+ including qualified inline image messages and text results. Explicit
+ web_search mode disabled and programmatic_tool_calling enabled false
+ use frozen common Runtime controls. Enabled forms, including those
+ saved on an Agent, remain unqualified and reject before any write
+ unless the Session replaces tools. Omitted programmatic configuration
+ preserves native behavior, a documented difference from the official
+ default-on behavior. Other combinations remain unqualified; see the
+ operation coverage.
+ - content: >-
+ Returns supported none, self_hosted and basic openai_hosted Session
+ environments. Self-hosted pending input can require a caller
+ connection before a Turn exists. Hosted initial provisioning remains
+ idle until a Turn starts; connection observations are not native
+ execution readiness.
+ - content: >-
+ The metadata field is required in an update body. Send null or {} to
+ clear it, or supply an object to replace all pairs. Up to 16 string
+ pairs, with keys at most 64 characters and values at most 512
+ characters; violations and non-string values return
+ invalid_request_error with a metadata or metadata. param. U+0000
+ is rejected as a local storage limit. Malformed, missing and foreign
+ Session IDs share the not-found response. Execution configuration and
+ activity are unchanged. Returns the same safe Environment and
+ pending-input activity projection as Session retrieval.
+ - content: >-
+ Removes a durably idle or failed Session and its history from the
+ public API. A Session whose root Turn is queued, in progress or
+ waiting (including required actions) or whose input reservation is
+ pending returns 409 conflict_error and is left unchanged; cancel it
+ and wait until it is idle before deleting. Subagent child Turns and
+ pending Environment file writes are not checked and do not block
+ deletion. Repeating the deletion of the caller's own deleted Session
+ returns the same confirmation; missing and foreign Sessions return
+ 404. Internal records and native history are retained pending separate
+ physical cleanup; overlapping stream timing remains unverified.
+ - content: >-
+ An empty events array is a resource-authorized no-op; it creates no
+ execution retry identity, Turn, Item or input receipt. For environment
+ none, atomically accepts text messages, cancellation and function
+ results. Messages steer active work or start a queued Turn. The
+ supported self_hosted profile accepts text-only messages; qualified
+ Codex and Claude SDK openai_hosted profiles also accept inline
+ PNG/JPEG. Under the Session lock, matching retries retain their
+ original target; new active messages append to the current Turn, while
+ idle messages reserve work and wait up to the original five-minute
+ connection/admission deadline. Return 202 only after durable
+ admission, without claiming native application; active messages create
+ no Turn or reservation. Cancellation-only prepared-environment batches
+ use existing durable cancellation admission and return 202 without
+ waiting for native exit; a new cancellation conflicts while a pre-Turn
+ reservation is pending. Homogeneous tool_result-only
+ prepared-environment batches reuse existing scoped result admission
+ and application receipts without creating a Turn or bypassing a
+ pending reservation. Mixed prepared-environment batches remain
+ unsupported. HTTP expiry/cancellation use local 409
+ environment_input_expired/environment_input_cancelled errors. New
+ input on a Session whose hosted Environment failed to provision
+ returns the observed 409 conflict_error "the hosted environment failed
+ to provision"; input already waiting when it fails and expired
+ Environments keep the local 409 environment_unavailable. Input the
+ Session cannot accept in its current state, such as a result after
+ cancellation or a batch while earlier input is pending, and a result
+ that differs from the call's saved result return 409 with type and
+ code conflict_error; reusing an Idempotency-Key with a different batch
+ returns the local 409 idempotency_conflict. Inside an owned Session, a
+ result for an unknown call or for a call of another Turn returns 400
+ invalid_request_error and changes nothing; missing and foreign
+ Sessions return 404. Losing execution ownership returns 503. The
+ response write deadline accommodates the admission window for either
+ prepared Environment, independently of new-hosted-admission and
+ executor URL settings. Disconnecting the waiting HTTP request does not
+ cancel retained work or restart its deadline. Retry keys identify the
+ whole ordered batch. Function output accepts text or ordered
+ text/image parts subject to engine support; Claude SDK accepts text
+ results and, on none and qualified openai_hosted, successful inline
+ PNG/JPEG results, preserving ordered content; error images and remote
+ references reject before admission. Native image resizing may change
+ bytes. Runtime image-result support is checked only for image-bearing
+ delivery. Codex and Claude SDK on none and qualified openai_hosted
+ accept ordered inline PNG/JPEG image messages. Self-hosted profiles
+ and other engines remain text-only; remote image URLs are unsupported.
+ Image references are retained unchanged without service-side
+ downloads.
+---
+
+{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
+
+ param. Metadata has a local 64 KiB encoded storage
+ bound. U+0000 in stored strings is rejected as a local storage limit.
+ Credentials, Session binding and hosted error/retry parity remain
+ incomplete.
+ - content: >-
+ Reads a Vault owned by the authenticated project without resolving
+ credentials, Sessions or execution devices. Missing and foreign IDs
+ share the same not-found response; exact hosted error semantics remain
+ unverified.
+ - content: >-
+ Atomically removes the authenticated project's Vault and all its
+ stored Credentials without an encryption key, decryption or external
+ requests. Existing Session snapshots, history and recorded retries
+ retain their frozen identities; subsequent credential lookups fail
+ without reselection or anonymous fallback. Already-resolved tokens and
+ running Sessions are not revoked or cancelled. Missing/repeated
+ deletion locally returns 404. Exact hosted archive, post-delete
+ visibility and concurrent/error semantics remain unverified; physical
+ erasure from native history, WAL or backups is not established.
+---
+
+{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
+
+.edited-`.
+3. It compares what it wrote with what actually runs. Each container carries a digest
+ of its inputs (the `io.oac.inputs` label; native Core carries `OAC_INPUTS`),
+ and `apply` recreates or restarts exactly the services whose inputs differ: Core
+ first, then Web. The **Restarts** column below says which services a setting
+ affects. Restarting Web signs everyone out of the console.
+4. While any service runs, `apply` also starts the stopped ones. After `oac stop`,
+ it only writes the files and the installation stays stopped.
+5. If Core refuses a value at startup, `apply` prints Core's startup error. If every
+ service was running with the previous files, it restores them and starts the
+ services again; otherwise it reports the failure, and the next `apply` finishes
+ the work.
+
+`oac status` reports changes to `config.json` that are not applied yet and
+generated files edited by hand.
+
+### Changing the public URL
+
+`public_url` is the one origin that applications, nodes, sandboxes and self-hosted
+executors use; Core derives the daemon WebSocket URL, the self-hosted `remote_url` and
+each sandbox's connection address from it. With `null`, Core uses
+`http://127.0.0.1:` and only this host can reach it.
+
+You can set or change it at any time with `oac apply`. When nodes, hosted
+sandboxes or self-hosted executors are bound to the current address, `apply` lists
+them and asks you to type the new URL (`--confirm-public-url-change URL` when not
+interactive). Afterwards, nodes on the old address get no new sandboxes: remove them
+in Web and add them again. Existing sandboxes and executors keep working only while
+the old address still reaches this Core, and `apply` warns that self-hosted executors
+must restart with the new `remote_url`. Their installer refuses to reuse an
+installation made for the old address, and moving an executor isn't supported yet:
+create new self-hosted Sessions and connect their hosts again. Update your reverse
+proxy first.
+
+### Settings
+
+`core.runtime_history.headers` may hold export credentials. They stay in the
+`0600` `config.json` and the generated file Core reads, and never appear in `oac`
+output or in Core's settings snapshot. Model providers are not process settings; see
+[Default models](#default-models).
+
+
+| Key | Type | Default | Modes | Change | Restarts | Meaning |
+| --- | --- | --- | --- | --- | --- | --- |
+| `$schema` | string | none | all | any time | none | Editor hint that points at the installed copy of this schema. Ignored. |
+| `format` | `1` | none | all | fixed | none | Configuration format. Only an upgrade changes it. |
+| `mode` | `"all"` \| `"core-only"` \| `"web-only"` | `"all"` | all | fixed | none | Which services this installation runs. Install flag: `--core-only` or `--web-only`. |
+| `native_core` | boolean | `false` | `all`, `core-only` | fixed | none | Run Core as a systemd user service instead of a container. Install flag: `--native-core`. |
+| `public_url` | string or null (canonical origin; HTTP only on loopback) | `null` | all | `oac apply` | core, web | Public origin of Core and Web behind your TLS reverse proxy, such as https://core.example. Nodes, sandboxes and self-hosted executors use it. null means local access only through http://127.0.0.1. Install flag: `--public-url`. |
+| `ports.core` | integer 1024–65535 | `8091` | `all`, `core-only` | `oac apply` | core (core, web with native Core) | Loopback port of the Core API. With native Core, Web follows it. Install flag: `--core-port`. |
+| `ports.web` | integer 1024–65535 | `8080` | `all`, `web-only` | `oac apply` | web | Loopback port of Web. Install flag: `--web-port`. |
+| `ports.database` | integer 1024–65535 | none | `all`, `core-only` | `oac apply` | database, core | Loopback port of PostgreSQL. Present exactly when native_core is true; the installer picks a free port. |
+| `web.core_url` | string (canonical origin; HTTP only on loopback) | none | `web-only` | `oac apply` | web | Origin of the Core that this Web connects to: HTTPS, or HTTP on a loopback host. Install flag: `--core-url`. |
+| `log.level` | `"debug"` \| `"info"` \| `"warn"` \| `"error"` | `"info"` | all | `oac apply` | core, web | Minimum log level of Core and Web. |
+| `log.format` | `"auto"` \| `"text"` \| `"json"` | `"auto"` | all | `oac apply` | core, web | Log format. auto writes text to a terminal and JSON otherwise. |
+| `log.add_source` | boolean | `false` | all | `oac apply` | core, web | Add the source file and line to each log record. |
+| `core.execution_concurrency` | integer 1–1024 | `4` | `all`, `core-only` | `oac apply` | core | Concurrent execution work units in Core. Unrelated to node sandbox capacity. |
+| `core.harnesses` | array of `"claude_sdk"` \| `"codex"` \| `"mcode"` | `["claude_sdk", "codex", "mcode"]` | `all`, `core-only` | `oac apply` | core | Harnesses that Sessions may select. |
+| `core.default_harness` | `"claude_sdk"` \| `"codex"` \| `"mcode"` | `"codex"` | `all`, `core-only` | `oac apply` | core | Harness used when a Session names none. It must be listed in core.harnesses. |
+| `core.write_audit_retention` | string (Go duration, at least `1h`) | `"2160h"` | `all`, `core-only` | `oac apply` | core | How long non-creation write history is kept, as a Go duration of at least 1h. |
+| `core.oauth_trusted_origins` | array of string (canonical HTTPS origin) | `[]` | `all`, `core-only` | `oac apply` | core | Extra HTTPS origins trusted as private OAuth issuers. |
+| `core.database_pool.max_conns` | integer or null ≥ 1 | `null` | `all`, `core-only` | `oac apply` | core | Maximum database connections. null keeps the driver default, max(4, CPU count). |
+| `core.database_pool.min_conns` | integer or null ≥ 0 | `null` | `all`, `core-only` | `oac apply` | core | Minimum idle database connections. null keeps the driver default, 0. |
+| `core.database_pool.max_conn_lifetime` | string or null (Go duration) | `null` | `all`, `core-only` | `oac apply` | core | Go duration. null keeps the driver default, 1h. |
+| `core.database_pool.max_conn_idle_time` | string or null (Go duration) | `null` | `all`, `core-only` | `oac apply` | core | Go duration. null keeps the driver default, 30m. |
+| `core.database_pool.health_check_period` | string or null (Go duration) | `null` | `all`, `core-only` | `oac apply` | core | Go duration. null keeps the driver default, 1m. |
+| `core.runtime_history` | object or null | `null` | `all`, `core-only` | `oac apply` | core | Runtime history collection and OTLP export. null keeps local collection with Core's defaults. Core checks the values at startup. |
+| `core.runtime_history.transport` | string | none | `all`, `core-only` | `oac apply` | core | OTLP export transport. |
+| `core.runtime_history.endpoint` | string | none | `all`, `core-only` | `oac apply` | core | OTLP collector endpoint. Omit it to keep history local. |
+| `core.runtime_history.insecure` | boolean | none | `all`, `core-only` | `oac apply` | core | Export without TLS. |
+| `core.runtime_history.headers` | object of string values | none | `all`, `core-only` | `oac apply` | core | Headers sent with each export, such as credentials. Never shown by oac or Core. Sensitive. |
+| `core.runtime_history.queue_capacity` | integer | none | `all`, `core-only` | `oac apply` | core | Export queue capacity. |
+| `core.runtime_history.timeout_seconds` | integer | none | `all`, `core-only` | `oac apply` | core | Export and query timeout in seconds. |
+| `core.runtime_history.sample_interval_seconds` | integer | none | `all`, `core-only` | `oac apply` | core | Periodic sampling interval in seconds. |
+
+
+The schema is
+[`deploy/install/config.schema.json`](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/deploy/install/config.schema.json); each
+installation keeps a copy in `generated/config.schema.json` for editors. Core serves
+the non-secret settings snapshot, with the path of `config.json` and the apply
+command, at `GET /core/v1/installation`.
+
+## Runtime settings: Web
+
+Runtime settings live in Core's database. Change them in Web; scripts use the same
+Core API with the Core key.
+
+| Setting | Where in Web | Core API | Notes |
+| --- | --- | --- | --- |
+| Sandbox backend: Docker, microsandbox or E2B | **Nodes** (**Sandbox backend** with E2B): the setup wizard, ending with **Save configuration** | `/core/v1/sandbox/deployment` | One backend per deployment. `install.sh --sandbox` saves the first choice. To change it, see the Nodes page; that flow will change in a coming release |
+| Sandbox size and Runtime release | **Nodes**: the setup wizard | `/core/v1/sandbox/deployment` | Every sandbox gets the same size. See [Sandbox deployment](#sandbox-deployment) |
+| E2B API key and template build | **Nodes**: the setup wizard's **E2B cloud** (the page is then called **Sandbox backend**) | `/core/v1/sandbox/deployment` | The key is write-only and encrypted |
+| Nodes and their capacity | **Nodes**: **Add node**, **Edit node**, **Remove node** on a node's page (**Remove** in its list row) | `/core/v1/sandbox/enrollment-tokens`, `/core/v1/sandbox/nodes` | See [Node capacity](#node-capacity) and the [nodes guide](/hosted-providers) |
+| Projects and API keys | **Projects and keys**: **Create project**, **Rename**, **Issue key**, **Revoke**, **Archive** | `/core/v1/projects` | Keys are shown once; Core stores digests |
+| Default model per harness | **System**: **Default model** | `/core/v1/harnesses/{harness}/model-provider` | See [Default models](#default-models) |
+| Executor credentials of a self-hosted Session | **Session log**, the Session's page: **Executor credentials** | `/core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials` | See [self-hosted executors](/self-hosted-execution) |
+
+Which harnesses are enabled, and the default one, are process settings
+(`core.harnesses`, `core.default_harness`); System shows them read-only. The
+[API index](/public-api#core-api) lists every Core API route.
+
+### Sandbox deployment
+
+Exactly one provider serves the deployment: Docker, microsandbox or E2B. The
+deployment specification holds the per-sandbox resources and, for Docker and
+microsandbox, the Runtime release. Web's setup proposes the Standard size from
+[`standard-sizes.json`](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/apps/web/src/features/sandbox/standard-sizes.json) and
+derives Small and Large from it; the installer applies the bundle's copy of the same
+file. The database owns the saved values.
+
+| Setting | Standard | Meaning |
+| --- | --- | --- |
+| `resources.cpus` | 2 | Whole vCPUs per sandbox, 1 through 255 |
+| `resources.memory_mib` | Docker 2048, microsandbox 4096 | MiB per sandbox, 512 through 1048576 |
+| `resources.root_disk_mib`, `environment_disk_mib` | microsandbox 8192 each | At least 1024 MiB; microsandbox only |
+| `runtime` | The bundle's Runtime release | Source revision, exact image ID and manifest, and Runtime and firmware hashes; never a mutable tag |
+| Idle suspension, snapshot retention | 300 and 86400 seconds | microsandbox only; fixed |
+
+E2B takes no `runtime`, and Web sends no resources for it: Core adopts the CPU and
+memory of the ready template build `template-id:build-uuid`, and supplied values must
+match it. Docker has no separate disk quota.
+
+Changing the provider, the size or the Runtime applies to the whole deployment; see the
+**Nodes** page, and note that this flow will change in a coming release. A successful
+change retires the old nodes and enrollment commands; history stays, and existing
+Sessions never move between providers. See the
+[operator reference](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#removal-and-maintenance)
+and the [deployment contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/sandbox-deployment.md).
+
+### Node capacity
+
+Core approves a node's capacity when you generate its Add node command: **Sandboxes at
+once** (`max_active`, default 2) and, for microsandbox only, **Retained sandboxes**
+(`max_retained`, default 8), with `max_retained >= max_active >= 1`. Docker never
+suspends sandboxes, so Web doesn't ask for it and Core keeps `max_retained` equal to
+`max_active`. Change them later with **Edit node**. Reservations and cleanup that is
+not confirmed count against capacity; lowering a limit stops no running sandbox. A
+node's own files can't change its capacity, size or Runtime.
+
+`core.execution_concurrency` is unrelated: it limits concurrent execution work in Core.
+
+### Default models
+
+Each harness has at most one default model provider: `protocol`, HTTPS `base_url`,
+a write-only `api_key` and, for MiniMax Code, `context_window` and
+`max_output_tokens`. It is the same bundle as `x_agents_core.model_provider`. Core
+encrypts it with `secrets/credential.key` and never returns the key.
+
+New Core-hosted (`openai_hosted`) Sessions and Sessions without an environment
+(`none`) use it when neither the request nor the Agent carries a provider; each
+Session freezes the provider it starts with, so a later change affects only new
+Sessions. Self-hosted Sessions never use it. A hosted or self-hosted Session with no
+provider is refused with 400 `model_provider_required`. See
+[model providers](/quickstart#model-providers) and the
+[model execution contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/model-execution.md#deployment-defaults).
+
+The operator file `AGENTS_API_EXECUTION_OPTIONS_FILE` is retired; see
+[Upgrade notes](/troubleshooting#upgrade-notes).
+
+## Secrets and identity
+
+| File | Content | Changed by |
+| --- | --- | --- |
+| `secrets/core.key` | The [Core key](/troubleshooting#core-key) | `oac rotate-core-key` |
+| `secrets/credential.key` | Encryption key for what Core stores sealed in the database: model providers, the E2B key, Vault credentials, Skills, initial files and environment setup | Nothing. Keep it with the database; `oac apply` refuses a changed file |
+| `secrets/database.password` | PostgreSQL password | Nothing. PostgreSQL reads it only when the database is created; `oac apply` refuses a changed file |
+| `state.json` | Installation ID, Compose project, image IDs, source commit and the digests of generated files | The tools only |
+
+A Web-only installation has only `secrets/core.key`, a copy of its Core's key.
+
+## Appendix: Core environment without the installer
+
+Core reads only its environment. The installer renders `generated/core.env` from
+`config.json`; if you run Core yourself (see
+[Maintainers and advanced deployments](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/maintainers.md)), set these variables. Compose
+loads the file with `env_file` and systemd with `EnvironmentFile`, so Compose must be
+2.26.0 or newer.
+
+| Variable | Set from |
+| --- | --- |
+| `OAC_PUBLIC_URL` | `public_url`, or Core's loopback origin. Core derives the daemon WebSocket URL, the self-hosted `remote_url`, the hosted sandbox address and the deployment's read-only `core_url` from it. Required with `OAC_INSTALLATION_ID` |
+| `OAC_ADDR` | `ports.core` (native Core) or the container port |
+| `OAC_DATABASE_URL` | The installation's PostgreSQL without a password, plus `core.database_pool` as `pool_*` query parameters |
+| `OAC_DATABASE_PASSWORD_FILE` | `secrets/database.password`. The URL must then carry no password; migrations and the maintenance commands read the file too |
+| `OAC_CREDENTIAL_KEY_FILE` | `secrets/credential.key` |
+| `OAC_CORE_KEY_DIGESTS_FILE` | `generated/core-key-digests.json`: a JSON array with the SHA-256 of the Core key |
+| `OAC_INSTALLATION_ID` | `state.json`; pinned to the database |
+| `OAC_SETTINGS_FILE` | `generated/settings.json`, the snapshot Core serves at `GET /core/v1/installation`; Core does not act on it |
+| `OAC_EXECUTION_CONCURRENCY`, `OAC_DEFAULT_HARNESS`, `OAC_HARNESSES`, `OAC_WRITE_AUDIT_RETENTION`, `OAC_OAUTH_TRUSTED_ORIGINS` | The matching `core.*` settings |
+| `OAC_HISTORY_SETTINGS_FILE` | `generated/runtime-history.json` when `core.runtime_history` is set; see the [history contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime-history-api.md) |
+| `OAC_LOG_LEVEL`, `OAC_LOG_FORMAT`, `OAC_LOG_ADD_SOURCE` | `log.*`; Web reads the same three |
+| `OAC_E2B_STATE_DIR`, `OAC_E2B_PROVIDER_BIN` | The E2B receipt directory and, for native Core, the bundled helper. The E2B key and template live in the database |
+
+A Web you run without the installer reads the variables in
+[Connecting the administrator console to Core](/bootstrap-projects-keys#server-configuration-and-login),
+plus `OAC_WEB_NODE_PAYLOAD_DIR`: the absolute path of the matched distribution's
+node payload (the installer's `node-payload/`). Without it, Add node and the
+self-hosted install command are unavailable.
+
+Core fails at startup, naming the replacement, while a retired variable is set:
+`AGENTS_API_DAEMON_WS_URL` (use `OAC_PUBLIC_URL`), `AGENTS_API_CONFIG_FILE` (no
+replacement), `AGENTS_API_EXECUTION_OPTIONS_FILE` (use
+[default models](#default-models)), `AGENTS_API_SANDBOX_ADMIN_DIGESTS_FILE` (use
+`OAC_CORE_KEY_DIGESTS_FILE`), and `AGENTS_API_MANAGED_RUNTIMES_FILE`,
+`AGENTS_API_SANDBOX_NODE_STATE_DIR` and `AGENTS_API_SANDBOX_NODE_CORE_URL` (the
+sandbox deployment lives in the database and nodes enroll separately). Core logs the
+file paths it loads, never environment values or file contents. Native installation
+paths must be canonical absolute paths without control characters, quotes, backslashes
+or wildcards. Keep the installation ID and the database together; Core refuses a
+missing installation ID when its database already has a deployment.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/configuration.md)
diff --git a/apps/docs/content/docs/configure.zh.mdx b/apps/docs/content/docs/configure.zh.mdx
new file mode 100644
index 000000000..8f0c525b7
--- /dev/null
+++ b/apps/docs/content/docs/configure.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Configuration reference · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+安装配置的唯一编辑入口是 config.json；运行 oac apply 应用变更。generated 目录由安装器生成。运行时后端、节点和默认模型由 Web 管理并保存在 PostgreSQL 中。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/configure)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/console.mdx b/apps/docs/content/docs/console.mdx
new file mode 100644
index 000000000..de30947cf
--- /dev/null
+++ b/apps/docs/content/docs/console.mdx
@@ -0,0 +1,74 @@
+---
+title: "Administrator console"
+description: "Monitor Core, inspect resources and manage deployment settings through Web."
+---
+
+Core Web is the administrator console for a Core deployment. Its Go service
+provides Core key login and forwards signed-in, same-origin `/core/v1` requests to
+Core. Applications use Core's public Agents API directly with their own Project API
+keys.
+
+The React console (`apps/web`) uses this contract: every browser request goes through
+the console's same-origin management routes with `AdminClient` and the sandbox
+management client, and it sends nothing to `/v1`.
+
+
+
+## Console pages
+
+| Group | Page | Purpose |
+| --- | --- | --- |
+| Monitor | Overview | Service status, running Sessions, sandbox slots and work needing attention; 24-hour Session activity; Core and its nodes as a topology, each with a popover glance; Sessions needing attention; usage by Project |
+| Monitor | Core metrics | The Core process: execution slots, the Turn queue, connected daemons, database latency and pool, background jobs |
+| Monitor | Agent metrics | Requests, errors, duration, tokens, models, tools, Agents and API keys over 1 h, 6 h, 24 h or 7 d |
+| Monitor | Sandbox metrics | Node capacity and hosted Runtime CPU and memory across Projects |
+| Monitor | Session log | Every Session, opening one Session's read-only conversation, trace and Turns; a self-hosted Session's page also manages its executor credentials and gives the command that connects a host |
+| Resources | Agents, Environment templates, Skills, Files, Vaults | Inspection and permitted deletion |
+| Platform | Projects and keys, Nodes, System | Project and key lifecycle; sandbox deployment and nodes; System: the installation's public address, API base URL, ID and source commit (read-only), each harness's default model provider (write-only key) beside its read-only startup state, the sandbox configuration every Project shares: provider, sandbox size, Runtime or E2B template build, idle suspension and maintenance, and Core's config.json startup settings with where to change them |
+
+Missing data is shown as missing (—), never as zero. How each figure is read and
+bounded is recorded in [management interface coverage](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/web/protocol-coverage.md).
+
+## Management scope
+
+Administrators can create, rename and archive Projects; issue and revoke their
+keys; inspect resources and execution history; delete supported resources; and
+issue, rotate and revoke the executor credentials of a self-hosted Session's
+environment on its Session page.
+They can also read summaries, Runtime observations and audit history, and manage
+deployment sandbox nodes. Deployment sandbox management selects E2B, Docker or
+microsandbox; caller-managed `self_hosted` Runtimes remain a separate application
+path.
+
+A Project owns one tenant and one principal. All its keys share assets and
+permissions; writes record the individual key as provenance. Projects and keys
+live only in PostgreSQL. Key issuance returns plaintext once and stores its digest.
+Rotate by issuing another key and revoking the old one. Archive disables every key
+in the Project while retaining assets and admitted work.
+
+The management API cannot create or edit arbitrary application resources, start
+Sessions, submit input or cancel execution. Applications perform those operations
+through `/v1`. Core has no API users, roles or memberships.
+
+## Connect and develop
+
+Follow the [installation guide](/install) for Core, Web and
+PostgreSQL with zero execution nodes. Installation creates no Project or application
+key; an administrator creates them on the console's **Projects and keys** page or
+through the management API. The browser signs in to the console with the Core key;
+only the console server sends it to Core.
+
+- [Connection and authentication](/bootstrap-projects-keys)
+- [Architecture and ownership](/execution-model)
+- [Management interface coverage](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/web/protocol-coverage.md)
+- [Frontend handoff and acceptance](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/web/roadmap.md)
+- [React application](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/apps/web/README.md)
+
+The [administrator API contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md) defines
+management routes and resource behavior. The [public API contracts](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md)
+define the separate application interface. See the [design principles](/concepts)
+for ownership and [contributor guide](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/CONTRIBUTING.md) for required checks.
+
+OpenAgentCore Web is available under the [MIT License](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/LICENSE).
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/web/README.md)
diff --git a/apps/docs/content/docs/console.zh.mdx b/apps/docs/content/docs/console.zh.mdx
new file mode 100644
index 000000000..3f91dbe76
--- /dev/null
+++ b/apps/docs/content/docs/console.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Administrator console · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+Web 是管理员控制台，提供 Monitor、Resources 和 Platform 操作。浏览器使用管理会话；Core key 作为上游凭据保留在 Web 服务端。应用 API 的执行请求不经过 Web。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/console)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/environments-and-files.mdx b/apps/docs/content/docs/environments-and-files.mdx
new file mode 100644
index 000000000..ab045960d
--- /dev/null
+++ b/apps/docs/content/docs/environments-and-files.mdx
@@ -0,0 +1,218 @@
+---
+title: "Environments and files"
+description: "Execution placement, Environment resources and workspace ownership."
+---
+
+This assessment covers the fixed [Python SDK contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream.json), with partial
+coverage. Core-managed Docker runs the three qualified native harnesses. V1
+user-managed `self_hosted` enrollment uses the same colocated Runtime for Codex,
+Claude SDK and MiniMax at `/workspace`; see its [real deployment qualification](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/user-managed-runtime-v1.md).
+For hosted compute, the deployment selects E2B, Docker or microsandbox through
+[Hosted Sandbox Manager](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md).
+For the separate caller-managed E2B path, the user owns allocation, renewal and
+cleanup through the official SDK and [Runtime packaging](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/deploy/e2b/README.md).
+[Templates](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-templates.md) remain a hosted-only resource path;
+[Files](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-files.md) reuse the exact authorized local workspace.
+
+The internal Store now owns a durable Environment association for newly created
+`self_hosted` and `openai_hosted` snapshots, atomically with Session creation.
+It derives configuration and tenant ownership from the Session; retries preserve
+the existing identity. Scoped reads hide associations after Session deletion while
+retaining the underlying record. The public text profile reuses this association
+and the preparation/admission path below; additional provider profiles remain open.
+Missing/`none` configurations and historical internal snapshots gain no backfill.
+
+
+The private daemon gateway authenticates the enrolled Environment executor key and
+exact dedicated device. Existing Worker connection observations retain generation
+and revision fencing; registration and connectivity do not establish native
+readiness. Rotation/revocation, Session deletion and ownership loss deny further
+access without promising immediate cessation of native effects. Native history
+remains local to the bound Runtime and cannot be replaced on retry. There is no
+registry/Noise relay or transient service-side harness credential.
+See the [enrollment guide](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/README.md#user-managed-runtime-enrollment).
+
+## Basic public Docker-hosted profile
+
+An explicitly configured default managed Docker provider enables `type=openai_hosted`
+for the qualified Codex, Claude Code and MiniMax Code profiles. Each uses the same
+Runtime lifecycle and workspace interfaces with its own native adapter/isolation.
+See the [engine profile guides](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md#public-engine-profiles) for setup and limits.
+The standalone [operator configuration](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/deploy/codex/README.md#standalone-operator-configuration)
+selects the qualified immutable Runtime image; advertised capabilities alone do
+not enable admission. An idle or initial-text creation commits Session, Environment
+and retry identity before the existing leased Worker provisions its allocation.
+A committed creation interrupted before bootstrap is recovered without replaying
+an existing allocation's Create.
+
+Omitted/null network defaults to enabled. Enabled, disabled and exact-host restricted
+policies use the same qualified image with adapter-selected immutable native policy.
+Templates and inline configuration share initial files, env, packages, ordered setup
+and inline or tenant-owned referenced Skills through the hosted initializer.
+Unsupported hostname forms and installation combinations reject explicitly; see
+the [Template coverage and limits](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-templates.md). Empty/null installation
+defaults produce safe empty metadata, not a live workspace inventory. Service-origin
+hosted MCP remains unsupported; Environment Plugin MCP has its
+own qualified transport matrix.
+
+Initial provisioning leaves a Session idle until a Turn starts, with no caller
+connection action. The managed scan records authenticated, exactly bound daemon
+connections through existing fenced generations. Native preparation remains
+separate. Core restart preserves allocation/workspace/native identity; it does not
+blindly replay uncertain work. Terminal cleanup revokes authority and settles
+pending input atomically before external reclamation. Matching retries preserve
+outcomes; new inputs reject terminal Environments. Expiry has no invented SSE
+variant. Local failure codes and exact event ordering remain unverified upstream
+semantics; this profile does not establish complete Environment compatibility.
+
+## User-managed E2B profile
+
+The application creates, renews and destroys its E2B sandbox through the official
+SDK. It deploys the shared Runtime, then enrolls that Runtime into a `self_hosted`
+Session. Core neither keeps an E2B allocation nor issues Provider renew/kill calls.
+The [E2B guide](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/deploy/e2b/README.md) owns packaging and
+user-side lifecycle instructions. Expiry or lost workspace/history must not trigger
+transparent replacement or replay. The [new enrollment qualification](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/user-managed-runtime-v1.md)
+records its own real deployment evidence.
+The [prior E2B qualification](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md#e2b-v1-qualification) records a historical
+Core-managed route; it does not establish this caller-managed enrollment result.
+Current deployment-managed E2B is a separate hosted configuration in the manager guide.
+
+## Initial public self-hosted profile
+
+Create a Session with `environment.type=self_hosted`,
+`workspace_directory: "/workspace"` and omitted/null/empty `capability_directories`. Creation
+accepts initial text as a string or ordered user-message array. Omitted/null input
+creates no Turn or connection action. Configured execution, an enabled harness and
+the exact local profile are validated
+before persistence. Supported optional functions remain engine-specific.
+
+Initial text commits a reservation and connection action, then returns the Session
+and Environment connection target while offline. Streamed creation sends the same
+committed projection as its `created` snapshot, already showing `requires_action`
+and the connection action, then the committed `requires_action` event. Like
+every fresh creation stream it ends right after the idle recorded when the
+admitted Turn ends or the reservation stops being pending, or after a failure;
+the connection alone clearing the action does not end it. A creation without
+input ends right after its created snapshot, and a same-key stream retry ends at
+once without events. The existing Worker prepares and admits the input; closing the stream
+leaves committed work intact.
+Initial expiry leaves a failed Session, safe error and empty actions without a
+Turn or an Environment failure. Creation retries preserve the original identity,
+deadline and input. Later live observers do not replay creation events.
+
+Later text-only batches recover their original reservation or direct receipt under
+the Session lock. New active messages append to the current Turn through existing
+ordered admission and native delivery; they create no Turn, preparation or reservation.
+If no Turn is active, reserve and wait for the existing Worker to retain native
+preparation, admit and claim. Return 204 only after that
+transaction commits. Connection actions precede a Turn and clear on connection;
+connection alone is not readiness. Retries preserve identity and the five-minute
+database deadline. HTTP disconnect retains the reservation. Local expired/cancelled
+outcomes return 409, lost ownership 503, and deletion 404; exact hosted error
+status/body and pending-input crash recovery are unverified. See the
+[canonical wait rules](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/CONTRIBUTING.md#environment-ownership-and-placement).
+
+Cancellation-only batches use the existing locked admission and native delivery.
+An idle cancellation creates no Turn, and retry identity preserves the original
+target during later work. Pending pre-Turn reservations still block new cancellation.
+HTTP 204 confirms admission, not native completion or OS quiescence. A cancellation
+before native Session transfer can still lack a final Outcome and conservatively
+fail; complete cancellation settlement remains open.
+Homogeneous function-result batches reuse scoped locked admission and native
+application receipts, without creating a Turn or preparation. Definitions use the
+existing function parser and remain fixed through native preparation and continuation;
+output/error field presence and ordered content keep their existing semantics.
+Retries retain the original call, including during later work. New results cannot
+bypass pending input. Function callbacks do not populate Environment installations.
+Mixed events, non-text input and nonempty capability directories remain unsupported.
+The public field types are unchanged; `/workspace` is the V1 deployment limit, not
+an upstream schema change. `remote_url` is the configured daemon WebSocket URL,
+returned unchanged. This is our private connection contract and does not claim
+stock `exec-server` compatibility. Service-origin HTTP MCP is explicitly rejected
+on `self_hosted`; `none` MCP and hosted Template Plugin MCP retain their own scope.
+
+Mechanism tests cover enrollment, credential checks and exact-device dispatch. They
+do not establish real public qualification. Before claiming that qualification,
+exercise fixed SDK/raw HTTP creation/input, actual native tools, Files/Artifacts,
+second-Turn history, Core/Runtime restart, cancellation and credential rotation/
+revocation/deletion on each declared deployment.
+
+## Contract inventory
+
+Paths below follow the SDK resource methods, before the service's `/v1` prefix.
+The authoritative fields and unions are linked to the pinned source; this table
+is an inventory, not a replacement schema.
+
+| Resource | Operations | Contract distinctions |
+| --- | --- | --- |
+| [Environment](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/environments.py) | `GET /agents/environments/{id}` | Created through Session configuration, with no standalone create/list/update/delete method in this resource. Safe metadata includes files, plugins, skills, type and status. |
+| [Template](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/templates.py) | `POST`, `GET /agents/environments/templates`; `GET`, `POST`, `DELETE /agents/environments/templates/{id}` | Reusable hosted configuration, resolved for each Session. List uses `after`, `limit` and `order`. Supplied update fields replace their value; omitted fields stay unchanged. Deletion includes confidential inputs. |
+| [Files](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/files.py) | `POST`, `GET /agents/environments/{id}/files` | Create accepts `file_id` or inline base64 data with an absolute path inside `/workspace`. List uses opaque `page`, not `after`, with stable path/order/limit across pages. |
+
+These are eight operations, separate from Session creation and live events.
+Templates use an `after` cursor and limit default 20, clamped to 1–100; file listing has nullable
+limit/path, non-null order/page when supplied, and case-sensitive path-component
+ordering. Both default to descending order. Do not reuse cursor decoding merely
+because both endpoints paginate.
+
+[Session environment input](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/environment_param.py)
+and [output](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/environment.py)
+have different shapes:
+
+- `none` selects no execution environment.
+- `self_hosted` input requires `type` and `workspace_directory`; its optional
+ nullable `capability_directories` defaults to an empty list. `remote_url` is
+ output-only. The output also includes the Environment ID and capability paths.
+ The output description's `/workspace` default does not make the input field
+ optional.
+- `openai_hosted` can reference a template and supply capability paths, network,
+ packages, files, plugins, skills, environment variables and setup commands.
+ Omitted template-backed values inherit; Session overrides cannot broaden the
+ template network policy. The service implementing this discriminator owns
+ provisioning; it does not rename the public discriminator for its provider.
+
+[Template responses](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environments/environment_template.py)
+expose safe metadata, retaining unresolved skill version selectors and file
+references. They do not return inline file/archive contents, environment variables
+or setup command bodies. Nullability and replacement behavior must be checked
+against each request type, not inferred from these response models.
+
+| Projection | State vocabulary |
+| --- | --- |
+| [Environment resource](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environment_info.py) | `pending`, `connected`, `disconnected`, `expired`, `failed` |
+| [Session environment event state](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agent_session_environment_state.py) | `pending`, `ready`, `connected`, `disconnected`, `failed`; nullable error |
+
+These projections cannot share an unchecked string cast. Session environment
+notifications carry Session/Environment identity and optional Turn identity.
+The Session's `required_actions` union includes `environment_connection` with an
+Environment ID, separately from function calls. Environment readiness is distinct
+from Session and Turn status.
+
+## Ownership and placement decision
+
+The canonical [architecture rules](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/CONTRIBUTING.md#environment-ownership-and-placement)
+keep Environment lifecycle common while leaving process placement and native
+transport to adapters. Logical ownership does not require a machine per object.
+
+| Object | Responsibility |
+| --- | --- |
+| API Session and Environment | Durable tenant ownership, configuration, pending interaction and connection observations. |
+| Provider allocation | Compute and filesystem lifetime; caller-owned for `self_hosted`, service-owned for hosted provisioning. |
+| Device and daemon connection | Authenticated engine-host identity and replaceable internal dispatch transport. |
+| Harness process and native Session | Native model/tool loop, execution state and proven history/continuation path. |
+| Runtime enrollment | Exact Environment/device/key binding for user-managed compute; no service-owned allocation. |
+
+Daemon, harness, tools and workspace are colocated in V1. Our daemon fills the
+executor role; a separate native executor and service-side harness are retired.
+The pinned public resources remain the target, while stock executor wire
+interoperability is explicitly outside this implementation.
+
+Co-location needs a real credential and isolation design: generated code must not
+gain the broader application credential or cross-tenant secrets through a shared
+unrestricted process account. A directory binding alone is not isolation. Retain
+native history independently of disposable compute, or prove native restoration;
+never treat an Environment ID as a filesystem or history backup. Do not silently
+move an existing Session away from its bound device.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environments.md)
diff --git a/apps/docs/content/docs/environments-and-files.zh.mdx b/apps/docs/content/docs/environments-and-files.zh.mdx
new file mode 100644
index 000000000..26bfc7865
--- /dev/null
+++ b/apps/docs/content/docs/environments-and-files.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Environments and files · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+Environment 与 Session 一起创建。none、self_hosted、openai_hosted 是协议中的执行位置名称；openai_hosted 在这里表示 Core 管理的计算资源。文件和工作区仍由对应资源及执行所有者管理。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/environments-and-files)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/execution-model.mdx b/apps/docs/content/docs/execution-model.mdx
new file mode 100644
index 000000000..07b150217
--- /dev/null
+++ b/apps/docs/content/docs/execution-model.mdx
@@ -0,0 +1,111 @@
+---
+title: "Execution and API architecture"
+description: "Applications call the public API; the administrator browser calls Web; Runtime connects to Core."
+---
+
+
+
+Core Web manages a Core deployment. Applications, including Parsar, use the public
+Agents API independently with their own Project keys. The management backend,
+`AdminClient` and the React console built on them are implemented.
+
+The [design principles](/concepts) define identity and authority.
+The [administrator contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md) defines exact
+routes, payloads, pagination and audit records.
+
+## Request boundaries
+
+```mermaid
+flowchart LR
+ browser["Administrator browser"]
+ console["Core console service"]
+ core["Core API"]
+ database[("PostgreSQL")]
+ application["Application / official SDK"]
+ runtime["Runtime and native adapters"]
+
+ browser -->|"Same-origin management requests; console login"| console
+ console -->|"/core/v1/* by prefix, including sandbox; Core key"| core
+ application -->|"/v1; Project API key"| core
+ core <--> database
+ core <--> runtime
+```
+
+React management code must use the Core clients from `packages/agents-client`:
+`AdminClient` for `/core/v1`, `CoreMetricsClient` for `/core/v1/metrics` and the
+sandbox management client for `/core/v1/sandbox`. The console service
+returns 404 for `/v1` and `/api/v1`, including requests with an explicit Bearer
+token. It has no application key and does not impersonate the selected Project.
+
+The console signs the browser in with the Core key, checks the host and origin, and
+forwards every signed-in `/core/v1/*` request to Core by prefix; Core alone decides
+whether the route exists. It strips the browser's Authorization, Cookie, Origin and
+Referer headers and supplies the Core key as its private upstream credential. Core
+rejects application keys on management routes and the Core key on `/v1`.
+The audit actor label is declared by the caller and is display only, never Core authorization: the console server declares `console`, and operator scripts calling Core with the Core key directly leave it empty.
+
+Node and daemon connections use `/api/v1` with their own credentials. The reverse
+proxy sends them directly to Core; the console never forwards them, and they do not
+grant a browser execution authority.
+
+## Ownership
+
+| Component | Responsibility |
+| --- | --- |
+| React frontend | Project selection, permitted management actions and operational views; cached reads (TanStack Query) that keep the last data on screen while refreshing |
+| `AdminClient` | Typed management requests and validation, sharing resource parsers with the public client |
+| `services/core-console` | Core key login, host/origin checks, and prefix forwarding of `/core/v1/*` with the Core key as the private upstream credential |
+| Core API and PostgreSQL | Project isolation, resource state, deletion preconditions, audit and scheduling |
+| Runtime and native adapters | Existing allocation, process lifecycle and execution protocols |
+
+A Project owns one tenant and one principal; its keys have equal access to its
+assets. Projects and keys are database records. Configuration contains deployment
+settings, not business identities. Core has no separate API-user or role model.
+
+Revoking one key prevents new authentication without removing assets or admitted
+work. Archiving a Project disables all its keys and retains resources for
+administrator inspection and deletion.
+
+Management adds no execution path. It can inspect metadata and history and apply
+existing deletion rules. It cannot edit arbitrary resources, create Sessions, send
+input or cancel work. A deletion conflict cannot be resolved by an implicit
+cancellation from the console.
+
+Secret fields remain write-only; Skill source and Artifact content have explicit
+read routes, while Source File content does not have an administrator download
+route.
+
+## Deployment and application Runtime paths
+
+Deployment sandbox management selects one provider at a time: E2B, Docker or
+microsandbox. E2B uses the deployment's provider integration; Docker and microsandbox
+use operator-managed machines. Provider setup, maintenance and node administration
+belong to the existing sandbox management surface.
+
+An application's `self_hosted` Runtime, including one it provisions in its own E2B
+account, is a separate caller-managed path. It does not choose or reconfigure the
+deployment provider. This console contract changes neither native Runtime protocols
+nor application Session creation semantics.
+
+## Frontend state and validation
+
+Session inspection uses paginated durable history and bounded polling. There is no
+management Session SSE endpoint. Project changes must discard stale reads and
+pending operation state before displaying results in another Project.
+
+The client sends each write once per explicit action. An uncertain result stays
+visible until the administrator checks state and decides how to proceed. Issued
+key plaintext must not enter browser storage or logs. Key issuance recovery
+follows the administrator contract.
+
+The sandbox deployment read (`GET /core/v1/sandbox/deployment`) describes the saved
+selection. It does not prove a reachable model, valid provider credentials or
+execution readiness. Runtime observations, usage coverage and audit history must
+retain the distinctions defined by Core. In E2B views, the running sandbox count
+comes from the deployment's allocations; the hosted Runtime total counts hosted
+observation records across projects and reported lifecycle states. These sources
+have different coverage and refresh independently, so the console does not infer
+resource retention or cleanup from their difference.
+Native execution ownership remains governed by [CONTRIBUTING.md](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/CONTRIBUTING.md).
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/web/architecture.md)
diff --git a/apps/docs/content/docs/execution-model.zh.mdx b/apps/docs/content/docs/execution-model.zh.mdx
new file mode 100644
index 000000000..d331de11c
--- /dev/null
+++ b/apps/docs/content/docs/execution-model.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Execution and API architecture · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+应用直接用 Project API key 调用 Core 的 /v1。管理员浏览器通过 Web 会话操作管理界面，Web 服务端持有 Core key。节点和 Runtime 用专属凭据直接连接 Core。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/execution-model)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/hosted-providers.mdx b/apps/docs/content/docs/hosted-providers.mdx
new file mode 100644
index 000000000..7b8638a06
--- /dev/null
+++ b/apps/docs/content/docs/hosted-providers.mdx
@@ -0,0 +1,309 @@
+---
+title: "Nodes and hosted providers"
+description: "Add and remove Docker or microsandbox nodes; diagnose connection and readiness."
+---
+
+A node is a Linux machine that runs sandboxes for Core-hosted Sessions when the
+sandbox backend is Docker or microsandbox. Core places each new Session on a node with
+free capacity; the node creates the sandbox, and the sandbox connects back to Core.
+With E2B you need no nodes. Self-hosted executors, which applications run for their
+own Sessions, are a different thing; see [Self-hosted executors](/self-hosted-execution).
+
+You add a node by generating a command in Web and pasting it on the host. The
+[operator reference](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md) covers the
+node protocol, manual registration, placement and failure handling.
+
+## Before you add a node
+
+- **Core has an HTTPS public URL** that the host and its sandboxes can reach: each
+ sandbox calls Core at `public_url`. A loopback installation can't have nodes, and
+ Web says so at Add node. See
+ [HTTPS and the reverse proxy](/install#https-and-the-reverse-proxy).
+- **Web holds the node files.** Install from the offline bundle, or add the release's
+ node files to the smaller bundle; see
+ [Download a release](/install#download-a-release). Otherwise Add node says that
+ the console has no node files for the provider.
+- **A sandbox backend is chosen.** The installer selects microsandbox unless you chose
+ otherwise. After `--sandbox none`, the **Nodes** page first asks you to choose
+ **Own machines**, then microsandbox (preselected as recommended) or Docker, which it
+ asks you to confirm, and a sandbox size, then **Save configuration**. Every node of a
+ deployment uses that provider.
+
+## Add a node
+
+1. In Web, open **Nodes** and select **Add node**.
+2. Set **Sandboxes at once** (default 2): how many sandboxes Core may run on this node.
+ With microsandbox, also set **Retained sandboxes** (default 8): how many it may keep,
+ suspended ones included. With Docker, Core keeps retained equal to at once. You can
+ change them later with **Edit node**.
+3. Select **Generate command** and copy the command. It registers one node, once, and
+ only if it runs within 10 minutes; Web counts down and offers
+ **Generate new command** when it expires.
+4. Run it on the host. Web follows the node from registered to connected to ready.
+
+The command downloads the node installer from your console, checks its SHA-256, and
+runs it with a one-time enrollment token. The installer downloads the node files from
+the same console and checks each against the release manifest, imports the Runtime
+image, registers the node, starts its service and waits until Core reports the node
+connected and ready. It never installs software, and it stops with a one-line hint
+before changing anything when a prerequisite is missing.
+
+Web's command runs the installer with sudo: it prepares the host itself, creating a
+`oac-node` service user and a system service. On a host where you have no sudo, the
+dialog's **No sudo on this host?** section gives the same command without sudo; the
+node then runs as a user service of a user that an administrator prepared.
+
+### The command
+
+This is the command Web generates, with this installation's values:
+
+```sh
+ (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
+curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
+printf '%s %s\n' '' "$d/node-install.pyz" | sha256sum -c --status &&
+printf '%s\n' '' | $s python3 "$d/node-install.pyz" --enrollment-token-stdin --source-url 'https://core.example' --core-url 'https://core.example' --provider 'docker' --installation-id '')
+```
+
+- It downloads the installer into a private temporary directory, checks its SHA-256,
+ and runs it with `sudo`, or directly in a root shell.
+- The token reaches the installer on standard input, so it never appears in a process
+ argument, an environment variable or sudo's log.
+- The leading space keeps the command out of the shell history where `HISTCONTROL`
+ ignores such lines (the Debian and Ubuntu default).
+- If the command is interrupted or the download stalls, run the same command again:
+ the download resumes.
+
+The host needs:
+
+- Linux amd64 with systemd; Python 3.9+, `curl` and `sha256sum`; root or sudo.
+- SELinux not enforcing. Sudo mode refuses an enforcing host; use the no-sudo command
+ with a prepared user there.
+- One Core per host: a host already running a sudo-mode node for another Core is
+ refused.
+- Docker: rootful Docker Engine running, its socket `/var/run/docker.sock` owned by the
+ `docker` group with mode `0660`, enforcing CPU and memory limits (cgroup v2).
+- microsandbox: `/dev/kvm` in the `kvm` group (hardware or nested virtualization), and
+ the libraries microsandbox links (glibc).
+- CPUs and memory for at least one sandbox of the deployment's size, and about 2 GB of
+ disk for the Runtime image.
+- HTTPS access to the console and Core at the public URL; sandboxes reach Core too.
+
+### Without sudo
+
+The no-sudo command is the same without `sudo`:
+
+```sh
+ (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT
+curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
+printf '%s %s\n' '' "$d/node-install.pyz" | sha256sum -c --status &&
+printf '%s\n' '' | python3 "$d/node-install.pyz" --enrollment-token-stdin --source-url 'https://core.example' --core-url 'https://core.example' --provider 'docker' --installation-id '')
+```
+
+Run it as the non-root user that will run the node; run by root, it installs the
+sudo-mode service instead. An administrator prepares that user once:
+
+- Docker: `sudo usermod -aG docker NODE_USER`, with Docker enforcing CPU and memory
+ limits. microsandbox: `sudo usermod -aG kvm NODE_USER` for read and write access to
+ `/dev/kvm`.
+- Lingering, after the group change: `sudo loginctl enable-linger NODE_USER`. After a
+ group change, sign in again as that user; if the user's systemd manager was already
+ running, restart it (`sudo systemctl restart user@$(id -u NODE_USER).service`) or
+ reboot.
+- microsandbox only: a home directory of at most 28 bytes, such as `/home/oac`,
+ because microsandbox's socket paths are short.
+- The host requirements above, except root, SELinux and one Core per host.
+
+`NODE_USER` stands for that user, as in the dialog's commands. Run the command as that
+user over SSH, or from a root shell with `su - NODE_USER`. The
+node's state then lives in `~/.oac/nodes//` of that user. The
+Docker group makes this user root-equivalent on the host too.
+
+## What sudo mode sets up
+
+| Item | Detail |
+| --- | --- |
+| Service user | System user `oac-node`, home `/var/lib/oac-node`, no login shell. An existing account with that home and a nologin shell is adopted; any other account named `oac-node` is refused |
+| Group | The group that owns `/var/run/docker.sock` (Docker) or `/dev/kvm` (microsandbox): `docker` or `kvm`, nothing else |
+| Service | `/etc/systemd/system/oac-node-.service`, a root-owned system unit with `User=oac-node`, enabled at boot. It restarts every 5 seconds while Core is unreachable and stops for good once Core no longer accepts the node |
+| Node state | `/var/lib/oac-node/.oac/nodes//`: identity, configuration, node files. microsandbox keeps its images and sandboxes under `/var/lib/oac-node/.oac/m/` |
+| Records | `/etc/oac-node/`: what the installer created or changed, used by reruns and uninstall |
+| Docker | The Runtime image, imported once, and a network `oac-node-` |
+
+Root only prepares the account, the group and the unit; everything else, the Docker
+network included, runs as `oac-node`, in its own session without a terminal. The
+installer never installs Docker, KVM or packages, never starts Docker, never changes
+device permissions, sudoers, firewall or SELinux settings, and never touches other
+accounts.
+
+**Docker mode is root-equivalent.** Membership in the `docker` group lets
+`oac-node`, and so anything that controls the node, act as root on the host. This
+is inherent to running sandboxes on Docker and equally true without sudo. Add Docker
+nodes only on hosts dedicated to sandboxes. microsandbox nodes need only the `kvm`
+group.
+
+**One Core per host.** All sudo-mode nodes share the `oac-node` account, so a host
+serves one Core in sudo mode; a command from a second Core is refused. A host also
+can't run the same installation's node both with and without sudo.
+
+**The token.** It is single-use, expires after 10 minutes and only registers the node.
+The installer takes it only on standard input and refuses it in the environment,
+where `sudo VAR=… python3` would record it in sudo's log. A sudoers policy with
+`log_input` records standard input, and so the token.
+
+## Rerun, expiry and slow links
+
+- Rerunning the same command is safe. Once the node is registered, a rerun uses the
+ node's own credential, changes nothing that already matches and needs no token.
+- A command that already expired, or was used on another host, fails at once with
+ `Core rejected the node configuration read (HTTP 401)`: generate a new command and
+ run it within 10 minutes.
+- If the command expires during a slow download, registration fails with
+ `The enrollment command expired or was already used`. The downloaded files are kept:
+ generate a new command in Web and run it.
+- Downloads resume where they stopped. A download that brings less than 64 KiB in a
+ minute stops, keeping what it has; run the command again.
+- The Docker Runtime image is about 500 MB. On a slow link, load it first: copy the
+ release's `oac--linux-amd64-runtime.tar.gz` asset to the host and run
+ `sudo docker load -i` on it. The installer then finds the exact image and skips the
+ download.
+- Interrupting the installer, or closing its terminal, stops it; run the command again
+ to continue.
+
+## Logs
+
+The installer prints the node's log command (`Logs: …`) when it finishes. The Add node
+dialog shows it too when something needs attention: when the node reports a problem, or
+when it hasn't become connected and ready about a minute after registering.
+
+| Node installed | Command |
+| --- | --- |
+| With sudo, or by root | `sudo journalctl -u oac-node-.service` |
+| Without sudo, as the node's user | `journalctl --user -u oac-node-.service` |
+
+The installation ID is in the command (`--installation-id`) and on the **System** page.
+
+## Remove a node
+
+1. In Web, open **Nodes** and choose **Remove node** on the node's page, or
+ **Remove** in its list row, then **Confirm removal**. Core refuses while the node
+ still holds sandboxes, snapshots or pending cleanup; let them finish, or
+ [archive their Sessions](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#removal-and-maintenance)
+ through the Core API. Removal is permanent: the host can come back only as a new
+ node.
+2. Web then shows **Clean up the host** with the uninstall command. Run it on the host:
+
+ ```sh
+ (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
+ curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
+ printf '%s %s\n' '' "$d/node-install.pyz" | sha256sum -c --status &&
+ $s python3 "$d/node-install.pyz" --uninstall --installation-id '')
+ ```
+
+ For a node installed without sudo, **Installed without sudo?** gives the same command
+ without `sudo`; run it as that user.
+
+Uninstall first asks Core, at the address the node enrolled with, whether the node was
+removed, and refuses while Core still lists it. When the node enrolled with an address
+other than the current public URL, the dialog also shows **Old Core address gone?**:
+if that address no longer responds, it gives the command with `--force`, which skips
+the check; remove the node on the Nodes page first. Without the dialog, take the
+installer's SHA-256 from the `node-install.pyz` line of
+`https://core.example/node-install/SHA256SUMS`. Uninstall
+stops and removes the service, the node state, the records and the Docker network. It
+deletes the `oac-node` account only if the installer created it and no node remains;
+an adopted account only loses the groups the installer added.
+
+It never deletes sandboxes, volumes or images. It keeps the Runtime image and prints
+the `docker image rm` command. For microsandbox it keeps the store under
+`/var/lib/oac-node/.oac/m/`, prints how to delete it
+(`sudo -u oac-node rm -rf `), and keeps a created account until the store is
+gone; rerun uninstall afterwards. With `--force`, microVMs may still use the store, so
+check `pgrep -u oac-node` first. Uninstall can be rerun until it completes.
+
+## Troubleshooting
+
+### Readiness codes
+
+When a node is online but its provider is not ready, **Nodes** shows its status as
+**Provider unavailable**, with the reason in a help tip; **Overview** counts it as a
+**Provider issue**. The API reports the reason as a fixed code, the `diagnostic` field
+of `GET /core/v1/sandbox/nodes`. A node reports only its first failed check, and the
+next heartbeat, about ten seconds after a fix, clears or replaces it. The node's log has
+the local error behind the code.
+
+| Code | Web shows | Cause | Fix |
+| --- | --- | --- | --- |
+| `docker_unavailable` | Docker unavailable | The Docker socket is unreachable or not accessible, or Docker fails its info or image request | Start Docker and give the node's user access to `/var/run/docker.sock` |
+| `docker_limits_unsupported` | Docker limits unsupported | Docker reports no CPU quota or memory limit support | Use a host whose cgroups enforce CPU and memory limits (cgroup v2) |
+| `runtime_image_unavailable` | Runtime image missing | Docker does not have the pinned Runtime image | Rerun the add command, or load the image from the matching release |
+| `kvm_unavailable` | KVM unavailable | The node can't open `/dev/kvm` for reading and writing | Enable hardware virtualization and give the node's user KVM access, through the `kvm` group |
+| `microsandbox_artifacts_unavailable` | microsandbox components missing | The Runtime or firmware is missing or fails its SHA-256 check, or the helper is missing | Rerun the add command |
+| `capacity_insufficient` | Host too small | The host has fewer CPUs or less memory than one sandbox | Use a larger host, or change the sandbox size |
+| `provider_unavailable` | Sandbox provider unavailable | Any other failure, and every failure an older node reports | Read the node's log |
+
+A new group membership applies only to a new process. In sudo mode, restart the node
+service: `sudo systemctl restart oac-node-.service`. Without sudo,
+the user's systemd manager keeps the groups it started with, so restart that manager:
+`sudo systemctl restart user@$(id -u NODE_USER).service`. A node that is registered
+but never connects usually can't reach Core at the public URL, or its `/api/v1`
+WebSocket doesn't pass the reverse proxy.
+
+### Installer messages
+
+| Message | Fix |
+| --- | --- |
+| `Core rejected the node configuration read (HTTP 401)` before anything downloads, or `The enrollment command expired or was already used` | Generate a new command in Web and run it within 10 minutes |
+| Core's public URL changed after this command was generated | Generate a new command in Web and run it |
+| This host's node uses ``, but this command uses `` | The node was added under an older public URL. Remove it in Web, uninstall it, then add it again |
+| Docker Engine is not installed, or Docker is not running | Install Docker Engine, or `sudo systemctl enable --now docker`, then rerun |
+| Docker on this host does not enforce CPU and memory limits | Use cgroup v2, then rerun |
+| KVM is unavailable, or `/dev/kvm` must be group-accessible | Enable virtualization; your distribution's KVM package sets `root:kvm 0660` |
+| This host has N CPUs and M MiB of memory; each sandbox needs … | Use a larger host, or change the sandbox size |
+| SELinux is enforcing on this host | Use the no-sudo command as a prepared user |
+| This host already runs a sudo-mode node for another Core | One host serves one Core in sudo mode. Remove that node and uninstall it first |
+| Ask the host administrator to enable user lingering, or No systemd user manager is running | No-sudo mode: `sudo loginctl enable-linger NODE_USER`, or use sudo |
+| Core still lists this node | Remove it on the Nodes page first |
+
+## Change the sandbox backend or size
+
+To change the sandbox backend, the sandbox size or the Runtime, see the **Nodes** page;
+this flow will change in a coming release. A change applies to the whole deployment
+and retires every node. Retired nodes drop out of the list, so there is nothing to
+remove in Web: on each host, run the [uninstall command](#remove-a-node) (Core no longer
+accepts the node, so it needs no `--force`), then add the host again with a new command.
+The [operator reference](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#removal-and-maintenance)
+describes today's procedure and API.
+
+
+## Remove a node added before the rename
+
+A new installer refuses retained state for the same installation under the old
+`parsar-node` names. It does not convert that state or remove nodes belonging to
+another installation. Remove the node on its old Core's Nodes page, then run the
+**previous release's** verified `node-install.pyz --uninstall --installation-id
+<installation-id>`, with `sudo` only if that node was installed with sudo. Use
+`--force` only when that Core no longer exists.
+
+If the previous installer is unavailable, inspect and remove only that
+installation's resources:
+
+1. Stop and disable `parsar-node-.service` with `systemctl`, using
+ `sudo` for a system service or `--user` as the original installing user.
+2. Remove its exact unit file or enablement link. System units live in
+ `/etc/systemd/system/`; user links live in `~/.config/systemd/user/`. Reload the
+ same systemd manager after removing the unit.
+3. After stopping the node, remove its state directory as its owner:
+ `/var/lib/parsar-node/.parsar/nodes/` as `parsar-node` in sudo
+ mode, or `~/.parsar/nodes/` as the original user. Do not run
+ root cleanup through files or links controlled by the service account.
+4. In sudo mode, remove only `/etc/parsar-node/.json`. Keep the
+ account record, the `parsar-node` user and group memberships while any other
+ installation or retained microsandbox store uses them.
+5. For Docker, remove `parsar-node-` only after confirming that
+ its network has no attached containers. Keep Runtime images, volumes and
+ retained microsandbox stores until their owners have explicitly retired them.
+
+Then use the new Core's Add node command. The new account, service and state use
+`oac-node` and `~/.oac/nodes`; historical Core Session records remain in Core.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/getting-started/nodes.md)
diff --git a/apps/docs/content/docs/hosted-providers.zh.mdx b/apps/docs/content/docs/hosted-providers.zh.mdx
new file mode 100644
index 000000000..6479922c6
--- /dev/null
+++ b/apps/docs/content/docs/hosted-providers.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Nodes and hosted providers · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+在 Web 的 Nodes 页面添加节点，并在目标主机执行经过校验的命令。sudo 模式使用 oac-node 系统账户；无 sudo 模式使用用户服务。旧名称的同一安装实例必须先按旧版本流程移除，再添加。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/hosted-providers)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/index.mdx b/apps/docs/content/docs/index.mdx
new file mode 100644
index 000000000..1be8be55b
--- /dev/null
+++ b/apps/docs/content/docs/index.mdx
@@ -0,0 +1,28 @@
+---
+title: "OpenAgentCore documentation"
+description: "Install Core and Web, create a Project API key, and add execution capacity."
+---
+
+OpenAgentCore is self-hosted, open-source Agents API infrastructure: Core serves the
+OpenAI Agents API and runs native harnesses (Codex, Claude Code and MiniMax Code) in
+sandboxes on your machines. Web is the administrator console; it issues the keys that
+applications call Core with.
+
+| Page | For | What it covers |
+| --- | --- | --- |
+| [Install Core and Web](/install) | Administrators | Prerequisites, download, the installer and every option, HTTPS and the reverse proxy, a local trial, first sign-in, what is created on disk |
+| [Nodes](/hosted-providers) | Administrators | Adding a node with one command, sudo and no-sudo modes, removal, logs and troubleshooting |
+| [Self-hosted executors](/self-hosted-execution) | Administrators and application owners | Connecting an application's own machine to a `self_hosted` Session, rotating and revoking its credential |
+| [Operations](/troubleshooting) | Administrators | The `oac` command, the Core key, backups, upgrades and troubleshooting |
+| [Configuration reference](/configure) | Administrators | Every `config.json` setting and every runtime setting in Web |
+| [Call the API](/quickstart) | Application developers | `OPENAI_BASE_URL` and `OPENAI_API_KEY`, running a Session, model providers and `x_agents_core` |
+| [API reference](/public-api) | Developers | The `/v1`, `/core/v1` and `/api/v1` namespaces and their contracts |
+
+Deeper references: the
+[nodes and sandbox backends](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md)
+reference for operators, the
+[protocol coverage and native differences](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md), and
+[maintainers and advanced deployments](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/maintainers.md) for building distributions
+and running Core without the installer.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/getting-started/README.md)
diff --git a/apps/docs/content/docs/index.zh.mdx b/apps/docs/content/docs/index.zh.mdx
new file mode 100644
index 000000000..f1cb5461f
--- /dev/null
+++ b/apps/docs/content/docs/index.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "OpenAgentCore documentation · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+安装 Core 与 Web，用 Core key 登录 Web，创建项目并签发应用 API key，然后添加执行节点。应用使用 /v1；Web 的服务端使用 /core/v1；机器连接使用 /api/v1。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/install.mdx b/apps/docs/content/docs/install.mdx
new file mode 100644
index 000000000..4778a096b
--- /dev/null
+++ b/apps/docs/content/docs/install.mdx
@@ -0,0 +1,533 @@
+---
+title: "Install Core and Web"
+description: "Current distribution, host prerequisites, HTTPS, first sign-in and installation options."
+---
+
+One command installs Core, the Web console and PostgreSQL on a Linux host. Web is
+the administrator console: you sign in with the Core key, issue Project API keys and
+add nodes. Applications call Core's API with those keys.
+
+1. [Check the prerequisites](#prerequisites).
+2. [Download a release bundle](#download-a-release).
+3. [Run the installer](#install).
+4. [Put Core and Web behind HTTPS](#https-and-the-reverse-proxy), or
+ [try it locally first](#try-it-locally-with-a-quick-tunnel).
+5. [Sign in to Web and issue a key](#sign-in-to-web).
+6. [Add a node](/hosted-providers).
+
+These pages describe the current source. Every bundle carries the docs that match it
+under `docs/`; if you install an older bundle, follow those.
+
+## Prerequisites
+
+**The Core host**
+
+- Linux amd64 with Python 3.9 or newer.
+- Docker Engine with Docker Compose 2.26.0 or newer (`docker compose version`).
+- A non-root user who can run `docker`. The installer refuses root.
+- Free loopback ports 8091 (Core) and 8080 (Web), or
+ [other ports](#ports-and-directory).
+- The GitHub CLI, `gh`, to download the bundle.
+
+The Core host needs no KVM and no systemd user services, unless you choose
+[native Core](#native-core).
+
+**Network, for nodes and remote access**
+
+- A DNS name for Core and Web, such as `core.example`, with a TLS certificate.
+- A reverse proxy on the Core host that sends three routes to the right service; see
+ [HTTPS and the reverse proxy](#https-and-the-reverse-proxy).
+
+Node hosts and their sandboxes, E2B sandboxes and self-hosted executors all reach
+Core at this HTTPS address. A local trial needs none of this: install without a
+public URL and set it later.
+
+## Download a release
+
+The repository is internal for now, so GitHub asks you to sign in first:
+
+```sh
+gh auth login
+```
+
+Pick a release, download its offline bundle and check it:
+
+```sh
+gh release list --repo MiniMax-AI/parsar-core
+mkdir -p "$HOME/.oac/releases" && cd "$HOME/.oac/releases"
+gh release download --repo MiniMax-AI/parsar-core --pattern '*-linux-amd64-offline.tar.gz*'
+sha256sum -c oac--linux-amd64-offline.tar.gz.sha256
+tar -xzf oac--linux-amd64-offline.tar.gz
+cd oac--linux-amd64
+```
+
+`` is the release tag from the list, and `` is the source commit in the
+asset names. The installer also checks every file in the bundle against its
+`SHA256SUMS` before it changes anything.
+
+Each release has two bundles:
+
+| Bundle | Contains | Use it for |
+| --- | --- | --- |
+| `oac--linux-amd64-offline.tar.gz` | Core, Web and PostgreSQL images, the installers and every node and Runtime file | Any installation. Web serves the node files to your nodes and self-hosted executors |
+| `oac--linux-amd64.tar.gz` | The same without the node and Runtime files | Core-only hosts, and installations that use only E2B. Web can't add nodes or connect self-hosted executors until the files are present |
+
+To add the node files to the smaller bundle, create an `artifacts/` directory in the
+extracted bundle, download the release's other `oac--linux-amd64-*`
+assets (not the two bundles) into it, then run `./install.sh`, or rerun it if the
+installation already exists. Nodes download these files only from your Web console,
+never from GitHub, so node hosts need no GitHub access.
+
+## Install
+
+From the extracted bundle:
+
+```sh
+./install.sh --public-url https://core.example
+```
+
+The installer:
+
+1. checks the host and the bundle, and loads the Core, Web and PostgreSQL images;
+2. creates private `~/.oac` (mode `0700`) and the installation directory `~/.oac/core` with the Core key, `config.json`
+ and the `oac` command ([what it creates](#what-the-installer-creates));
+3. starts PostgreSQL, Core and Web with Docker Compose, on loopback ports only;
+4. selects microsandbox at Web's Standard size (2 CPUs, 4 GiB memory and two 8 GiB
+ disks each). It adds no node, so this host needs no KVM; you add nodes in Web.
+
+It creates no Project or API key, makes no model request and runs no sample task.
+It ends by printing the console address, the API base URL and the next steps.
+
+Without `--public-url`, the installation serves only this host
+(`http://127.0.0.1:8080` for Web, `http://127.0.0.1:8091/v1` for the API). Set
+`public_url` in `config.json` later and run `oac apply`; you don't reinstall. Nodes,
+E2B and self-hosted executors need the public URL.
+
+### Installer options
+
+Flags only seed `config.json` for a new installation. Afterwards you change settings in
+`config.json` with [`oac apply`](/configure#process-settings-configjson),
+and rerunning `install.sh` accepts no flag except `--install-dir`.
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `--public-url URL` | none: local access only | Public origin of Core and Web behind your reverse proxy, such as `https://core.example`: HTTPS, no path. Plain HTTP only for a loopback host. Seeds `public_url` |
+| `--sandbox docker\|microsandbox\|e2b\|none` | `microsandbox` (`none` with `--web-only`) | [Sandbox backend](#sandbox-backend) to start with. A one-time choice saved in the database; change it later in Web |
+| `--accept-docker-risks` | | With `--sandbox docker`: accept Docker's [weaker isolation](#sandbox-backend) without the prompt; required without a terminal |
+| `--e2b-api-key-file FILE` | | With `--sandbox e2b`: absolute path of a private file (no group or other access, at most 4 KiB) holding the E2B API key |
+| `--e2b-template ID:BUILD` | | With `--sandbox e2b`: the ready template build, `template-id:build-uuid` |
+| `--core-only` | | [Mode](#modes): Core and PostgreSQL, without Web |
+| `--web-only` | | [Mode](#modes): Web only, connected to an existing Core. Needs `--core-url` and `--core-key-file` |
+| `--core-url URL` | | With `--web-only`: origin of the existing Core, HTTPS or loopback HTTP. Seeds `web.core_url` |
+| `--core-key-file FILE` | | With `--web-only`: absolute path of a private file holding that Core's Core key (at least 32 characters) |
+| `--native-core` | off | Run [Core as a systemd user service](#native-core) instead of a container |
+| `--core-port PORT` | `8091` | Loopback port of Core. Seeds `ports.core` |
+| `--web-port PORT` | `8080` | Loopback port of Web. Seeds `ports.web` |
+| `--install-dir DIR` | `~/.oac/core` | Absolute installation directory. It must be empty or missing |
+| `--config FILE` | | Seed `config.json` from a prepared file instead of the setting flags above (`--public-url`, the mode flags, `--native-core`, ports, `--core-url`) |
+| `--convert`, `--yes` | | [Convert an installation](/troubleshooting#convert-an-earlier-installation) made before the OpenAgentCore rename; `--yes` skips the confirmation |
+
+#### Sandbox backend
+
+A deployment runs its sandboxes on exactly one backend:
+
+| `--sandbox` | Sandboxes run on | You then |
+| --- | --- | --- |
+| `microsandbox` (default) | microVMs on your nodes (KVM), 2 CPUs, 4 GiB memory and two 8 GiB disks each | [Add nodes](/hosted-providers) in Web |
+| `docker` | Docker on your nodes, 2 CPUs and 2 GiB each; weaker isolation, confirmed at install | [Add nodes](/hosted-providers) in Web |
+| `e2b` | E2B's cloud, with the CPU and memory of your template build | Nothing: E2B needs no nodes |
+| `none` | Nothing yet | Choose the backend on the **Nodes** page in Web |
+
+The Standard sizes come from the bundle's copy of Web's
+[`standard-sizes.json`](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/apps/web/src/features/sandbox/standard-sizes.json). The
+installer saves the choice through the same administrator API that Web uses once the
+services are healthy. If Core refuses it, for example because E2B rejects the key,
+the installer prints Core's message and exits with an error; the services keep
+running, and you choose the backend on the Nodes page.
+
+`--sandbox docker` first prints Docker's drawbacks. Containers share the host kernel,
+so a container escape reaches the node host, while microsandbox runs each sandbox in
+its own microVM. The node service account in the `docker` group is root-equivalent
+on each node host. Choose Docker only for trusted workloads or hosts without KVM.
+The installer then asks for confirmation, defaulting to No; without a terminal, pass
+`--accept-docker-risks`. Unconfirmed, it exits with an error before it installs
+anything.
+
+E2B also needs an HTTPS public URL that is not loopback, because E2B's sandboxes
+call Core from E2B's cloud. The installer refuses `--sandbox e2b` without one, before
+it installs anything:
+
+```sh
+./install.sh --public-url https://core.example --sandbox e2b \
+ --e2b-api-key-file "$HOME/.oac/e2b-api-key" --e2b-template ':'
+```
+
+Prepare the template build with the
+[E2B guide](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/deploy/e2b/README.md). To change the backend or
+the sandbox size later, use the Nodes page in Web; see
+[Nodes](/hosted-providers#change-the-sandbox-backend-or-size).
+
+#### Modes
+
+| Mode | Runs | Use it for |
+| --- | --- | --- |
+| all (default) | PostgreSQL, Core and Web | Most installations |
+| `--core-only` | PostgreSQL and Core | A Core whose Web runs on another host, or scripts only. Without Web there is no Add node command |
+| `--web-only` | Web | A second host for the console, paired with an existing Core |
+
+A Web-only console forwards every signed-in `/core/v1` request to its Core with the
+Core key, so `--core-url` must reach Core's `/core/v1` directly. The default reverse
+proxy sends `/core/v1` to Web, so the Core's public URL doesn't work here:
+
+- **Web on the Core host:** use Core's loopback port,
+ `--core-url http://127.0.0.1:8091`.
+- **Web on another host:** give Core a second HTTPS name whose proxy sends every path to
+ Core, such as `https://core-api.example` to `127.0.0.1:8091` on the Core host, and use
+ it as `--core-url`. Allow only the Web host's address on that name; anyone else who
+ reaches it still needs the Core key.
+
+##### Split deployment
+
+| Host | Install | Reverse proxy |
+| --- | --- | --- |
+| Core | `./install.sh --core-only --public-url https://core.example` | `core.example`: `/v1`, `/v1/*` and `/api/v1/*` to Core; `/node-install/*` to the Web host, with Host rewritten to `console.example`; nothing else. `core-api.example`: every path to Core, for the Web host's address only |
+| Web | `./install.sh --web-only …`, below | `console.example`: every path to Web |
+
+```sh
+./install.sh --web-only --install-dir "$HOME/.oac/web" \
+ --public-url https://console.example \
+ --core-url https://core-api.example \
+ --core-key-file "$HOME/core.key"
+```
+
+Browsers use `console.example`, and nodes download their installer from it.
+Applications, nodes and sandboxes call Core at `core.example`, and self-hosted
+executors download their installer from there too, which is why `core.example` sends
+`/node-install/*` to the Web host. Web serves those files only for its own name, so the
+proxy rewrites Host. The Web host serves every node and executor file, so install it
+from the offline bundle (or add `artifacts/`) when the deployment has nodes or
+self-hosted executors.
+
+Caddy on the Core host, where `203.0.113.10` stands for the Web host's address:
+
+```text
+core.example {
+ @core path /v1 /v1/* /api/v1/*
+ handle @core {
+ reverse_proxy 127.0.0.1:8091
+ }
+ handle /node-install/* {
+ reverse_proxy https://console.example {
+ header_up Host console.example
+ }
+ }
+ handle {
+ respond 404
+ }
+}
+
+core-api.example {
+ @web remote_ip 203.0.113.10
+ handle @web {
+ reverse_proxy 127.0.0.1:8091
+ }
+ handle {
+ respond 403
+ }
+}
+```
+
+nginx on the Core host, with the `map` from the
+[main example](#https-and-the-reverse-proxy):
+
+```nginx
+server {
+ listen 443 ssl;
+ server_name core.example;
+ ssl_certificate /etc/letsencrypt/live/core.example/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/core.example/privkey.pem;
+
+ client_max_body_size 0;
+ proxy_http_version 1.1;
+ proxy_set_header Host $http_host;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection $connection_upgrade;
+ proxy_buffering off;
+ proxy_request_buffering off;
+ proxy_read_timeout 1h;
+ proxy_send_timeout 1h;
+
+ location = /v1 { proxy_pass http://127.0.0.1:8091; }
+ location /v1/ { proxy_pass http://127.0.0.1:8091; }
+ location /api/v1/ { proxy_pass http://127.0.0.1:8091; }
+ location /node-install/ {
+ proxy_pass https://console.example;
+ proxy_set_header Host console.example; # Web serves node files only for its own name
+ proxy_ssl_server_name on;
+ proxy_ssl_name console.example;
+ proxy_ssl_verify on;
+ proxy_ssl_verify_depth 2;
+ proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+ }
+ location / { return 404; }
+}
+
+server {
+ listen 443 ssl;
+ server_name core-api.example;
+ ssl_certificate /etc/letsencrypt/live/core-api.example/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/core-api.example/privkey.pem;
+
+ allow 203.0.113.10; # the Web host
+ deny all;
+ client_max_body_size 0;
+ proxy_http_version 1.1;
+ proxy_buffering off;
+ proxy_read_timeout 1h;
+ location / { proxy_pass http://127.0.0.1:8091; }
+}
+```
+
+The Web host's proxy sends every path to Web, for example
+`console.example { reverse_proxy 127.0.0.1:8080 }` in Caddy.
+
+Copy the key file from the Core host's `secrets/core.key` with mode `0600`; the
+installer keeps its own copy in `secrets/core.key`, so delete `$HOME/core.key`
+afterwards. After the Core key is rotated, copy the new key again; see
+[Rotate the Core key](/troubleshooting#rotate-the-core-key). A Web-only install selects no
+sandbox backend: the Core host's `--sandbox` does, or later the paired console's
+**Nodes** page.
+
+The mode and native Core are fixed once installed. To change them, install into a
+new directory.
+
+#### Native Core
+
+`--native-core` runs Core as a systemd user service of the installing user;
+PostgreSQL and Web stay in containers. It needs a running systemd user manager and
+lingering for that user (`sudo loginctl enable-linger "$USER"`), and the bundle's
+native binaries must load on the host. PostgreSQL then listens on a loopback port
+the installer picks (`ports.database`), and Web uses the host network. Native Core
+needs no KVM and is unrelated to the sandbox backend.
+
+#### Ports and directory
+
+Core and Web listen on `127.0.0.1` only; the reverse proxy reaches them there. The
+installer refuses a port that is in use. Several installations can share a host with
+their own `--install-dir` and ports, for example
+`--install-dir "$HOME/.oac/core-2" --core-port 8092 --web-port 8081`. Each has its
+own database, Core key and nodes.
+
+## HTTPS and the reverse proxy
+
+By default, Core and Web share one public origin; for Web on its own host, see the
+[split deployment](#split-deployment). Your reverse proxy terminates TLS and routes by
+path:
+
+| Path | Goes to | Callers |
+| --- | --- | --- |
+| `/v1`, `/v1/*` | Core, `127.0.0.1:8091` | Applications, with a Project API key |
+| `/api/v1/*` | Core, `127.0.0.1:8091` | Nodes, sandboxes and self-hosted executors, with their own machine credentials. Uses WebSockets |
+| Everything else | Web, `127.0.0.1:8080` | Browsers: the console, its sign-in and `/core/v1/*`. Node and executor hosts download their installers from `/node-install/*` |
+
+The proxy must:
+
+- **Preserve Host.** Web accepts only requests for the host of its public URL.
+- **Pass WebSocket upgrades** on `/api/v1`. Nodes and Runtime daemons hold long-lived
+ WebSocket connections.
+- **Not buffer or time out streams.** `/v1` streams Session events (server-sent events).
+- **Accept large uploads.** Core enforces its own limits; source files may reach
+ 512 MiB.
+
+Web answers 404 on `/v1` and `/api/v1` and never forwards them. If those paths reach
+Web, application calls, node enrollment and every sandbox connection fail. Run the
+proxy on the Core host, since Core and Web listen on loopback. `oac status` prints
+the routes with this installation's ports.
+
+**Caddy** (obtains and renews the certificate itself; passes Host and WebSockets by
+default):
+
+```text
+core.example {
+ @core path /v1 /v1/* /api/v1/*
+ handle @core {
+ reverse_proxy 127.0.0.1:8091
+ }
+ handle {
+ reverse_proxy 127.0.0.1:8080
+ }
+}
+```
+
+**nginx** (for example `/etc/nginx/conf.d/oac.conf`, inside the `http` block;
+use your certificate paths):
+
+```nginx
+map $http_upgrade $connection_upgrade {
+ default upgrade;
+ '' close;
+}
+
+server {
+ listen 80;
+ server_name core.example;
+ return 301 https://$host$request_uri;
+}
+
+server {
+ listen 443 ssl;
+ server_name core.example;
+ ssl_certificate /etc/letsencrypt/live/core.example/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/core.example/privkey.pem;
+
+ client_max_body_size 0; # Core enforces its own upload limits
+ proxy_http_version 1.1;
+ proxy_set_header Host $http_host;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection $connection_upgrade;
+ proxy_buffering off; # server-sent events on /v1
+ proxy_request_buffering off;
+ proxy_read_timeout 1h; # long-lived WebSockets and streams
+ proxy_send_timeout 1h;
+
+ location = /v1 { proxy_pass http://127.0.0.1:8091; }
+ location /v1/ { proxy_pass http://127.0.0.1:8091; }
+ location /api/v1/ { proxy_pass http://127.0.0.1:8091; }
+ location / { proxy_pass http://127.0.0.1:8080; }
+}
+```
+
+Replace `core.example` and, if you changed them, the ports. To check the routing:
+
+```sh
+curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
+```
+
+`401` means `/v1` reached Core, which asks for a key; `404` means it reached Web.
+
+Install with `--public-url https://core.example`, or, for an existing installation,
+set `public_url` in `~/.oac/core/config.json` and run `~/.oac/core/oac apply`.
+Core derives every address it hands out from this one setting. If you change it while
+nodes, sandboxes or self-hosted executors use the old address, `oac apply` lists
+them and asks you to confirm; those nodes must then be added again. See
+[Changing the public URL](/configure#changing-the-public-url).
+
+TLS verification stays on everywhere. With a private certificate authority, node
+hosts, executor hosts and the Runtime image must trust it.
+
+## Try it locally with a quick tunnel
+
+For a trial without DNS or certificates, a
+[Cloudflare quick tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/)
+gives the installation a temporary public HTTPS address. It forwards to one local
+port, so put a plain-HTTP proxy with the same three routes in front, for example this
+Caddyfile on `127.0.0.1:8443`:
+
+```text
+http://:8443 {
+ bind 127.0.0.1
+ @core path /v1 /v1/* /api/v1/*
+ handle @core {
+ reverse_proxy 127.0.0.1:8091
+ }
+ handle {
+ reverse_proxy 127.0.0.1:8080
+ }
+}
+```
+
+1. Install, with or without a public URL (`./install.sh`).
+2. Start the local proxy: `caddy run --config Caddyfile`.
+3. Start the tunnel: `cloudflared tunnel --url http://127.0.0.1:8443`. It prints an
+ address such as `https://random-words.trycloudflare.com`.
+4. Set `"public_url": "https://random-words.trycloudflare.com"` in
+ `~/.oac/core/config.json` and run `~/.oac/core/oac apply`.
+5. Open that address and [sign in](#sign-in-to-web).
+
+A quick tunnel is for trials only. Its address changes whenever `cloudflared`
+restarts; nodes and executors bound to the old address must then be added again.
+Its throughput is low, so the first node download of the Runtime (about 500 MB) can
+be slow; see [slow links](/hosted-providers#rerun-expiry-and-slow-links). Nodes and E2B need a
+reachable HTTPS address, so a loopback-only installation can't have nodes: Web says so
+at Add node.
+
+## Sign in to Web
+
+1. Open the console address the installer printed: your public URL, or
+ `http://127.0.0.1:8080` on the Core host. Use exactly that address; Web refuses
+ other host names. For a loopback installation on a remote machine, forward the port
+ first: `ssh -L 8080:127.0.0.1:8080 `.
+2. Sign in with the Core key:
+
+ ```sh
+ cat ~/.oac/core/secrets/core.key
+ ```
+
+ The Core key is the installation's administrator credential. Keep it private; see
+ [Core key](/troubleshooting#core-key). Web has no user accounts.
+3. **Set a default model.** Open **System** and find **Default model**. On the harness
+ card marked **Default** (Codex unless you changed `core.default_harness`), choose
+ **Set**; once a provider is configured, the button reads **Replace**. Enter the
+ model provider's base URL and API key; MiniMax Code also needs the context window
+ and max output tokens. Core encrypts the key and never shows it again. The default
+ applies to Core-hosted Sessions and Sessions without an environment when the request
+ and the Agent carry no model provider; self-hosted Sessions never use it. See
+ [model providers](/quickstart#model-providers).
+4. **Create a project and issue a key.** Open **Projects and keys**, choose
+ **Create project** and give it a **Name**, then **Issue key** in it with a
+ **Key name**. The **Key issued** dialog shows the key once: choose **Copy key**, keep
+ it somewhere safe, then **I've saved this key**. Core keeps only a digest. The
+ dialog's **How to call** card shows the API base URL and sample requests.
+5. Give the application developer the key, the API base URL and the model ID to use
+ with the default model provider (Sessions must name `agent.model`). They follow the
+ [API quickstart](/quickstart).
+
+**Overview** tracks the setup in a **Getting started** checklist, in any order:
+**Get sandboxes ready** ([add a node](/hosted-providers)), **Set a default model**,
+**Create a project and issue a key**, and **Run the first Session**. After you hide it,
+**Show Getting started** in the sidebar brings it back.
+
+An existing pre-rename installation at `~/.parsar/core` blocks a new default install.
+Use `./install.sh --convert` after draining it with the old release, or explicitly
+choose another `--install-dir`. See [conversion and retained backups](/troubleshooting#convert-an-earlier-installation).
+
+## What the installer creates
+
+The installation directory, `~/.oac/core` by default, mode `0700`:
+
+| Path | Content |
+| --- | --- |
+| `config.json` | Process settings. The only file you edit; see the [configuration reference](/configure) |
+| `oac` | The [management command](/troubleshooting#the-oac-command) |
+| `secrets/core.key` | The Core key |
+| `secrets/credential.key` | Encryption key for credentials stored in the database. Back it up with the database; never replace it |
+| `secrets/database.password` | PostgreSQL password |
+| `state.json` | Format 2, installation ID, Compose project name, image IDs and source commit. Written by the tools only |
+| `generated/` | Files derived from `config.json`: `compose.json`, `core.env`, `core-key-digests.json`, `settings.json`, `config.schema.json`, and `runtime-history.json` or the native Core unit when used. `oac apply` rewrites them; don't edit them |
+| `node-payload/` | The node and self-hosted installers, the manifest and the node files that Web serves at `/node-install/` |
+| `state/e2b/` | Private E2B receipts |
+| `native/` | Core binaries, with `--native-core` only |
+
+Web-only installations have only `secrets/core.key` among the secrets, and no
+`state/e2b/`; Core-only installations have no `node-payload/`.
+
+In Docker, the installer creates a Compose project named `oac-<10 hex digits>`
+(`project` in `state.json`) with the containers `database`, `migrate` (runs the
+migrations, then exits), `core` and `web`, and the volume `_database` that
+holds all data. Core and Web publish only `127.0.0.1:8091` and `127.0.0.1:8080`. The
+database publishes no port unless Core is native.
+
+The database holds the sandbox backend selection, and later your Projects, keys,
+nodes, default models and all execution history. Apart from Docker's own storage,
+nothing is written outside your home directory: no system service and no file under
+`/etc`. Native Core adds a systemd user unit, enabled from `generated/`.
+
+## Rerun the installer
+
+Rerunning `./install.sh` from the same bundle repairs an installation: it reloads
+missing images, restores a missing `oac` command, copies node files newly placed in
+`artifacts/`, applies `config.json` and starts the services. It accepts only
+`--install-dir`. It refuses a bundle from another release; see
+[Upgrades](/troubleshooting#upgrade-an-installation).
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/getting-started/install.md)
diff --git a/apps/docs/content/docs/install.zh.mdx b/apps/docs/content/docs/install.zh.mdx
new file mode 100644
index 000000000..c8cc6d490
--- /dev/null
+++ b/apps/docs/content/docs/install.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Install Core and Web · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+安装器默认在 ~/.oac/core 安装 Core、Web 和专用 PostgreSQL，初始没有执行节点。先确定公网 HTTPS 地址，按当前版本的校验步骤下载并安装，再用 Core key 登录 Web。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/install)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/meta.json b/apps/docs/content/docs/meta.json
new file mode 100644
index 000000000..73b131510
--- /dev/null
+++ b/apps/docs/content/docs/meta.json
@@ -0,0 +1,27 @@
+{
+ "title": "OpenAgentCore documentation",
+ "pages": [
+ "---Start here---",
+ "index",
+ "concepts",
+ "execution-model",
+ "install",
+ "configure",
+ "---Application access---",
+ "bootstrap-projects-keys",
+ "quickstart",
+ "public-api",
+ "agents-and-tools",
+ "sessions",
+ "---Execution---",
+ "environments-and-files",
+ "hosted-providers",
+ "self-hosted-execution",
+ "---Administration---",
+ "console",
+ "admin-api",
+ "observability",
+ "troubleshooting",
+ "api-reference"
+ ]
+}
diff --git a/apps/docs/content/docs/meta.zh.json b/apps/docs/content/docs/meta.zh.json
new file mode 100644
index 000000000..e1c42ae20
--- /dev/null
+++ b/apps/docs/content/docs/meta.zh.json
@@ -0,0 +1,27 @@
+{
+ "title": "OpenAgentCore 文档",
+ "pages": [
+ "---从这里开始---",
+ "index",
+ "concepts",
+ "execution-model",
+ "install",
+ "configure",
+ "---应用接入---",
+ "bootstrap-projects-keys",
+ "quickstart",
+ "public-api",
+ "agents-and-tools",
+ "sessions",
+ "---执行环境---",
+ "environments-and-files",
+ "hosted-providers",
+ "self-hosted-execution",
+ "---管理---",
+ "console",
+ "admin-api",
+ "observability",
+ "troubleshooting",
+ "api-reference"
+ ]
+}
diff --git a/apps/docs/content/docs/observability.mdx b/apps/docs/content/docs/observability.mdx
new file mode 100644
index 000000000..91d7f2d57
--- /dev/null
+++ b/apps/docs/content/docs/observability.mdx
@@ -0,0 +1,282 @@
+---
+title: "Runtime observations"
+description: "Current Runtime observations, recorded history and their availability limits."
+---
+
+Status: Phase 2 and initial Core Web consumption implemented. The current-snapshot routes, strict
+`packages/agents-client` projection, and generated `core.openapi.yaml` contract are
+implemented and consumed by the Dashboard through complete Session/observation
+identity joins. Durable history uses the separate optional
+[Runtime history API](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime-history-api.md); lifecycle controls remain outside
+this phase.
+
+These are administrator reads under `/core/v1`, authenticated by the Core key,
+not upstream OpenAI Agents resources. The
+former project routes `GET /v1/agents/runtime-observations` and
+`GET /v1/agents/sessions/{session_id}/runtime-observation` are removed.
+
+## Routes
+
+### List current Runtime observations
+
+```http
+GET /core/v1/sandbox/runtime-observations?after={session_id}&limit=20&order=desc
+Authorization: Bearer ...
+```
+
+| Field | Rules |
+| --- | --- |
+| `after` | Observation ID from the previous page. Optional, supplied once. |
+| `limit` | Integer 1–100, default 20. |
+| `order` | `asc` or `desc`, default `desc`. |
+
+The list contains one current Runtime context for every Session of every managed
+Project, labelled with its owning `project_id`, including explicit `none`,
+unsupported `self_hosted`, and released managed contexts. Ordering uses the same Session creation-time and ID
+keyset as the Session list. An observation ID is the Session UUID, so pagination
+does not change when the underlying Runtime incarnation changes. Pages are not an
+atomic telemetry snapshot; every row has its own `resolved_at`, and a successful
+provider sample has its own `observed_at`. A client completes the entire page chain
+before publishing a new Dashboard snapshot.
+
+```json
+{
+ "object": "list",
+ "data": [
+ {
+ "project_id": "3f0c2a9e-2b7d-4d0f-9a51-1c8e4b6d7a20",
+ "observation": {
+ "id": "6c77d3a2-71d6-4ed5-884f-687aecda02a3",
+ "object": "agent.runtime_observation",
+ "session_id": "6c77d3a2-71d6-4ed5-884f-687aecda02a3",
+ "environment_id": "6c02fb71-5fa8-4298-93e8-57c6625a3fc2",
+ "mode": "openai_hosted",
+ "provider_type": "docker",
+ "instance": {
+ "kind": "managed_allocation",
+ "allocation_id": "d23ab94e-e40b-45bd-93a2-444f1f74642b",
+ "device_id": "2e434f4f-76aa-4e54-a707-4757036d90ef",
+ "connection_generation": null
+ },
+ "status": "observed",
+ "reason": null,
+ "allocation_created_at": 1789951200,
+ "resolved_at": 1789953021,
+ "observed_at": 1789953020,
+ "started_at": 1789951220,
+ "cpu": {
+ "usage_seconds_total": 482.75,
+ "capacity_cores": 2.0,
+ "usage_cores": null,
+ "utilization_ratio": null
+ },
+ "memory": {
+ "usage_bytes": 805306368,
+ "limit_bytes": 2147483648
+ },
+ "disk": null
+ }
+ }
+ ],
+ "has_more": false,
+ "first_id": "6c77d3a2-71d6-4ed5-884f-687aecda02a3",
+ "last_id": "6c77d3a2-71d6-4ed5-884f-687aecda02a3"
+}
+```
+
+### Retrieve one Session's current Runtime observation
+
+```http
+GET /core/v1/projects/{project_id}/sessions/{session_id}/runtime-observation
+Authorization: Bearer ...
+```
+
+This returns the same object shape as a list item's `observation`, without the
+administrator list's `disk` (see the [administrator contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md)). It never starts a Turn, creates
+an Environment, provisions compute, renews a lease, or changes lifecycle state.
+
+A valid `environment:none` Session returns `200` with status `unsupported`; the
+Session exists but has no attributable Runtime instance. A missing Session, or one
+outside the Project, returns the existing indistinguishable not-found error.
+
+## Resource schema
+
+### `RuntimeObservation`
+
+| Field | Type | Required | Semantics |
+| --- | --- | --- | --- |
+| `id` | string | yes | Session UUID; stable identity of this current-observation resource and its list cursor. |
+| `object` | literal | yes | `agent.runtime_observation`. |
+| `session_id` | string | yes | Authorized Core Session. |
+| `environment_id` | string or null | yes | Null only for mode `none`. |
+| `mode` | enum | yes | `none`, `self_hosted`, `openai_hosted`. |
+| `provider_type` | string or null | yes | Forward-compatible safe source kind such as `docker` or `microsandbox`; null when no provider applies. Clients must not treat an unknown nonempty value as an error. |
+| `instance` | object | yes | Provider-neutral current incarnation identity; explicit `kind=none` when no compute applies. |
+| `status` | enum | yes | `observed`, `unsupported`, `unavailable`. |
+| `reason` | enum or null | yes | Safe reason when status is not `observed`. |
+| `allocation_created_at` | integer or null | yes | Unix seconds for managed allocation age. |
+| `resolved_at` | integer | yes | Unix seconds when Core resolved identity and status for this row. |
+| `observed_at` | integer or null | yes | Provider sample time; null without a sample. |
+| `started_at` | integer or null | yes | Current compute incarnation start time. |
+| `cpu` | object or null | yes | Null when no CPU fields were observed. |
+| `memory` | object or null | yes | Null when no memory fields were observed. |
+
+### `RuntimeInstance`
+
+```json
+{
+ "kind": "managed_allocation",
+ "allocation_id": "alloc_...",
+ "device_id": "device_...",
+ "connection_generation": null
+}
+```
+
+`kind` is `managed_allocation`, `self_hosted_connection`, or `none`. For a managed
+context, `allocation_id` is the incarnation key; for self-hosted, the current
+`connection_generation` is the incarnation key. Fields that do not apply are
+explicit nulls. Provider-native container IDs, pod names, host paths, credentials,
+and raw labels are not public fields.
+
+### `RuntimeCPUObservation`
+
+```json
+{
+ "usage_seconds_total": 482.75,
+ "capacity_cores": 2.0,
+ "usage_cores": 1.42,
+ "utilization_ratio": 0.71
+}
+```
+
+All fields are `number | null`. Values are finite and nonnegative;
+`capacity_cores`, when present, is greater than zero. Numeric zero is observed
+zero. Null is unavailable. `usage_cores` is the cumulative CPU delta divided by
+the observation-time delta for two ordered samples of the same incarnation.
+`utilization_ratio` is `usage_cores / capacity_cores`. It is not clamped: a value
+above 1 is retained as provider/accounting evidence and is not interpreted as a
+lifecycle signal. Both derived fields are null after a cache restart or whenever
+either source sample is absent or invalid. The API never derives CPU rate from a
+single sample of cumulative time. A provider that reports only a current share
+of its CPU capacity (E2B) fills `utilization_ratio` with that report and leaves
+`usage_seconds_total` and `usage_cores` null.
+
+### `RuntimeMemoryObservation`
+
+```json
+{
+ "usage_bytes": 805306368,
+ "limit_bytes": 2147483648
+}
+```
+
+Both fields are `integer | null`. Values are nonnegative and safe JSON integers.
+Zero usage is observed zero. A missing or unlimited provider limit is null.
+
+## Status and reason matrix
+
+| Status | Allowed reason |
+| --- | --- |
+| `observed` | null |
+| `unsupported` | `runtime_mode_not_observable` |
+| `unavailable` | `allocation_pending`, `runtime_not_running`, `source_not_configured`, `sample_timeout`, `sample_unavailable` |
+
+Ownership mismatch, malformed durable identity, corrupt provider evidence, and
+authorization failure are not downgraded to unavailable rows.
+
+## Error responses
+
+Use the existing Agents API error envelope.
+
+| HTTP | Type / code | When |
+| --- | --- | --- |
+| 400 | `invalid_request_error` / `invalid_request_error` | List: a repeated supported query key, or an empty or invalid limit or order, with the shared Beta list messages. Unknown list query keys are ignored. |
+| 400 | `invalid_request_error` / `unsupported_parameter` | Single-Session retrieval with any query parameter. |
+| 401 | `invalid_request_error` / `invalid_admin_key` | Missing or invalid Core key. |
+| 404 | `not_found_error` / `not_found_error` | Missing, malformed or foreign Session/cursor, indistinguishably, as for the [Session list cursor](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/list-query-semantics.md#list-cursor-errors--september-23-2026). |
+| 500 | `server_error` / `internal_error` | Integrity, ownership, or invalid provider evidence. |
+| 503 | `server_error` / `execution_unavailable` | Required Runtime observation service is not configured, or list collection exceeded its request budget. |
+
+Errors never include provider raw responses or credentials.
+
+## Freshness and caching
+
+- Return `Cache-Control: no-store`.
+- The Phase 2 implementation performs bounded direct reads and has no observation
+ cache. A later internal cache may coalesce reads for at most five seconds.
+- `observed_at` is authoritative for freshness; HTTP response time is not.
+- Clients mark samples stale according to their own explicit threshold.
+- `ETag` is not proposed because observations change independently.
+
+## Client contract
+
+`packages/agents-client` exposes:
+
+```ts
+type RuntimeObservationStatus = "observed" | "unsupported" | "unavailable";
+type RuntimeObservationReason =
+ | "runtime_mode_not_observable"
+ | "allocation_pending"
+ | "runtime_not_running"
+ | "source_not_configured"
+ | "sample_timeout"
+ | "sample_unavailable";
+
+type RuntimeObservation =
+ | RuntimeObservedObservation
+ | RuntimeUnavailableObservation
+ | RuntimeNoneObservation
+ | RuntimeSelfHostedObservation;
+
+interface AdminRuntimeObservation {
+ project_id: string;
+ observation: RuntimeObservation & { disk: RuntimeDiskObservation | null };
+}
+
+class AdminClient {
+ listRuntimeObservations(options?: {
+ after?: string;
+ limit?: number;
+ order?: "asc" | "desc";
+ }): Promise>;
+
+ retrieveRuntimeObservation(projectId: string, sessionId: string): Promise;
+}
+```
+
+These exported variants discriminate on `status` and `mode`; their instance,
+reason, timestamps, CPU, and memory fields narrow accordingly. The exact variant
+definitions live in `packages/agents-client/src/types.ts` and mirror the status
+and reason matrix above.
+
+The client validates every required field, enum, nullability rule, timestamp, and
+finite number. The current pinned contract rejects unknown additive fields so an
+unreviewed server expansion cannot silently cross the browser boundary. Malformed
+data rejects the whole page; Web does not publish a partial snapshot.
+
+The generated OpenAPI 2 schema records field-level required/nullability rules,
+UUID formats, reason enums, and numeric minima. OpenAPI 2
+cannot encode the complete cross-field discriminated union. The matrix above is
+normative for wire consumers; the server projection and strict TypeScript
+projector enforce it, and the exported TypeScript type prevents invalid
+status/mode combinations in typed consumers.
+
+Web also applies a configured whole-refresh budget. If `has_more` remains true
+when that budget is exhausted, it retains the prior complete snapshot and marks
+the refresh incomplete; it does not publish partial values as global totals.
+After both Runtime-observation and Session traversals complete, Web also requires
+their Session ID sets to be identical. A mismatch caused by concurrent creation or
+deletion makes the candidate incomplete and prevents publication.
+
+## Deliberately excluded
+
+- Token usage: use existing Session/Turn Usage.
+- Billing and cost: product/backend concern.
+- Historical series in these routes: the optional capability uses the separate
+ [Runtime history API](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime-history-api.md).
+- Container logs and command output.
+- Provider credentials or native configuration.
+- Start, stop, pause, resume, restart, renew, or delete operations.
+- Idle classification and automatic shutdown.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime-observability-api.md)
diff --git a/apps/docs/content/docs/observability.zh.mdx b/apps/docs/content/docs/observability.zh.mdx
new file mode 100644
index 000000000..981a98f6c
--- /dev/null
+++ b/apps/docs/content/docs/observability.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Runtime observations · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+当前 Runtime 观测与已保存历史是不同的数据。离线或陈旧数据不代表当前健康状态；查看来源、时间和可用性，执行事实仍以 Core 为准。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/observability)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/public-api.mdx b/apps/docs/content/docs/public-api.mdx
new file mode 100644
index 000000000..13cec4d9c
--- /dev/null
+++ b/apps/docs/content/docs/public-api.mdx
@@ -0,0 +1,105 @@
+---
+title: "API namespaces and credentials"
+description: "The public application API, private administration API and machine connection interface."
+---
+
+Core serves three namespaces. Each has one kind of caller and its own credential;
+no credential works in another namespace.
+
+| Namespace | Caller | Credential | Contents | Reference |
+| --- | --- | --- | --- | --- |
+| `/v1` | Applications (business systems, SDKs) | Project API key | Exactly the pinned official Agents API routes. Core-only fields live only in `x_agents_core` (`harness`, `model_provider`) | [Public API](/sessions) |
+| `/core/v1` | Core Web's server and operator scripts | [Core key](/troubleshooting#core-key) | Installation facts, Projects and keys, resource reads and deletion, Session archive, credential issuance, metrics, audit, sandbox deployment and nodes, deployment model providers | [Core API](#core-api), [Web API](/admin-api), [Core OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core.openapi.yaml) |
+| `/api/v1` | Nodes, Runtime daemons, self-hosted executors | Machine credentials: node enrollment tokens and executor credentials issued through `/core/v1`, node credentials registered with an enrollment token, and daemon credentials Core writes into hosted sandboxes | Machine connections only: `/api/v1/sandbox-node/*` and `/api/v1/agent-daemon/*`, including WebSockets; each credential works only on its own routes | [Node operations](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#register-a-host), [executor credentials](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-executor-credentials.md), [machine OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime.openapi.yaml) |
+
+A Project API key gets 401 on `/core/v1` and `/api/v1`; the Core key gets 401 on
+`/v1` and `/api/v1`. Projects own assets. Multiple equally privileged keys share
+the Project's assets and execution principal; provenance retains the key that
+performed each write. Projects and application keys live in PostgreSQL, never
+deployment configuration.
+
+The browser talks only to Web's server: `/console/auth` and `/console/config`,
+`/node-install/*`, the static pages, and `/core/v1/*`, which the server forwards
+with the Core key after sign-in and same-origin checks. Users sign in to Web with
+the Core key and get an HttpOnly session cookie; the browser never receives the
+key. Core decides which `/core/v1` routes
+exist; Web returns 404 for `/v1` and `/api/v1`, whatever credential a request
+carries.
+
+The deployment's reverse proxy sends `/v1`, `/v1/*` and `/api/v1/*` to Core and
+every other path, including `/core/v1/*`, to Web. Operator scripts call `/core/v1`
+with the Core key on Core's loopback port, not through the public entry.
+
+## Public API
+
+Applications call every `/v1` route with a Project API key. The routes are exactly
+the 58 method and path pairs in
+[upstream-routes.json](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream-routes.json); the
+[Public API guide](/sessions) groups them by resource. `/v1` has no
+Core-only route.
+
+## Core API
+
+All routes are under `/core/v1`. Core Web's server and operator scripts call them
+with the Core key.
+
+| Routes | Contents | Contract |
+| --- | --- | --- |
+| `projects`, `projects/{project_id}[/archive]`, `projects/{project_id}/keys[/{key_id}]` | Projects and their API keys | [Administrator contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md) |
+| `projects/{project_id}/{agents,environment-templates,skills,files,vaults,sessions}/**` | Resource reads and deletion, Session history, artifacts and archive | [Administrator contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md) |
+| `projects/{project_id}/sessions/{session_id}/execution-configuration` | Committed harness and model selection | [Execution configuration](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/execution-configuration.md) |
+| `projects/{project_id}/sessions/{session_id}/runtime-observation`, `sandbox/runtime-observations` | Current Runtime observations | [Runtime observations](/observability) |
+| `projects/{project_id}/sessions/{session_id}/runtime-history` | Stored Runtime history | [Runtime history](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime-history-api.md) |
+| `projects/{project_id}/{resource-owners,write-operations}`, `audit-log`, `summary` | Provenance, write history, administrator audit and usage summary | [Write audit](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/write-audit.md), [administrator contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md) |
+| `projects/{project_id}/environments/{environment_id}/executor-credentials[/{key_id}]` | Executor credentials for a self-hosted Environment | [Executor credentials](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-executor-credentials.md) |
+| `installation` | Public URL, API base URL, source commit, the installer's process settings and what is bound to the public URL; available before any deployment | [Installation](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/installation.md) |
+| `metrics` | Core's own process metrics | [Core metrics](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core-metrics.md) |
+| `sandbox/deployment[/maintenance]`, `sandbox/enrollment-tokens`, `sandbox/nodes[/{node_id}[/allocations]]` | Sandbox deployment, node enrollment tokens and nodes | [Sandbox deployment](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/sandbox-deployment.md), [node operations](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md), [node host history](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/node-host-history.md) |
+| `harnesses`, `harnesses/{harness}/model-provider` | Supported harnesses and each harness's deployment default model provider (write-only key) | [Model execution](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/model-execution.md#deployment-defaults) |
+
+## Machine connection API
+
+These routes are under `/api/v1`. Each accepts only the credential listed, never
+the Core key or a Project API key.
+
+| Routes | Caller | Credential | Contract |
+| --- | --- | --- | --- |
+| `POST sandbox-node/enroll` | Node installer | One-use enrollment token from `POST /core/v1/sandbox/enrollment-tokens` | [Node operations](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#register-a-host), [machine OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime.openapi.yaml) |
+| `GET sandbox-node/configuration` | Node installer and node | Enrollment token, or node credential with `X-OAC-Node-ID` | [Sandbox deployment](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/sandbox-deployment.md), [machine OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime.openapi.yaml) |
+| `GET sandbox-node/identity`, WebSocket `GET sandbox-node/connect` | Node | Node credential registered at enrollment | [Node operations](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#register-a-host) |
+| `POST agent-daemon/enroll`, `GET agent-daemon/connection` | Self-hosted executor and its installer | Executor credential from `/core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials` | [Executor credentials](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-executor-credentials.md) |
+| WebSocket `GET agent-daemon/ws`, `POST agent-daemon/bootstrap`, `GET agent-daemon/device-status` | Runtime daemons | Daemon credential: Core writes one into each hosted sandbox it prepares; a self-hosted executor uses its executor credential | [Runtime enrollment](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/README.md#user-managed-runtime-enrollment) |
+
+## Contract sources
+
+- [Pinned upstream baseline](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream.json): OpenAI
+ Python SDK 3.13.0, exact upstream commit and `agents=v1`.
+- [Pinned routes](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream-routes.json) and
+ [fields](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream-fields.json): extracted from the
+ pinned SDK by `scripts/extract-agents-api-upstream.py`. Contract tests require the
+ public OpenAPI to have exactly these routes and to keep every other field inside
+ `x_agents_core`.
+- [Public OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/openapi.yaml): public schema snapshot;
+ combine it with the fixed SDK and [operation evidence](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/operation-evidence.md).
+- [Core OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core.openapi.yaml): generated `/core/v1`
+ routes, all authenticated by the Core key.
+- [Machine connection OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/runtime.openapi.yaml):
+ generated `/api/v1` sandbox node routes. The node WebSocket and the private
+ daemon transport are described in the node and Runtime credential guides.
+- [Administrator contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md): Project/key
+ lifecycle, resources, explicit hosted Session archive, summary,
+ errors/deletion preconditions, audit and historical copy provenance.
+- [Web integration](/admin-api): browser, console and Core boundaries and frontend handoff.
+- [Design rules](/concepts) and [contributor guide](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/CONTRIBUTING.md):
+ ownership, security and change requirements.
+
+Generated schemas do not establish complete compatibility or real execution
+support. The [coverage record](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md) identifies
+qualified workflows, native differences and unresolved behavior. Update the
+relevant contract and this index when adding or moving an API surface.
+
+Core administration failures use the [Core error envelope](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/core-errors.md),
+including typed optional safe details and distinct console proxy rejection codes.
+The public and machine error contracts remain unchanged.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/api/README.md)
diff --git a/apps/docs/content/docs/public-api.zh.mdx b/apps/docs/content/docs/public-api.zh.mdx
new file mode 100644
index 000000000..7d2fc3a97
--- /dev/null
+++ b/apps/docs/content/docs/public-api.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "API namespaces and credentials · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+/v1 使用 Project API key；/core/v1 使用 Core key，由 Web 服务端或管理员脚本调用；/api/v1 只接受对应的节点、注册、daemon 或 executor 凭据。这三类凭据不能互换。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/public-api)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/quickstart.mdx b/apps/docs/content/docs/quickstart.mdx
new file mode 100644
index 000000000..b6ebfacd8
--- /dev/null
+++ b/apps/docs/content/docs/quickstart.mdx
@@ -0,0 +1,149 @@
+---
+title: "Call the Agent API"
+description: "Use the pinned SDK, a Project API key and an explicit model provider to run a Session."
+---
+
+Core serves the OpenAI Agents API. Applications use the official OpenAI SDK with two
+environment variables, which the SDK reads by default:
+
+| Variable | Value | From |
+| --- | --- | --- |
+| `OPENAI_BASE_URL` | The installation's API base URL: its public URL followed by `/v1`, such as `https://core.example/v1` | The administrator; Web's **System** page shows it as **API base URL** |
+| `OPENAI_API_KEY` | A Project API key | The administrator issues it on **Projects and keys**; see [Sign in to Web](/install#sign-in-to-web) |
+
+The Project API key authenticates your application to this Core. It is separate from
+the model provider's key that a harness uses, and neither belongs in source control.
+The API base URL reaches Core directly; Web does not serve `/v1`.
+
+## First request
+
+Use the pinned client version:
+
+```sh
+python3 -m venv .venv
+. .venv/bin/activate
+pip install openai==3.13.0
+export OPENAI_BASE_URL=https://core.example/v1
+read -rs OPENAI_API_KEY && export OPENAI_API_KEY # paste the Project API key; it isn't echoed
+```
+
+```python
+from openai import OpenAI
+
+client = OpenAI() # reads OPENAI_BASE_URL and OPENAI_API_KEY
+print(client.beta.agents.list().data)
+```
+
+`read -rs` keeps the key out of your shell history. This read checks access; it runs no
+model and creates no sandbox. The same request with curl, which keeps the key off its
+command line:
+
+```sh
+curl "$OPENAI_BASE_URL/agents" -H "OpenAI-Beta: agents=v1" \
+ -H @<(printf 'Authorization: Bearer %s\n' "$OPENAI_API_KEY")
+```
+
+All keys of a Project share its assets and execution principal; other Projects are
+isolated. When the administrator rotates your key, they issue a new one in the same
+Project and revoke the old one; your assets stay.
+
+## Run a Session
+
+A Core-hosted Session (`openai_hosted`) runs in a sandbox that Core creates: on a node
+with free capacity, or on E2B. Core prepares the daemon, native harness and workspace
+inside it. The installation needs a ready node or an E2B backend; see
+[Nodes](/hosted-providers).
+
+```python
+import os
+
+session = client.beta.agents.sessions.create(
+ environment={"type": "openai_hosted"},
+ input="Create /workspace/hello.txt with a short greeting, then describe it.",
+ extra_body={
+ "agent": {
+ "model": os.environ["MODEL_NAME"],
+ "x_agents_core": {"harness": "codex"},
+ },
+ "x_agents_core": {
+ "model_provider": {
+ "protocol": "responses",
+ "base_url": os.environ["MODEL_BASE_URL"],
+ "api_key": os.environ["MODEL_API_KEY"],
+ }
+ },
+ },
+)
+print(session.id)
+```
+
+This makes a real model request and may incur charges. If the administrator set a
+default model for the harness, omit `x_agents_core.model_provider`; `agent.model` is
+still required, so ask the administrator which model ID the default provider serves.
+SDK 3.13.0 replaces an ordinary body field with the matching `extra_body` field
+instead of merging nested fields, so keep the whole `agent` object in `extra_body`.
+
+## Core extensions: x_agents_core
+
+`/v1` has exactly the official routes. Core's additions are fields inside
+`x_agents_core`, passed through `extra_body`; any other member is rejected with 400.
+
+| Field | Where | Meaning |
+| --- | --- | --- |
+| `x_agents_core.harness` | A saved Agent, or the Session's inline `agent` | Which native harness runs the Agent: `codex` (Codex), `claude_sdk` (Claude Code) or `mcode` (MiniMax Code). Omitted: the installation's default harness (`core.default_harness`, Codex unless changed) |
+| `x_agents_core.model_provider` | A saved Agent, or Session creation | The model provider bundle: `protocol`, HTTPS `base_url`, write-only `api_key`, and for `mcode` also `context_window` and `max_output_tokens`. Reads return `api_key_configured` instead of the key |
+
+The provider's protocol must match the harness:
+
+| Harness | `protocol` | Also required |
+| --- | --- | --- |
+| Codex (`codex`) | `responses` | The provider's exact model ID in `agent.model` |
+| Claude Code (`claude_sdk`) | `anthropic` | The provider's exact model ID |
+| MiniMax Code (`mcode`) | `anthropic` | `context_window` and `max_output_tokens` |
+
+See [harness selection](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/harness-selection.md) and
+[model execution](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/model-execution.md) for the full contract.
+Selecting a harness doesn't make an unsupported model or operation work.
+
+## Model providers
+
+A Session takes its model provider from the first of these that has one; bundles are
+never merged:
+
+1. `x_agents_core.model_provider` in the Session creation request;
+2. the saved Agent's `x_agents_core.model_provider`;
+3. the installation's default model for the harness, set in Web on **System**,
+ **Default model**.
+
+| Environment | Request or saved Agent | Default model | None of them |
+| --- | --- | --- | --- |
+| `openai_hosted` | Used | Used | 400 `model_provider_required` |
+| `self_hosted` | Used | Never | 400 `model_provider_required` |
+| `none` | Rejected with 400 `unsupported_or_invalid_configuration` | Used | Allowed: the device's own environment supplies the model |
+
+A Session freezes its provider when it is created; later changes to the Agent or the
+default affect only new Sessions. Core encrypts the key with the Session and never
+returns it. Self-hosted Sessions always bring their own provider, because the default
+holds the operator's key and the executor host belongs to the application; see
+[Self-hosted executors](/self-hosted-execution).
+
+## Observe and recover
+
+```python
+current = client.beta.agents.sessions.retrieve(session.id)
+turns = client.beta.agents.sessions.turns.list(session.id)
+items = client.beta.agents.sessions.items.list(session.id)
+print(current.id, turns.data, items.data)
+```
+
+Wait for the Turn's final state before treating a task as done. After a disconnect,
+recover through Session, Turn and Items reads: the event stream is live only and does
+not replay history. Don't submit the same work as a new Session when a response is
+lost.
+
+Files, Artifacts, cancellation and their current limits are in the
+[coverage ledger](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md). MCP credentials use the
+separate Vault API; they are neither Project API keys nor model provider keys. The
+[API index](/public-api) lists every route.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/getting-started/quickstart.md)
diff --git a/apps/docs/content/docs/quickstart.zh.mdx b/apps/docs/content/docs/quickstart.zh.mdx
new file mode 100644
index 000000000..e652c1784
--- /dev/null
+++ b/apps/docs/content/docs/quickstart.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Call the Agent API · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+应用设置 OPENAI_BASE_URL=https://core.example.com/v1 和 OPENAI_API_KEY=<project-api-key>，使用文档固定的 SDK 版本。先配置执行后端和模型，再创建 Session 并读取 Turn 结果。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/quickstart)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/self-hosted-execution.mdx b/apps/docs/content/docs/self-hosted-execution.mdx
new file mode 100644
index 000000000..3de987fef
--- /dev/null
+++ b/apps/docs/content/docs/self-hosted-execution.mdx
@@ -0,0 +1,169 @@
+---
+title: "Self-hosted executors"
+description: "Connect a user-owned Runtime to its Environment with a restricted executor credential."
+---
+
+A `self_hosted` Session runs on a machine the application owns, the executor host,
+instead of a node. The application creates the Session through `/v1`; the
+administrator issues an executor credential for it in Web; one command on the host
+starts a Runtime container that connects to Core. The Runtime is the same one nodes
+use: daemon, native harness and workspace.
+
+An executor credential works for one Session's environment only. It can't call the
+Agent API, the Core API or node enrollment.
+
+## Before you start
+
+- **Core has an HTTPS public URL.** The Session's `remote_url` is
+ `wss:///api/v1/agent-daemon/ws`, and the installer connects only over
+ `wss://`. Web shows no command until Core has a reachable public URL.
+- **Web holds the installer and the Runtime files.** The command downloads the
+ installer, the Runtime launcher and the image from Core's public URL, which the
+ reverse proxy sends to Web (in a [split deployment](/install#split-deployment), to
+ the Web host); install from the offline bundle. A console without the self-hosted
+ installer shows no **Connect a host** section at all.
+- **The host** runs Linux amd64 with Python 3.9+, `curl`, `sha256sum` and the Docker
+ CLI, with Docker usable through `/var/run/docker.sock` by the non-root user that runs
+ the installer; the installer refuses root. It reaches the public URL over HTTPS.
+- **The Session carries its model provider**, in the request or saved on its Agent.
+ Default models never apply to self-hosted Sessions, and creating one without a
+ provider fails with 400 `model_provider_required`.
+
+## Connect a host
+
+1. **The application creates the Session**, with its Project API key and its own model
+ provider:
+
+ ```python
+ import os
+ from openai import OpenAI
+
+ client = OpenAI() # reads OPENAI_BASE_URL and OPENAI_API_KEY
+ session = client.beta.agents.sessions.create(
+ environment={"type": "self_hosted", "workspace_directory": "/workspace"},
+ extra_body={
+ "agent": {"model": os.environ["MODEL_NAME"], "x_agents_core": {"harness": "codex"}},
+ "x_agents_core": {"model_provider": {
+ "protocol": "responses",
+ "base_url": os.environ["MODEL_BASE_URL"],
+ "api_key": os.environ["MODEL_API_KEY"],
+ }},
+ },
+ )
+ print(session.id, session.environment.id, session.environment.remote_url)
+ ```
+
+2. **In Web**, open **Session log**, then the Session's page. In its
+ **Executor credentials** section, **Connect a host** shows a command in a
+ **Terminal** block; copy it and run it on the executor host:
+
+ ```sh
+ (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT
+ curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/self-hosted-install.pyz' -o "$d/install.pyz" &&
+ printf '%s %s\n' '' "$d/install.pyz" | sha256sum -c --status &&
+ python3 "$d/install.pyz" --source-url 'https://core.example' --environment-id '' --remote 'wss://core.example/api/v1/agent-daemon/ws')
+ ```
+
+ The command contains no secret. It downloads the installer from your console and
+ checks its SHA-256 before running it.
+3. **Issue the credential.** Select **Issue credential**. The **Executor credential**
+ dialog shows it once: choose **Copy credential**.
+4. **Paste it at the installer's hidden prompt** and press Enter. The prompt accepts the
+ compact or the pretty-printed credential and never echoes it. Then choose **Done** in
+ the dialog; after that the credential can't be shown again. Closing the dialog with
+ × keeps the credential on the page until you choose **Done**.
+
+The installer downloads the Runtime from the console and checks it, starts a container
+named `oac-selfhost-<32 hex digits>`, and waits until Core confirms that the
+Environment is connected. The Session then runs its Turns there. Rerunning the same
+command resumes the same installation. It refuses, with "This installation belongs to
+another Environment or distribution", once Core runs another release or its public URL
+changed: the host's installation is tied to both. Moving an executor to a new release
+or address isn't supported yet. A fresh installation would start a new container
+without the old workspace and native history, so the Session can't continue there:
+stop the old container, create a new self-hosted Session and connect a host for it.
+
+For automation without a terminal, choose **Download credential file**, which saves
+`executor-credential-.json`, make it private
+(`chmod 600`), and add `--credential-file /absolute/path/to/that-file.json` to the
+installer line. The path must not go through a symbolic link.
+
+The host keeps its state in `~/.oac/self-hosted//`
+(`--install-dir` chooses another absolute directory). Keep it with the container's
+volumes: they hold the credential, workspace and native history. The Runtime's log is
+`docker logs `. A connected Environment proves the connection, not that the
+model works; send the Session a Turn to test execution.
+
+Core delivers the Session's model provider only over this Environment's executor
+connection. The host keeps it in the Runtime's harness home, where the model's tools
+and the Files API can't read it but the host's owner can.
+
+## Rotate or revoke
+
+| Action in Web | Effect |
+| --- | --- |
+| **Rotate** | The credential gets a new secret; the old secret stops working at once. Rotating a revoked credential restores it |
+| **Revoke** | The credential stops working at once |
+
+After either, the Runtime disconnects and stops retrying: its log shows one message
+that names the fix, and the container keeps running without a restart loop. To
+reconnect the host:
+
+1. **Rotate** the same credential in Web and copy the new secret.
+2. Rerun the same install command on the host and paste it.
+
+The installer puts the new credential into the same container, which reconnects with
+its workspace and history. Issuing a *new* credential doesn't reconnect an Environment
+that has already connected: it stays bound to its first credential, and the installer
+says to rotate that one.
+
+To remove the Runtime instead, stop its container:
+`docker --host unix:///var/run/docker.sock stop `. Deleting the Session does
+not remove containers or volumes on the executor host.
+
+In an archived project, Web shows "This project is archived, so executor credentials
+can't be issued or rotated." Only **Revoke** remains; a host that already holds a
+credential keeps it when you rerun the command.
+
+## Without Web
+
+Scripts on the Core host can issue credentials with the Core key through Core's
+loopback port (`ports.core` in `config.json`, 8091 by default). Choose a new UUID for
+the credential and keep it:
+
+```sh
+key_id=$(python3 -c 'import uuid; print(uuid.uuid4())'); echo "credential ID: $key_id"
+(umask 077; curl -fsS -X POST \
+ -H @<(printf 'Authorization: Bearer %s\n' "$(cat "$HOME/.oac/core/secrets/core.key")") \
+ -H 'Content-Type: application/json' -d "{\"key_id\":\"$key_id\"}" \
+ "http://127.0.0.1:8091/core/v1/projects/$PROJECT_ID/environments/$ENVIRONMENT_ID/executor-credentials" \
+ -o executor-key.json)
+```
+
+Rotate with `{"key_id":"…","rotate":true}` on the same route; revoke with
+`DELETE …/executor-credentials/`. After an uncertain response, list the
+credentials with `GET` before trying again. The
+[credential contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-executor-credentials.md)
+has every rule and error.
+
+
+## Executors installed before the rename
+
+An existing `parsar-selfhost-*` container keeps its own image, daemon and
+`~/.parsar/self-hosted/` directory. It can keep serving its
+Environment after Core is renamed; Core does not upgrade or manage this container.
+
+The new installer refuses when that exact Environment still has a directory under
+`~/.parsar/self-hosted`, including when a different `--install-dir` is supplied.
+Executors for other Environments are unaffected. To replace it, inspect the old
+installation's `started.json` to identify its container, stop and remove that
+exact container, and preserve any history you need before removing the old
+Environment's installation directory. Then rerun the new verified installer. It
+starts `oac-selfhost` with state under `~/.oac/self-hosted/`;
+it does not reuse the old executor's volumes or native history.
+
+Credential replacement for executors created by the new installer still updates
+and restarts the same owned container. The legacy refusal does not authorize
+adopting an old container to replace its credential.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/getting-started/self-hosted.md)
diff --git a/apps/docs/content/docs/self-hosted-execution.zh.mdx b/apps/docs/content/docs/self-hosted-execution.zh.mdx
new file mode 100644
index 000000000..27012a4b9
--- /dev/null
+++ b/apps/docs/content/docs/self-hosted-execution.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Self-hosted executors · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+self_hosted 执行器由用户拥有，Core 不管理它的容器。通过 Web 为对应 Environment 签发 executor 凭据，安装器通过隐藏输入或私有文件读取凭据；不要把凭据放入命令行。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/self-hosted-execution)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/sessions.mdx b/apps/docs/content/docs/sessions.mdx
new file mode 100644
index 000000000..c70cbe237
--- /dev/null
+++ b/apps/docs/content/docs/sessions.mdx
@@ -0,0 +1,97 @@
+---
+title: "Sessions and public resources"
+description: "Agents, Sessions, Turns, events and resources in the pinned public contract."
+---
+
+Applications call Core directly with an API key issued inside a Project. They use
+the public API to create and execute Agents, query history, and manage their assets.
+They never use the Core key or the console's browser session cookie.
+
+## Authentication and base URL
+
+Set `OPENAI_BASE_URL` to the installation's API base URL (`api_base_url` in
+`GET /core/v1/installation`: the public URL followed by `/v1`) and `OPENAI_API_KEY`
+to a Project API key; the official SDK reads both. Raw HTTP callers send
+`Authorization: Bearer `. The fixed SDK supplies
+`OpenAI-Beta: agents=v1` for the Beta Agents resources; raw HTTP callers must add
+it. General Files and Skills endpoints do not require that Beta header.
+
+```python
+from openai import OpenAI
+
+client = OpenAI() # Reads OPENAI_API_KEY and OPENAI_BASE_URL.
+page = client.beta.agents.list()
+```
+
+This read does not execute a model. See the [real execution quickstart](/quickstart)
+for separate model access configuration and a complete Session example.
+
+All keys in a Project share assets and Session creator identity. Revoking one key
+leaves the others valid; archiving the Project revokes all its keys. The optional
+`OpenAI-Organization` and `OpenAI-Project` headers must match `core` and
+`proj_` respectively. Do not send a key's UUID as the project scope.
+
+## Public resources
+
+Paths are relative to `/v1`. Detailed fields, union types and response shapes are
+in the [public OpenAPI](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/openapi.yaml), fixed SDK source
+and linked semantic records. The [resource inventory](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/README.md#upstream-resource-inventory)
+lists each operation and its coverage.
+
+| Resource | Route family | Semantics |
+| --- | --- | --- |
+| Agents | `/agents` | Reusable configuration, CRUD and lists |
+| Sessions and Turns | `/agents/sessions`, nested `/turns` | Admission, metadata, state and recovery queries |
+| Items and events | Session `/items`, `/events` | Persisted history and live SSE |
+| Artifacts | Session `/artifacts` | Captured output metadata, immutable content and deletion |
+| Subagents | Session `/subagents`, nested `/turns` and `/items` | Scoped child execution reads; [native limits](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/subagents.md) |
+| Environments and workspace Files | `/agents/environments`, nested `/files` | [Environment state](/environments-and-files) and [workspace access](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-files.md) |
+| Environment Templates | `/agents/environments/templates` | [Reusable initialization](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-templates.md) |
+| Source Files | `/files` | [Uploaded content resources](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/source-files.md), distinct from live workspace files |
+| Skills and versions | `/skills`, nested `/versions` | [Bundles and versions](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/file-resource-semantics.md) |
+| Vaults and Credentials | `/vaults`, nested `/credentials` | [Scoped write-only credential storage](/environments-and-files) |
+
+SSE is live, not a historical replay service. After a disconnect, query the Session,
+Turns and Items to reconcile state. An accepted request is not proof of completed
+native execution. Do not automatically replay uncertain tool or file effects.
+
+## Core extension fields
+
+The `/v1` route set is exactly the pinned SDK's operations, listed in
+[upstream-routes.json](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/upstream-routes.json); Core adds
+no route. It adds fields only inside `x_agents_core`, because it runs several
+harnesses and accepts custom model access:
+
+| Field | Where | Reference |
+| --- | --- | --- |
+| `x_agents_core.harness` | Saved Agent create, update and read; the inline Session `agent`; the Session's effective `agent` | [Harness selection](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/harness-selection.md) |
+| `x_agents_core.model_provider` | Saved Agent create, update and read; Session creation. It takes `protocol`, `base_url`, optional `context_window` and `max_output_tokens`, and a write-only `api_key`; reads return `api_key_configured` instead of the key | [Model execution](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/model-execution.md) |
+
+Any other member of `x_agents_core` is rejected with 400. Deployment, placement,
+credential issuance and operational reads are not part of `/v1`; they belong to
+`/core/v1`, which only the Core key can call (see the [API index](/public-api)).
+
+A Session's model provider comes from the Session's `x_agents_core.model_provider`,
+then a saved Agent's, then the deployment default that the administrator sets per
+harness. The deployment default applies to `openai_hosted` and `none` Sessions,
+never to `self_hosted`; `none` Sessions accept only the deployment default.
+`openai_hosted` and `self_hosted` Sessions must end up with one: otherwise creation
+returns 400 with code `model_provider_required` and param
+`x_agents_core.model_provider`, and nothing is written. See
+[model execution](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/model-execution.md).
+
+An application reads a Session's model from `agent.model` and an explicitly
+selected harness from `agent.x_agents_core.harness`; a Session on the deployment
+default harness omits `agent.x_agents_core`. `/v1` has no execution-configuration
+read.
+
+`openai_hosted` keeps the official wire name and means Core-managed compute here.
+The deployment chooses E2B or its own Docker/microsandbox nodes. A public
+`self_hosted` Environment uses caller-owned compute and the same colocated
+Runtime. For a `self_hosted` Session, the deployment operator issues the
+Environment's executor credential with the Core key; see
+[executor credentials](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/environment-executor-credentials.md).
+Our daemon transport and the supported native harness differences are
+explicit; they do not imply interoperability with OpenAI's stock executor transport.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/api/public-agent-api.md)
diff --git a/apps/docs/content/docs/sessions.zh.mdx b/apps/docs/content/docs/sessions.zh.mdx
new file mode 100644
index 000000000..87e48cbf8
--- /dev/null
+++ b/apps/docs/content/docs/sessions.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Sessions and public resources · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+Session 是持久对话上下文，绑定一个 Environment。输入事件启动或引导 Turn。Session、Turn 和 Environment 的状态各有含义，不应互相替代；具体字段以公共参考为准。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/sessions)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/docs/troubleshooting.mdx b/apps/docs/content/docs/troubleshooting.mdx
new file mode 100644
index 000000000..3c9cd97f3
--- /dev/null
+++ b/apps/docs/content/docs/troubleshooting.mdx
@@ -0,0 +1,407 @@
+---
+title: "Operations and troubleshooting"
+description: "oac lifecycle commands, backups, key rotation, upgrades and diagnostics."
+---
+
+The installation operator owns the Core host, its storage and its availability. Node
+hosts run their own services; see [Nodes](/hosted-providers). Settings are described in the
+[configuration reference](/configure).
+
+## The oac command
+
+Each installation has its own management command in its directory. It needs neither
+the bundle nor root:
+
+```sh
+~/.oac/core/oac status
+```
+
+| Command | What it does |
+| --- | --- |
+| `oac status` | Shows each service and its health, Core and Web health, the public URL, API base URL, console address and source commit, the reverse-proxy routes to configure, `config.json` changes not applied yet and generated files edited by hand. A Web-only installation also checks that its Core accepts its Core key. Exits non-zero when a service is unavailable. It never calls a model |
+| `oac start` | Starts every service with the files last written by `apply`; warns about unapplied changes |
+| `oac stop` | Stops PostgreSQL, Core and Web. Data, nodes and sandboxes are kept, and running sandbox work may continue |
+| `oac apply` | Applies `config.json` and restarts what changed; see [how apply works](/configure#how-oac-apply-works) |
+| `oac apply --dry-run` | Shows the changed settings, files and restarts, and changes nothing |
+| `oac apply --discard-edits` | Overwrites generated files edited by hand, keeping each as `generated/.edited-` |
+| `oac apply --confirm-public-url-change URL` | Confirms a public URL change without a prompt; must equal the new URL |
+| `oac apply --yes` | Web-only: pairs Web with a different Core without asking |
+| `oac rotate-core-key [--yes]` | Replaces the Core key; see [Rotate the Core key](#rotate-the-core-key) |
+
+`install.sh --status` and `--stop` are retired; they name the `oac` command instead.
+For a second installation, use its own command, such as
+`~/.oac/web/oac status`.
+
+## Service health
+
+Use these observations for different questions:
+
+| Observation | What it establishes |
+| --- | --- |
+| `oac status`, PostgreSQL health | The database accepts its readiness check |
+| Core `/healthz` | Core's process is alive |
+| An authenticated API read | The caller's key works for that resource |
+| Environment connection | The Runtime transport is connected |
+| A finished Turn and its results | The task's recorded outcome |
+
+Service health does not prove that a native harness or a model works. Use Session,
+Turn, Items and Usage reads for execution, and Web's **Nodes** page for node connection,
+readiness and placement. For local diagnosis, use the installation's own Compose file:
+
+```sh
+docker compose -f "$HOME/.oac/core/generated/compose.json" ps --all
+docker compose -f "$HOME/.oac/core/generated/compose.json" logs --tail 200 core
+```
+
+Native Core logs to its user unit: `journalctl --user -u -core.service`, with
+`project` from `state.json`. Don't paste `docker compose config`, `docker inspect` or
+raw logs into public issue reports.
+
+## Stop and restart
+
+Let active work settle before a planned restart:
+
+```sh
+~/.oac/core/oac stop
+~/.oac/core/oac start
+```
+
+Stopping Core stops no node and no sandbox. Node services, their microVMs and Docker
+containers keep running; stopping is not a way to reclaim compute. A Core restart does
+not continue an interrupted native tool call transparently. After reconnecting, query
+the same Session; don't create a new Session to replay uncertain work. Session event
+streams are live only; recover through Session, Turn and Items reads.
+
+A Web restart, including one caused by `oac apply`, signs everyone out of the
+console.
+
+## Core key
+
+Each installation has one administrator credential, the Core key. The installer
+generates a 64-character random key in `/secrets/core.key`, by default
+`~/.oac/core/secrets/core.key`. The Core key:
+
+- signs in to Web. The browser gets an HttpOnly session cookie, never the key;
+- authorizes Core API (`/core/v1`) requests sent as `Authorization: Bearer `;
+- never authorizes the Agent API (`/v1`). Applications use Project API keys, which in
+ turn can't call `/core/v1`.
+
+Keep it private: `secrets/` is mode `0700` and its files `0600`. Of the services, only
+Web reads `core.key`; Core reads its SHA-256 from `generated/core-key-digests.json`,
+which `oac apply` derives from the key. Both read them only at startup. A Core key
+has at least 32 characters and no whitespace. Web limits failed sign-ins.
+
+Scripts run on the Core host, call Core's loopback port and read the key from its file,
+which keeps it off the command line:
+
+```sh
+curl -fsS -H @<(printf 'Authorization: Bearer %s\n' "$(cat "$HOME/.oac/core/secrets/core.key")") \
+ http://127.0.0.1:8091/core/v1/projects
+```
+
+### Rotate the Core key
+
+```sh
+~/.oac/core/oac rotate-core-key
+```
+
+It refuses while `config.json` has changes that are not applied or a generated file was
+edited by hand: run `oac apply` first. It asks for confirmation (`--yes` skips it),
+stops Web, writes a new key to `secrets/core.key` and regenerates the digest file. On a
+running installation it then restarts Core, starts Web and checks that Core accepts the
+new key and refuses the old one; a stopped installation only gets the new files and
+uses the new key at the next `oac start`. The old key stops working as soon as Core
+restarts, and every console session ends: sign in again and update your scripts. If the
+command stops early, `secrets/core.key` holds the key to use; run `oac apply` to
+finish.
+
+A separate Web-only installation keeps its own copy of the key. After rotating, copy
+`secrets/core.key` from the Core host into that installation's `secrets/core.key`
+(mode `0600`) and run its `oac apply`. Its `oac status` reports a key that Core
+refuses. `rotate-core-key` refuses to run on a Web-only installation.
+
+## Projects and API keys
+
+Create Projects and issue their keys in Web, on **Projects and keys**, or with the
+[Core API](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md) under `/core/v1/projects`. A key's
+plaintext is shown once; Core stores only its digest. All keys of a Project share its
+assets and execution principal, and each write records the key that made it.
+
+To rotate an application key, issue another key in the same Project, update the
+application, then **Revoke** the old key. **Archive** disables all of a Project's keys
+and keeps its assets and accepted work. Administrators can inspect and delete retained
+resources but can't execute with the Core key.
+
+## Data and upgrades
+
+### Back up
+
+Back up these together; a restore needs all of them:
+
+- the PostgreSQL volume `_database`. It holds Projects, key digests, nodes,
+ default models, encrypted credentials and all execution history, including large
+ objects. A logical dump:
+
+ ```sh
+ docker compose -f "$HOME/.oac/core/generated/compose.json" exec -T database \
+ pg_dump -U agents_api agents_api > oac-backup.sql
+ ```
+
+- the installation directory: `config.json`, `state.json` (installation ID) and
+ `secrets/`. `credential.key` must stay with the database, or stored credentials can't
+ be decrypted; never regenerate it to get past an error.
+- `state/e2b/`, when E2B is used: receipts Core needs to clean up E2B sandboxes.
+- each node's state directory on its host,
+ `/var/lib/oac-node/.oac/nodes//` (sudo mode) or
+ `~/.oac/nodes//` (no sudo), with its provider storage: Docker
+ volumes or microsandbox's store.
+- the bundle you installed from, to repair or recover the same release.
+
+A missing node state directory is a recovery incident: restore it with the database
+and provider storage rather than registering over existing resources. Never prune
+Docker volumes or delete native history to make a retry pass. A deleted Session does
+not prove that all provider resources were reclaimed.
+
+### Upgrade an installation
+
+| Installation | How to upgrade |
+| --- | --- |
+| Before the OpenAgentCore rename: `state.json` format 1 and a `parsar-…` project, or a legacy `installation.json` layout | [Convert it](#convert-an-earlier-installation) with this bundle |
+| OpenAgentCore, same release | Rerun `./install.sh --install-dir DIR` from the same bundle to repair it |
+| OpenAgentCore, another release | General upgrades are not supported yet; keep the installed release |
+
+There is no downgrade after database migrations. Back up before converting.
+
+### Convert an earlier installation
+
+Use the old Web and old nodes to drain first: enable maintenance, archive hosted
+Sessions until allocations and pending work are both zero, remove every node on the
+Nodes page, and run each node's uninstall command from the previous release.
+Suspended sandboxes, retained snapshots and uncertain cleanup still count. Archived
+Sessions retain their history but cannot resume their old sandbox. Self-hosted
+executors keep running and are not converted.
+
+Extract the new bundle and run:
+
+```sh
+./install.sh --convert
+```
+
+Without `--install-dir`, this converts `~/.parsar/core` into `~/.oac/core`, or resumes
+an unfinished conversion already moved there. An explicit custom directory converts
+in place. `--yes` skips the one confirmation; `--public-url` only settles a legacy
+layout's conflicting public addresses. Convert the Core host before Web-only hosts.
+The latter rename their directory, project and payload without copying a database.
+
+Preflight reports generated-file edits, invalid configuration, destination conflicts,
+insufficient database-copy space, and every available drain blocker. It reads the
+old Core with its Core key. When that Core is stopped and static checks pass, it
+announces a temporary start using only the existing files. Refusal restores the
+services this probe started; a restoration failure is reported explicitly. No
+installation conversion happens before confirmation.
+
+The confirmation prints the backup command for the old project and the directory
+and secret moves. For a config.json installation, take the backup before confirming:
+
+```sh
+docker compose -f "$HOME/.parsar/core/generated/compose.json" exec -T database \
+ pg_dump -U agents_api agents_api > oac-backup.sql
+```
+
+A legacy installation uses `compose.json` at the directory's top level instead.
+Its supported settings move into config.json and secrets move into secrets/ in the
+same run, with no intermediate upgrade or second confirmation. Unknown legacy files
+are reported and left in place; unknown settings and edited derived values refuse.
+
+Conversion stops the old services, copies the stopped database into
+`oac-_database`, removes the old containers and network, and moves the
+default directory atomically. It retains `parsar-_database` as a backup.
+An interrupted copy is restarted only after verifying that its target volume and
+copy container belong to this conversion. A foreign same-name resource is refused.
+
+The new state format is 2; config.json's schema format remains 1. Ports, public URL,
+secrets, Core key, installation ID and database contents are preserved. The old
+`parsar` path becomes a stub naming the new `oac` command. New services use `OAC_*`
+settings and `io.oac.inputs` labels. Docker and microsandbox deployments retain
+their resources, replace their Runtime with the bundle's release through the normal
+maintenance-only API, then resume admission. E2B remains in maintenance: rebuild its
+template with this release's `build-template.py`, replace it in Web, then resume.
+
+Rerun `./install.sh --convert` with the **same bundle** after any interruption,
+including after the directory move. For a custom directory, repeat `--install-dir`.
+The journal rejects a different bundle or installation identity. It verifies Project
+identities and service health before recording completion. Check retained history,
+then add new nodes through **Nodes → Add node**. Keep the old volume until this
+verification is complete; the final output names its exact `docker volume rm`
+command. Never remove the new volume or use a Docker-wide cleanup.
+
+Before the directory move, the old command can restart the old services against the
+untouched old volume. After the move, finish by rerunning conversion. Once new Core
+migrations run, restoring the old release requires the old bundle, old installation
+files and the pre-conversion backup or retained old volume; this is not a downgrade
+of the new database.
+
+### Upgrade notes
+
+These names are retired. Core and Web refuse to start while a retired setting is
+present, and the installers reject retired flags and variables; each error names the
+replacement:
+
+| Retired | Replacement | Where |
+| --- | --- | --- |
+| `AGENTS_API_EXECUTION_OPTIONS_FILE` | Default models, set per harness in Web (**System**, **Default model**) or with `PUT /core/v1/harnesses/{harness}/model-provider` | `config/core.env`. `--convert` does not carry it over; it leaves the file, which may hold model keys, and reports it. Delete the file once the defaults are set |
+| `AGENTS_API_DAEMON_WS_URL` (a `wss://…/api/v1/agent-daemon/ws` URL) | `OAC_PUBLIC_URL` (the origin, such as `https://core.example`), or `public_url` in `config.json` | `config/core.env` |
+| `AGENTS_API_CONFIG_FILE` | None; delete the line | `config/core.env` |
+| `AGENTS_API_MANAGED_RUNTIMES_FILE` | The sandbox deployment in the database, set in Web | `config/core.env`; see [older file-managed installations](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#older-file-managed-installations) |
+| `admin/sandbox-admin.key`, `admin/digests.json` | `admin/core.key`, `admin/core-key-digests.json` (conversion then moves them to `secrets/` and `generated/`) | Files and their `compose.json` mounts |
+| `AGENTS_API_SANDBOX_ADMIN_DIGESTS_FILE` | `OAC_CORE_KEY_DIGESTS_FILE` | `config/core.env` |
+| `CORE_CONSOLE_ADMIN_TOKEN_FILE`, `install.sh --admin-token-file` | `OAC_WEB_CORE_KEY_FILE`, `--core-key-file` | Web environment; installer flag |
+| `CORE_CONSOLE_AUTH_MODE`, `CORE_CONSOLE_STATE_DIR`, `CORE_CONSOLE_PASSWORD_FILE` | None: Web has no accounts or passwords; sign in with the Core key | Web environment, with their `state/console` and `config/console.password` mounts |
+| `install.sh --sandbox-provider`, `--provider` | `install.sh --sandbox`; add the Core host as a node with Add node | Installer flags |
+| `install.sh --status`, `--stop` | `oac status`, `oac stop` | Installer flags |
+| `PARSAR_NODE_ENROLLMENT_TOKEN` | The token on standard input with `--enrollment-token-stdin`, as Web's Add node command passes it | Node installer; it refuses the variable |
+
+The release also renames the following operator identities. Old process settings
+are refused even when empty; errors name all applicable replacements without values.
+These historical names are inputs only to conversion and retirement diagnostics.
+
+| Before | OpenAgentCore |
+| --- | --- |
+| `AGENTS_API_*` process settings | `OAC_*`; `AGENTS_API_ENGINE` becomes `OAC_DEFAULT_HARNESS`, `AGENTS_API_SANDBOX_INSTALLATION_ID` becomes `OAC_INSTALLATION_ID`, and `AGENTS_API_RUNTIME_HISTORY_FILE` becomes `OAC_HISTORY_SETTINGS_FILE` |
+| `CORE_CONSOLE_*` | `OAC_WEB_*`; `CORE_CONSOLE_UPSTREAM` becomes `OAC_WEB_UPSTREAM` |
+| `PARSAR_LOG_*` | `OAC_LOG_*` |
+| Runtime `PARSAR_*`, including `PARSAR_HOME` | `OAC_RUNTIME_*`, including `OAC_RUNTIME_HOME`; separate Parsar-product hooks are unchanged |
+| Developer/build variables and test database/SDK variables | `OAC_DEV_*` and `OAC_TEST_*`; `OAC_TEST_DATABASE_URL` selects the dedicated test database |
+| `~/.parsar/core`, `parsar`, `parsar_cli.py`, `parsar.pyz`, `.parsar.lock` | `~/.oac/core`, `oac`, `oac_cli.py`, `oac.pyz`, `.oac.lock` |
+| `parsar-` project, containers, default network and database volume | `oac-`; the old database volume is retained as a backup |
+| `parsar--core.service`, `PARSAR_INPUTS`, `io.parsar.inputs`, `x-parsar`, `/run/parsar` | `oac--core.service`, `OAC_INPUTS`, `io.oac.inputs`, `x-oac`, `/run/oac` |
+| `parsar-core--linux-amd64` bundle and artifact prefix | `oac--linux-amd64` |
+| `agents-api`, `agents-api-migrate`, `agents-api-device`, `agents-api-environment-key`, `core-console` | `oac-core`, `oac-core-migrate`, `oac-core-device`, `oac-core-environment-key`, `oac-web` |
+| `agents-api-e2b-provider`, `/opt/parsar/e2b` | `oac-e2b-provider`, `/opt/oac/e2b` |
+| `parsar-daemon`, Runtime `agents-api-*` helpers | `oac-daemon`, `oac-*` helpers |
+| `~/.parsar/parsar-daemon`, `/home/runtime/.parsar`, `/run/parsar/daemon-suspend.json` | `~/.oac/daemon`, `/home/runtime/.oac`, `/run/oac/daemon-suspend.json` |
+| `parsar-core-runtime@sha256:…`, `agents-runtime-` | `oac-runtime@sha256:…`, `oac-runtime-` |
+| Runtime `io.parsar.agents-api.*`, microsandbox `io.parsar.*`, `parsar.runtime.placement` | `io.oac.*`, `io.oac.*`, `io.oac.placement` |
+| E2B `parsar_*` metadata, `/opt/parsar-e2b`, `/root/.parsar/e2b`, `/etc/parsar-runtime-env.json` | `oac_*`, `/opt/oac-e2b`, `/root/.oac/e2b`, `/etc/oac-runtime-env.json` |
+| Model-visible `parsar_workspace`, `parsar_worker`, `parsar_root`, `parsar/subagents`, Codex provider `parsar` | `oac_workspace`, `oac_worker`, `oac_root`, `oac/subagents`, provider `oac` |
+
+The PostgreSQL database and role remain `agents_api`. Public API routes, Go module
+paths, source directory names and npm package names are unchanged. Historical
+Session content is never rewritten. Nodes and self-hosted executors require their
+own [node](/hosted-providers) and [self-hosted](/self-hosted-execution) procedures; the Core converter
+does not rename their stores or adopt their resources.
+
+Before converting, rename or remove only the names from before the Core key:
+`admin/sandbox-admin.key`, `admin/digests.json`, `AGENTS_API_SANDBOX_ADMIN_DIGESTS_FILE`
+and the retired `CORE_CONSOLE_*` settings. Leave `AGENTS_API_DAEMON_WS_URL`,
+`AGENTS_API_CONFIG_FILE` and `AGENTS_API_EXECUTION_OPTIONS_FILE` to `--convert`, which
+maps or reports them. Don't add `AGENTS_API_PUBLIC_URL` by hand to a legacy installation: when it is present,
+conversion takes it as the address Core uses and skips the check against the sandbox
+deployment's Core address that keeps existing nodes bound. Hosted and self-hosted
+Sessions that relied on the retired options file
+have no model provider of their own and can't start new work after the upgrade. Count
+them before converting, from the new bundle:
+
+```sh
+python3 model_provider_sessions.py --install-dir "$HOME/.parsar/core"
+```
+
+Recreate them with `x_agents_core.model_provider` or an Agent that has one saved.
+
+The deployment no longer stores a Core address; nodes keep the one they enrolled with.
+For a Core you run without the installer, read `GET /core/v1/sandbox/deployment` with
+the Core key before upgrading and set `OAC_PUBLIC_URL` to its `core_url`; with
+any other value, every existing node counts as bound to another address and must be
+added again.
+
+#### Node connections at /api/v1
+
+Core and its nodes must come from the same distribution; the node installer refuses a
+mismatched release. Current releases serve every machine connection at `/api/v1`, and
+Web returns 404 there. When the new Core and Web go live, route `/api/v1/*`, including
+WebSocket upgrades, to Core instead of Web
+([HTTPS and the reverse proxy](/install#https-and-the-reverse-proxy)); with the old
+routing, node enrollment and every Runtime connection fail, for Docker, microsandbox,
+E2B and self-hosted executors alike.
+
+Nodes from releases that used the removed `/core/v1/sandbox/enroll` and
+`/core/v1/sandbox/node/*` paths can't connect to a current Core. For a Docker or
+microsandbox deployment:
+
+1. Drain with the previous release while its nodes are connected: enter maintenance,
+ archive retained hosted Sessions and wait until nothing is retained (the
+ [maintenance procedure](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/services/agents-api/HOSTED-SANDBOX-MANAGER.md#removal-and-maintenance)).
+2. Upgrade Core and Web, and change the routing as above.
+3. Save the new release's Runtime, resume, and add the nodes again. On each node host,
+ stop the old node service and move its state directory aside as a backup first.
+
+A Web-selected Docker or microsandbox deployment saved before deployment specifications
+existed has an empty specification after migration. Draining it needs a Core that has
+the pre-specification drain mode (pull request #114) but still serves the old node
+paths. No such release was published: build a distribution from main commit
+`7b66be236a627246c85658722314285e6b39d9b8`, or any commit that contains #114 but not the
+move to `/api/v1/sandbox-node`. That Core loads the deployment only to drain; fresh
+sandboxes, node configuration reads and enrollment are refused. Back up, replace Core
+and Web with that build, drain as in step 1, then upgrade to the current release and
+continue with steps 2 and 3. Node IDs change; Session history and persisted Files and
+Artifacts remain. E2B deployments from that period are not covered.
+
+## Troubleshooting
+
+| Symptom | Cause and fix |
+| --- | --- |
+| `Run as a non-root user on Linux amd64 with Docker access` | Run `install.sh` as a normal user, on Linux amd64 |
+| `Installation failed; inspect prerequisites and private deployment files` | A prerequisite failed without its own message, most often Docker: check that `docker info` and `docker compose version` work for this user |
+| `Docker Compose 2.26.0 or newer is required …` | Update the Docker Compose plugin |
+| `Port N is already in use; select another port` | Free the port, or install with `--core-port`/`--web-port` |
+| `Installation directory is not empty …` | Use an empty `--install-dir` |
+| `This installation is configured by …/config.json …` | Flags only seed a new installation: edit `config.json` and run `oac apply` |
+| `This installation predates config.json …` | [Convert it](#convert-an-earlier-installation) |
+| `This installation runs another release …` | See [Upgrade an installation](#upgrade-an-installation) |
+| `generated/ was edited by hand` | Put the change in `config.json`, then `oac apply --discard-edits` |
+| `config.json has changes that are not applied` | Run `oac apply` |
+| `Core rejects secrets/core.key …` | Run `oac apply`, which restarts Core with the key's digest |
+| `config.json not applied: …` | `oac apply` printed Core's startup error above; fix `config.json` and apply again |
+| Web answers 403 `Forbidden` | Open exactly the console address `oac status` prints; the reverse proxy must pass the original Host |
+| `/v1` or `/api/v1` answers 404 | Those paths reach Web; route them to Core ([reverse proxy](/install#https-and-the-reverse-proxy)) |
+| Web shows that Core is unavailable (502) | Core is stopped or failing: `oac status`, then Core's log |
+| Session creation returns 400 `model_provider_required` | No model provider: set a [default model](/configure#default-models) for the harness, or pass one; self-hosted Sessions always pass their own |
+| Add node says nodes need an HTTPS public URL | Set `public_url` and run `oac apply` |
+| Add node says the console has no node files | Install from the offline bundle, or add the node files and rerun `./install.sh` |
+| A node is not ready | See [node troubleshooting](/hosted-providers#troubleshooting) |
+
+## Exposure and network policy
+
+Core and Web listen on host loopback; PostgreSQL has no published port unless Core is
+native. Your TLS reverse proxy routes `/v1` and `/api/v1` to Core and everything else to
+Web. Web signs administrators in with the Core key, checks the origin of every request,
+and forwards signed-in `/core/v1` requests to Core with the Core key, which stays on
+the server. It answers 404 on `/v1` and `/api/v1` whatever credential a request carries,
+serves only the non-secret node payload at `/node-install/`, and has no Docker or KVM
+access. Machine routes keep their own enrollment and connection credentials. Web
+sign-in sessions live in Web's memory and last 12 hours.
+
+microsandbox uses an explicit network policy: public egress, the Core and DNS ports the
+Runtime needs, and no inbound or private-network access. Private model or MCP endpoints
+need an explicit policy change. A Session's own network policy is separate.
+
+The Docker node uses the nested-sandbox Runtime policy. Its service account needs the
+host's Docker daemon, and Core has no Docker socket. Install nodes on trusted hosts and
+don't share their Docker access with untrusted users.
+
+A Core restart leaves node services and resident microVMs running. A host reboot, the
+end of a user manager or the loss of a running microVM is not a Core restart and is not
+a qualified recovery workflow. Idle snapshots keep their recovery contract.
+
+### API-key write history
+
+Core records which key made each public resource write, for the console. Set
+`core.write_audit_retention` in `config.json` (Go duration, at least `1h`, default
+`2160h`) to control how long non-creation history is kept; creation ownership is kept
+for good. Removing keys or resources does not delete these records. See the
+[query contract](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/write-audit.md); administrator mutations
+have a separate
+[audit log](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/contracts/agents-api/admin-api.md#monitoring-and-audit). Neither
+logs bodies or secrets.
+
+[Repository source](https://github.com/MiniMax-AI/parsar-core/blob/75bf4484ba957344ae374354858bbdfe104f5c4f/docs/getting-started/operations.md)
diff --git a/apps/docs/content/docs/troubleshooting.zh.mdx b/apps/docs/content/docs/troubleshooting.zh.mdx
new file mode 100644
index 000000000..9e1a5db31
--- /dev/null
+++ b/apps/docs/content/docs/troubleshooting.zh.mdx
@@ -0,0 +1,10 @@
+---
+title: "Operations and troubleshooting · 中文导读"
+description: "当前版本的中文导读；完整操作步骤见英文正文。"
+---
+
+使用 oac status 查看安装状态，oac doctor 诊断配置，oac apply 应用 config.json。备份必须同时保留数据库、配置和密钥。升级按当前指南执行；不要假设在线 generation 更新或 reset 已实现。
+
+此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/troubleshooting)。
+
+[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)
diff --git a/apps/docs/content/guide-sources.json b/apps/docs/content/guide-sources.json
new file mode 100644
index 000000000..e768b0c2b
--- /dev/null
+++ b/apps/docs/content/guide-sources.json
@@ -0,0 +1,61 @@
+{
+ "revision": "75bf4484ba957344ae374354858bbdfe104f5c4f",
+ "sources": {
+ "docs/getting-started/README.md": "e4ca3bcbfdcbf3832c1d9e0525f98083ca11a4e42148f9f45090bbe1bc0f2b5c",
+ "docs/design-principles.md": "5e1bff3cdcc77cd02ad692f67977cb4e0a5654989982d722bac0e3c79dbf82cb",
+ "docs/web/architecture.md": "23e5758d72687c2c821975f326f24a789545ce0b0f566802cbe901edf2ebe3f1",
+ "docs/getting-started/install.md": "15cfe81d4005a7337ac82bf6c35a8b441e9f9b0f2a2299021ad6c539f3f336a3",
+ "docs/configuration.md": "7fe061b93a09c0f7baaa70f33f0863d8b29d308bbbc9b0e42b35cbef0ef0c648",
+ "docs/web/core-connection.md": "46f86520e70bf41079708e2c398655aa9087ad9488c8e661d9a73035d11098c4",
+ "docs/getting-started/quickstart.md": "5effeffcfb343f7939910f0c1758e1492d49e7bd66c409b1819cefe67af592d7",
+ "docs/api/README.md": "f8c3872b012af7c490a06578c7d56560e0ec5998865ef043523bc66cc10ae4be",
+ "contracts/agents-api/execution-tools.md": "e0b61f6c0c236c362186c5f6d0ad69a16dd8a8d9afabe1329a1fe22e5f4a71e9",
+ "docs/api/public-agent-api.md": "18829b366bd2e49fe5beb76dc8a709bc1aa8e35d4fbfd2484a0c52b46cf75417",
+ "contracts/agents-api/environments.md": "89ffc903ee44d00ee87c16950202a3ca4c8345160780dcdd4ed2a71b25b1c2dc",
+ "docs/getting-started/nodes.md": "00d98f03d0ac967575bfa35ee960ff24b971bff1531a264517b384376986ac6f",
+ "docs/getting-started/self-hosted.md": "3f1b402cf28bb320ba414eaf36110e9df4d792b81da0456a3c42d469357d8d99",
+ "apps/web/public/onboarding/monitor-en.webp": "29dc220cb1250c7016b7c4bf7f30e9510b07c07b814a48c3aa9303b2d76f20b2",
+ "docs/web/README.md": "3b96e673591da67a6f666dddafd49a565c066c347bdfa2eaba0f92ab03daf514",
+ "docs/api/web-management.md": "5480bfcf9dd24a8ffc8d442e4d8582e007dadd22dba6a686d71b4bede0616506",
+ "contracts/agents-api/runtime-observability-api.md": "cd46e777fe716a7e76374f4655c96dfbad9d8be1bfca6203ed6118ab87874c2b",
+ "docs/getting-started/operations.md": "abc965e6ba19d2a2c148c8b5afde7203ca39891383840d85379d0d433b39df1d",
+ "apps/docs/scripts/guides.json": "9d1ba424f8fadd65ffa6175eaa9c7bc4878d3e1437971099812c984e1e593080"
+ },
+ "outputs": {
+ "content/docs/index.mdx": "2cd2e1d7adb6b38bfb1808bc5f9d9b2f699d02b02eb233c0ee72438884dffe9a",
+ "content/docs/index.zh.mdx": "5bdd41893946f1d229eb4cf1599a97f2e38cb9e09722d2a69f62053376ac88a9",
+ "content/docs/concepts.mdx": "32120464dd98c1b80d5d4c57d7f2c7e4365f623532024a632b9fccbda730384a",
+ "content/docs/concepts.zh.mdx": "c60644f395dbac5ee607cdb053249e05ec8352d28de97ef1c38d6c1e4443bbb1",
+ "content/docs/execution-model.mdx": "b3c928e353e173aa7eea5c4fbad06b6896fd1e97f69c87701de8af39fae054fe",
+ "content/docs/execution-model.zh.mdx": "9976a9203c6a83d49c2c753e3a8528a369078e87aeb88850654da948ac8c17e1",
+ "content/docs/install.mdx": "439809c11f5d805e6c6f964c779ec01468dcdad88bd11a56bb180a6e6a13b98a",
+ "content/docs/install.zh.mdx": "7ed0b726cf721b18e85b89145ef8ebd2f5d382afd0489633a7b63962aa2fc4ed",
+ "content/docs/configure.mdx": "4ab159c54f7b9c6e1a2d0c3873de5e3641b48c4e1badf47f63311bef94f8778f",
+ "content/docs/configure.zh.mdx": "a0c3a1df3e9f75e672e1d0a8c68c82c24ac36a8479d10a951de441960d07927f",
+ "content/docs/bootstrap-projects-keys.mdx": "4a39e95986851828e3fbcc0550398146de9bb37cfe22f10df566c51a911ca9ed",
+ "content/docs/bootstrap-projects-keys.zh.mdx": "509b4dcea4c865d6834bcaef78baa681180d48274931230f958a39e46011c88f",
+ "content/docs/quickstart.mdx": "92f62b5df213c363bd7148de0462b2ca66f2054f4458d790196e75daa678bb24",
+ "content/docs/quickstart.zh.mdx": "c5f119b100b102918a45763834d0ed7fd436479fb411e16a62a408411dbcb3e1",
+ "content/docs/public-api.mdx": "a3d39d873054614bdf410d8c2a1e5c33320f1f3bffe155657b64579ea28fdc48",
+ "content/docs/public-api.zh.mdx": "fb0efb9be2fba3f4a3dc71bf053d2c7eddffbfe010f59fa5a1ae60a3f068545b",
+ "content/docs/agents-and-tools.mdx": "78789f7e6a1d327ff514d872b9f8b55a88754ffbfc34b7b10e5f7c115f242e3c",
+ "content/docs/agents-and-tools.zh.mdx": "cc8d4e0ef0ea894f068f3bbd143d5ee70c6346bf98f425b1d5fe07ec3931f128",
+ "content/docs/sessions.mdx": "eaef17849bce13c9f3c22966910e081fcc4851c59a7a8b972e917a45bdebfb57",
+ "content/docs/sessions.zh.mdx": "b1b1a7f8aacd9a902320f9692173ede24036124f85761cf02f23ef3ef2bcc4c1",
+ "content/docs/environments-and-files.mdx": "411328cb87962ee9849021ed14de144ab9d4b31ecb8a42954079c9142d479e98",
+ "content/docs/environments-and-files.zh.mdx": "ee64577220a798f023b330c65302c14438f25a34a78c4e36144bfdb4304a3ae5",
+ "content/docs/hosted-providers.mdx": "7d1825a5ef7e81d71a0c64bd00ce8fcc3c00d632a318eaa4063dacf876fdfee5",
+ "content/docs/hosted-providers.zh.mdx": "f54d80d6e65596dca6b20262abaa3dcb5af245227ffad146fcaed4bd69454dee",
+ "content/docs/self-hosted-execution.mdx": "67a134939247a5a3d16b4a935895259c37d8264377de53179e6598bdb82957d5",
+ "content/docs/self-hosted-execution.zh.mdx": "f11d34ce30d48039376256474bc9509a508a2f6b9906f49b5cf6e396707ae5c0",
+ "public/images/source/apps/web/public/onboarding/monitor-en.webp": "29dc220cb1250c7016b7c4bf7f30e9510b07c07b814a48c3aa9303b2d76f20b2",
+ "content/docs/console.mdx": "a708f26941840375299f14b26dc69a278c1f44a7aedca90d50bb806ba05685c0",
+ "content/docs/console.zh.mdx": "72f953ba46dcc95933773ac0c4dffdc0d0a499be9d9a1cb9467db2659f1fa10d",
+ "content/docs/admin-api.mdx": "23b0ebdbb3ab93cee6f93e083026318465fae581546de5af9953fbf779444452",
+ "content/docs/admin-api.zh.mdx": "07006de30df3080e54c3cd79ed0ea5337dce557aa2f11afea84edb7f92884d38",
+ "content/docs/observability.mdx": "4894808be45568b3d6e1039183350a5315dbbde1144db94cc592eb8bd8c433e4",
+ "content/docs/observability.zh.mdx": "9574b3412a5754f41ab2d3a16062ac1cad06766be481a8e6bff1b84acbde7e7e",
+ "content/docs/troubleshooting.mdx": "2008f1bcdc5e8cfb55602e2d849093140a61682c68795d9c9f707d62e30b0c0a",
+ "content/docs/troubleshooting.zh.mdx": "a47714ea9890385e811b163bbb2dc1412ddd9c12747792cf53630fc06062e5e2"
+ }
+}
diff --git a/apps/docs/lib/i18n.ts b/apps/docs/lib/i18n.ts
new file mode 100644
index 000000000..6ec2bbf10
--- /dev/null
+++ b/apps/docs/lib/i18n.ts
@@ -0,0 +1,10 @@
+import { defineI18n } from "fumadocs-core/i18n"
+
+export const i18n = defineI18n({
+ languages: ["en", "zh"],
+ defaultLanguage: "en",
+ hideLocale: "default-locale",
+ parser: "dot",
+})
+
+export type Lang = (typeof i18n.languages)[number]
diff --git a/apps/docs/lib/legacy-redirects.test.ts b/apps/docs/lib/legacy-redirects.test.ts
new file mode 100644
index 000000000..b0c6eb243
--- /dev/null
+++ b/apps/docs/lib/legacy-redirects.test.ts
@@ -0,0 +1,55 @@
+import assert from "node:assert/strict"
+import { existsSync } from "node:fs"
+import { join } from "node:path"
+import test from "node:test"
+import { i18n } from "./i18n.ts"
+import { LEGACY_TARGETS, legacyTarget } from "./legacy-redirects.ts"
+
+// Resolved from either the repo root or the app directory, so the suite runs
+// whether `node --test` is started from the app or from the repository root.
+const contentRoots = [
+ join(process.cwd(), "content", "docs"),
+ join(process.cwd(), "apps", "docs", "content", "docs"),
+]
+
+/**
+ * A page counts as live only when every declared language has a source file.
+ * A redirect landing on an untranslated page would hand a Chinese reader an
+ * English page, which is the failure these redirects exist to prevent.
+ */
+function isLivePage(target: string): boolean {
+ const stem = target === "/" ? "index" : target.replace(/^\//, "")
+ return contentRoots.some((root) =>
+ i18n.languages.every((lang) =>
+ existsSync(
+ join(root, lang === i18n.defaultLanguage ? `${stem}.mdx` : `${stem}.${lang}.mdx`),
+ ),
+ ),
+ )
+}
+
+test("every redirect target is a page that exists in every language", () => {
+ for (const [from, to] of Object.entries(LEGACY_TARGETS)) {
+ assert.ok(isLivePage(to), `${from} -> ${to} is not a translated page`)
+ }
+})
+
+test("no retired slug is still published", () => {
+ for (const from of Object.keys(LEGACY_TARGETS)) {
+ assert.ok(!isLivePage(`/${from}`), `${from} is mapped but is still a live page`)
+ }
+})
+
+test("legacyTarget resolves with or without surrounding slashes", () => {
+ assert.equal(legacyTarget("/api-keys"), "/bootstrap-projects-keys")
+ assert.equal(legacyTarget("api-keys"), "/bootstrap-projects-keys")
+ assert.equal(legacyTarget("/api-keys/"), "/bootstrap-projects-keys")
+})
+
+test("legacyTarget leaves live pages and the root to the router", () => {
+ assert.equal(legacyTarget("/configure"), undefined)
+ assert.equal(legacyTarget("/public-api"), undefined)
+ assert.equal(legacyTarget("/environments-and-files"), undefined)
+ assert.equal(legacyTarget("/"), undefined)
+ assert.equal(legacyTarget(""), undefined)
+})
\ No newline at end of file
diff --git a/apps/docs/lib/legacy-redirects.ts b/apps/docs/lib/legacy-redirects.ts
new file mode 100644
index 000000000..2aeb661c9
--- /dev/null
+++ b/apps/docs/lib/legacy-redirects.ts
@@ -0,0 +1,70 @@
+/**
+ * Slugs retired when the manual was rewritten around the administrator-API
+ * baseline. Keys are the previous slugs without a locale prefix; values are the
+ * surviving page that now covers the topic, or `/` for a topic that was folded
+ * into an overview.
+ *
+ * `middleware.ts` answers these with a permanent redirect and carries the
+ * reader's language across, so `/zh/api-keys` lands on
+ * `/zh/bootstrap-projects-keys` instead of the English page.
+ *
+ * `legacy-redirects.test.ts` asserts every target is a page that still exists
+ * in every language, and that no retired slug is still published — so this map
+ * cannot silently rot as the manual changes.
+ */
+export const LEGACY_TARGETS: Record = {
+ // Folded into the overview page; no single successor page.
+ "project-map": "/",
+ "console-tour": "/",
+ glossary: "/",
+ "local-development": "/",
+ "locales-themes": "/",
+
+ // Renamed, or folded into a surviving page.
+ "execution-flow": "/execution-model",
+ "install-core": "/install",
+ "configure-core": "/configure",
+ "console-admin": "/admin-api",
+ credentials: "/configure",
+ "api-keys": "/bootstrap-projects-keys",
+ connection: "/configure",
+ verification: "/install",
+
+ // Agent and Session topics.
+ agents: "/agents-and-tools",
+ "create-agent": "/agents-and-tools",
+ "agent-tools": "/agents-and-tools",
+ vaults: "/agents-and-tools",
+ "start-session": "/sessions",
+ conversation: "/sessions",
+
+ // Operations topics.
+ dashboard: "/observability",
+ metrics: "/observability",
+ trace: "/observability",
+ system: "/hosted-providers",
+
+ // Environment, file and provider topics.
+ environment: "/environments-and-files",
+ "environment-templates": "/environments-and-files",
+ files: "/environments-and-files",
+ "sandbox-nodes": "/hosted-providers",
+ "hosted-sandbox-manager": "/hosted-providers",
+ "connect-daemon": "/self-hosted-execution",
+ "connect-executor": "/self-hosted-execution",
+
+ // The public Agent API replaced three separate API pages.
+ "agents-api": "/public-api",
+ "agents-api-sessions": "/public-api",
+ "agents-api-errors": "/public-api",
+}
+
+/**
+ * Resolve a retired path to its successor. `rest` is the path with any locale
+ * prefix already removed; surrounding slashes are ignored, and a live page or
+ * the root resolves to `undefined` so the caller can carry on routing.
+ */
+export function legacyTarget(rest: string): string | undefined {
+ const key = rest.replace(/^\/+/, "").replace(/\/+$/, "")
+ return key ? LEGACY_TARGETS[key] : undefined
+}
\ No newline at end of file
diff --git a/apps/docs/lib/locale-link.test.ts b/apps/docs/lib/locale-link.test.ts
new file mode 100644
index 000000000..e6f8b599b
--- /dev/null
+++ b/apps/docs/lib/locale-link.test.ts
@@ -0,0 +1,69 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+import { i18n } from "./i18n.ts"
+import { prefixLocale } from "./locale-link.ts"
+
+// The rule this file locks down: a *translated* page must never hand the reader
+// back to the default language. `[Configure](/configure)` written in
+// `configure.zh.mdx` has to render as `/zh/configure`.
+test("a translated page keeps prefix-free internal links in its own language", () => {
+ assert.equal(prefixLocale("/configure", "zh", i18n), "/zh/configure")
+ assert.equal(prefixLocale("/configure/", "zh", i18n), "/zh/configure/")
+ assert.equal(prefixLocale("/", "zh", i18n), "/zh")
+ assert.equal(prefixLocale("/#section", "zh", i18n), "/zh#section")
+ assert.equal(prefixLocale("/public-api?tab=2", "zh", i18n), "/zh/public-api?tab=2")
+})
+
+test("the default language stays prefix-free", () => {
+ assert.equal(prefixLocale("/configure", "en", i18n), "/configure")
+ assert.equal(prefixLocale("/", "en", i18n), "/")
+})
+
+test("a link that already carries a locale is left alone", () => {
+ // Hand-written prefixed links must not become `/zh/zh/...`.
+ assert.equal(prefixLocale("/zh/configure", "zh", i18n), "/zh/configure")
+ // A link into another language is deliberate; do not rewrite it.
+ assert.equal(prefixLocale("/en/configure", "zh", i18n), "/en/configure")
+ assert.equal(prefixLocale("/zh", "zh", i18n), "/zh")
+})
+
+test("non-page links are never prefixed", () => {
+ const untouched = [
+ "https://github.com/MiniMax-AI/parsar-core",
+ "http://127.0.0.1:18092/core/v1/admin/summary",
+ "mailto:docs@example.com",
+ "tel:+1234567890",
+ "//example.com/path",
+ "#local-anchor",
+ "./sibling",
+ "../parent",
+ "relative/page",
+ "",
+ ]
+
+ for (const href of untouched) {
+ assert.equal(prefixLocale(href, "zh", i18n), href, `${href} must not be rewritten`)
+ }
+})
+
+test("a path that merely starts with a locale name is still prefixed", () => {
+ // `/environment` must not be mistaken for an `/en`-prefixed link, and
+ // `/zh-tw` is not a locale this site declares.
+ assert.equal(prefixLocale("/environment", "zh", i18n), "/zh/environment")
+ assert.equal(prefixLocale("/zh-tw/guide", "zh", i18n), "/zh/zh-tw/guide")
+})
+
+test("every declared language is recognised as a prefix", () => {
+ for (const lang of i18n.languages) {
+ assert.equal(prefixLocale(`/${lang}/configure`, "zh", i18n), `/${lang}/configure`)
+ }
+})
+
+test("translating the default language into itself is a no-op", () => {
+ // Guards the `lang === defaultLanguage` short circuit: if it ever stops
+ // firing, every English internal link gains an `/en` prefix the router then
+ // redirects away from.
+ for (const href of ["/configure", "/", "/a/b", "#x", "https://example.com"]) {
+ assert.equal(prefixLocale(href, i18n.defaultLanguage, i18n), href)
+ }
+})
\ No newline at end of file
diff --git a/apps/docs/lib/locale-link.ts b/apps/docs/lib/locale-link.ts
new file mode 100644
index 000000000..0cc6cee80
--- /dev/null
+++ b/apps/docs/lib/locale-link.ts
@@ -0,0 +1,53 @@
+/**
+ * The part of the site's i18n configuration that link rewriting depends on.
+ *
+ * Passed in rather than imported so this module stays a pure function with no
+ * runtime dependency, which lets `locale-link.test.ts` load it directly under
+ * `node --test` without a bundler or path-alias resolution.
+ */
+export type LocaleLinkConfig = {
+ languages: readonly string[]
+ defaultLanguage: string
+}
+
+/**
+ * Add the active locale prefix to a root-relative link written in MDX, so that
+ * navigation inside a translated page stays in that language.
+ *
+ * Fumadocs' loader keeps the default language prefix-free
+ * (`hideLocale: "default-locale"`), so `[Configure](/configure)` written in
+ * `configure.zh.mdx` would otherwise render as ``: the
+ * reader leaves the Chinese manual and lands on the English page with no
+ * visible reason. The docs route therefore renders every MDX anchor through
+ * `LocaleLink`, so pages can be written with locale-free internal links.
+ *
+ * Deliberately left untouched:
+ * - absolute URLs with a scheme (`https:`, `mailto:`, `tel:`, …)
+ * - protocol-relative URLs (`//host/path`)
+ * - in-page anchors (`#section`)
+ * - relative paths (`./x`, `../x`)
+ * - paths that already carry a declared locale
+ * - every link on the default language, whose URLs stay prefix-free
+ */
+export function prefixLocale(
+ href: string,
+ lang: string,
+ { languages, defaultLanguage }: LocaleLinkConfig,
+): string {
+ if (!href) return href
+ if (lang === defaultLanguage) return href
+ if (/^[a-z][a-z0-9+.-]*:/i.test(href)) return href
+ if (href.startsWith("//")) return href
+ if (href.startsWith("#")) return href
+ if (!href.startsWith("/")) return href
+
+ const first = href.split("/").filter(Boolean)[0]
+ if (first && languages.includes(first)) return href
+
+ // The root page is served at `/zh`, not `/zh/`, so a link to the root — with
+ // or without an anchor or query — drops the separator rather than keeping it.
+ if (href === "/") return `/${lang}`
+ if (href.startsWith("/#") || href.startsWith("/?")) return `/${lang}${href.slice(1)}`
+
+ return `/${lang}${href}`
+}
\ No newline at end of file
diff --git a/apps/docs/lib/openapi.ts b/apps/docs/lib/openapi.ts
new file mode 100644
index 000000000..c41dbaf49
--- /dev/null
+++ b/apps/docs/lib/openapi.ts
@@ -0,0 +1,45 @@
+// Registers the OpenAPI documents the reference pages render.
+//
+// Generated MDX names its surface by id rather than by file path so the pages
+// stay portable across checkout locations. `scripts/generate-api-reference.mjs`
+// owns the ids and the files; add an entry here when it gains a surface.
+//
+// `getSchemas()` keys its result by the very string passed as `input`, so the
+// lookup below goes through the same `absolute` map that built the input.
+
+import { createOpenAPI } from "fumadocs-openapi/server"
+import path from "node:path"
+
+export const SURFACES = {
+ "public-api": "openapi/public-api.yaml",
+ "core-api": "openapi/core-api.yaml",
+ "runtime-api": "openapi/runtime-api.yaml",
+} as const
+
+export type SurfaceId = keyof typeof SURFACES
+
+const absolute = Object.fromEntries(
+ Object.entries(SURFACES).map(([id, relative]) => [
+ id,
+ path.join(process.cwd(), relative),
+ ]),
+) as Record
+
+export const openapi = createOpenAPI({ input: Object.values(absolute), disablePlayground: true })
+
+/** Reads one surface, by the id the generated MDX refers to. */
+export async function loadSurface(id: string) {
+ const file = absolute[id as SurfaceId]
+ if (!file) {
+ throw new Error(
+ `Unknown API surface "${id}". Known surfaces: ` +
+ `${Object.keys(SURFACES).join(", ")}.`,
+ )
+ }
+ const schemas = await openapi.getSchemas()
+ const document = schemas[file]
+ if (!document) {
+ throw new Error(`API surface "${id}" was not processed from ${file}.`)
+ }
+ return document
+}
diff --git a/apps/docs/lib/site.ts b/apps/docs/lib/site.ts
new file mode 100644
index 000000000..a0a0516a0
--- /dev/null
+++ b/apps/docs/lib/site.ts
@@ -0,0 +1,86 @@
+import { existsSync } from "node:fs"
+import { join } from "node:path"
+import { i18n } from "./i18n"
+import { source } from "./source"
+
+/**
+ * Canonical origin of the published manual, used only to build absolute URLs
+ * for crawler metadata: the per-page canonical link, the hreflang alternates
+ * and the sitemap. Set `DOCS_SITE_ORIGIN` to the real origin before publishing
+ * the manual; the default matches the local review server.
+ */
+export const SITE_ORIGIN = (
+ process.env.DOCS_SITE_ORIGIN ?? "http://127.0.0.1:4001"
+).replace(/\/+$/, "")
+
+/**
+ * Absolute URL of a page from its Fumadocs-relative url (`/configure`,
+ * `/zh/configure`). The home page arrives as `/`, which would serialize with a
+ * trailing slash that the route does not serve; strip it so the sitemap entry
+ * and the page's own canonical link stay byte-identical.
+ */
+export function absoluteDocsUrl(relative: string): string {
+ return `${SITE_ORIGIN}${relative === "/" ? "" : relative}`
+}
+
+/** Content directories, so the check works from the repo root or from the app. */
+function contentRoots(): string[] {
+ return [
+ join(process.cwd(), "content", "docs"),
+ join(process.cwd(), "apps", "docs", "content", "docs"),
+ ]
+}
+
+function pageStem(slugs: string[]): string {
+ return slugs.length === 0 ? "index" : slugs.join("/")
+}
+
+/**
+ * Whether a translated source file exists for a page.
+ *
+ * `source.getPage(slugs, lang)` answers for the default language when a
+ * translation is missing, so it cannot tell "translated" from "fell back".
+ * The file system can.
+ */
+export function hasLocalizedPage(slugs: string[], lang: string): boolean {
+ const stem = pageStem(slugs)
+ const candidates =
+ lang === i18n.defaultLanguage
+ ? [`${stem}.mdx`, `${stem}/index.mdx`]
+ : [`${stem}.${lang}.mdx`, `${stem}/index.${lang}.mdx`]
+
+ return contentRoots().some((root) =>
+ candidates.some((candidate) => existsSync(join(root, candidate))),
+ )
+}
+
+/**
+ * Next.js `metadata.alternates` for a docs page:
+ * - `canonical` points at the default-language version, so search engines
+ * consolidate ranking signals on one URL instead of treating the English
+ * and Chinese pages as duplicates
+ * - `languages` declares every translation under its hreflang code
+ * - `x-default` points at the canonical URL for unmatched audiences
+ *
+ * A page translated into one language still gets a valid block; only what
+ * exists is declared.
+ */
+export function docsAlternates(slugs: string[]): {
+ canonical: string
+ languages: Record
+} {
+ const languages: Record = {}
+
+ for (const lang of i18n.languages) {
+ if (!hasLocalizedPage(slugs, lang)) continue
+ const page = source.getPage(slugs, lang)
+ if (!page) continue
+ languages[lang] = absoluteDocsUrl(page.url)
+ }
+
+ const canonical =
+ languages[i18n.defaultLanguage] ?? Object.values(languages)[0]
+ if (canonical) languages["x-default"] = canonical
+
+ return { canonical: canonical ?? absoluteDocsUrl("/"), languages }
+}
diff --git a/apps/docs/lib/source.ts b/apps/docs/lib/source.ts
new file mode 100644
index 000000000..761a26f9f
--- /dev/null
+++ b/apps/docs/lib/source.ts
@@ -0,0 +1,9 @@
+import { docs } from "@/.source"
+import { loader } from "fumadocs-core/source"
+import { i18n } from "./i18n"
+
+export const source = loader({
+ baseUrl: "/",
+ source: docs.toFumadocsSource(),
+ i18n,
+})
diff --git a/apps/docs/middleware.ts b/apps/docs/middleware.ts
new file mode 100644
index 000000000..bff1a2a5a
--- /dev/null
+++ b/apps/docs/middleware.ts
@@ -0,0 +1,62 @@
+import { NextResponse, type NextRequest } from "next/server"
+import { i18n } from "@/lib/i18n"
+import { legacyTarget } from "@/lib/legacy-redirects"
+
+export default function middleware(request: NextRequest) {
+ const pathname = request.nextUrl.pathname
+ const segments = pathname.split("/").filter(Boolean)
+ const pathLocale = i18n.languages.find((locale) => segments[0] === locale)
+ const rest = `/${segments.slice(pathLocale ? 1 : 0).join("/")}`
+
+ // Retired slugs first, so a reader following a link into the previous manual
+ // reaches the page that replaced it instead of a 404. Handled here rather than
+ // in `next.config.mjs` to keep the locale prefix and the redirect in one hop:
+ // `/en/api-keys` collapses to `/bootstrap-projects-keys` directly, instead of
+ // first stripping the prefix and then redirecting a second time.
+ const legacy = legacyTarget(rest)
+ if (legacy) {
+ const target =
+ pathLocale && pathLocale !== i18n.defaultLanguage
+ ? `/${pathLocale}${legacy === "/" ? "" : legacy}`
+ : legacy
+ const url = new URL(target, request.url)
+ // `new URL(path, base)` drops the base query, which would silently lose
+ // campaign and referral parameters on the redirect.
+ url.search = request.nextUrl.search
+ return NextResponse.redirect(url, 308)
+ }
+
+ // The default language is served prefix-free, so its canonical URL has to
+ // reach the `[lang]` route without a redirect the reader can see.
+ if (!pathLocale) {
+ const url = new URL(request.url)
+ url.pathname = `/${i18n.defaultLanguage}${pathname === "/" ? "" : pathname}`
+ return NextResponse.rewrite(url)
+ }
+
+ if (pathLocale === i18n.defaultLanguage) {
+ // An explicit default-language prefix is not the canonical URL, so this is
+ // permanent: the docs route serves the default language prefix-free.
+ const stripped = pathname.slice(`/${pathLocale}`.length)
+ const target = stripped || "/"
+ const url = new URL(target, request.url)
+ url.search = request.nextUrl.search
+ return NextResponse.redirect(url, 308)
+ }
+
+ return NextResponse.next()
+}
+
+export const config = {
+ // Locale routing must not touch API routes, Next's own assets, or anything
+ // served as a file from `public/`. Without the `images/` exclusion the rewrite
+ // turns `/images/x.png` into `/en/images/x.png`, which matches no route and
+ // breaks every screenshot in the manual; the extension guard covers the rest,
+ // including `favicon.ico`, `icon.png`, `sitemap.xml` and `robots.txt`, which
+ // must stay outside `[lang]` or crawlers get a 404.
+ //
+ // The `api/` and `api$` forms are deliberate rather than a bare `api`: a
+ // prefix match would also exclude `/api-keys`, a retired page this middleware
+ // has to redirect. Same reasoning for `images/` and `images$`.
+ matcher: ["/((?!api/|api$|_next/|images/|images$|.*\\.[a-zA-Z0-9]+$).*)", "/"],
+}
diff --git a/apps/docs/next-env.d.ts b/apps/docs/next-env.d.ts
new file mode 100644
index 000000000..830fb594c
--- /dev/null
+++ b/apps/docs/next-env.d.ts
@@ -0,0 +1,6 @@
+/// param. The inline agent uses the Agent create configuration validation with agent.-prefixed params, reported before the input requirement and saved-Agent lookup; saved configurations with conflicting tools or schema roots reject admission with the same errors, and execution limits keep unsupported_or_invalid_configuration. Hosted network policy rejections return invalid_request_error with a null param. Initial input accepts a string or ordered user-message array. Codex and Claude SDK on none and qualified openai_hosted also accept inline PNG/JPEG image content; other image combinations and remote URLs are unsupported. None initial input atomically starts a Turn; self_hosted initial input is reserved while returning its Environment connection target, with execution deferred to native readiness and Session failure on initial timeout. Initial input is required for none and for streamed creation outside self_hosted. Omitted/null input remains valid for non-streaming hosted and self_hosted creation. With stream=true, returns live Session events starting with the committed creation snapshot and closes right after the first agent.session.idle recorded when a Turn ends or an input reservation stops being pending, or any agent.session.failed, without sending later events. A creation that admitted nothing closes after the snapshot; a settlement that records no event closes after events up to the cursor read with a settled Session projection. Required actions keep it open; disconnect does not cancel execution. The GET events stream remains live-only. New Sessions retain their authenticated creator; all creation retries require the same typed subject, including across key rotation. Saved-Agent retries and inline requests using Vault attachments or credential references retain caller intent independently of later resource changes; new hosted inline requests also freeze caller intent before deployment defaults resolve; unrelated non-hosted inline retries preserve resolved/default equivalences, and their resolved hash leaves out any deployment default. Provider keys enter retry hashes only as fingerprints keyed by the credential key. Unknown historical creators reject retries; known creators without recorded intent retain resolved-snapshot retry rules. These conflict policies are local and not verified hosted parity. A same-key stream=true retry of an existing creation returns 201 with no events and closes at once; retry with stream=false or use the GET events stream to recover. Claude SDK on none and Core-managed Docker openai_hosted supports qualified object-root json_schema output with medium verbosity, single-Agent execution and ordinary functions. Hosted execution reuses native workspace tools and Files/Artifacts; Skills, Plugins, capability directories, HTTP MCP, Subagent and tool_search combinations remain unqualified, including inherited template contents. Other non-text initial input remains unsupported. Basic Codex and Claude SDK openai_hosted creation requires an explicitly configured managed provider. The Claude workspace profile supports non-deferred function tools with text or successful inline PNG/JPEG results alongside native workspace tools; HTTP MCP remains unsupported. Idle Sessions provision automatically; initial provisioning has no caller connection action. Network defaults to enabled; disabled and restricted exact ASCII hostnames are supported. Restricted policy requires 1–100 allowed domains. Unsupported hostname forms and startup installations are rejected. Confidential env, system/npm/Python packages and ordered setup commands use the shared initialization lifecycle; requested network applies after setup. Initial inline and tenant-owned file_id files freeze encrypted bytes before provisioning, then install through the common Core lifecycle before native execution or live Files access. With a template reference, omitted/null files, env, packages and setup_commands inherit. Non-null files and command lists replace; env overlays by key; each package manager inherits on omission/null and otherwise replaces its list. Empty lists clear their selected field. Tenant-owned environment_template_id references inherit omitted/null network and allow only narrowing overrides. Inline hosted network:null retains the enabled default; updating a Template with network:null resets its saved policy to enabled. Core freezes effective configuration; template updates/deletion do not alter Session snapshots or same-intent creation retries. Inline or tenant-owned skill_reference Skills share initialization. Templates preserve default/latest/explicit selectors; Session creation freezes concrete metadata and encrypted content atomically. Skill, Plugin and capability-directory list omission/null inherit; a non-null list replaces, including empty-list clearing. Omitted/null Skill version selectors resolve the default version. Source deletion/default updates cannot change committed Session Skill contents. Deferred function discovery uses type-only tool_search and per-function defer_loading in the qualified single-agent Claude environment:none function profile, including qualified inline image messages and text results. Explicit web_search mode disabled and programmatic_tool_calling enabled false use frozen common Runtime controls. Enabled forms, including those saved on an Agent, remain unqualified and reject before any write unless the Session replaces tools. Omitted programmatic configuration preserves native behavior, a documented difference from the official default-on behavior. Other combinations remain unqualified; see the operation coverage.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Creation retry key, up to 128 bytes
+ in: header
+ name: Idempotency-Key
+ responses:
+ '201':
+ description: Created
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Session'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.Session'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '409':
+ description: Conflict
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Create an execution Session
+ tags:
+ - Sessions
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.CreateSessionRequest'
+ description: Session configuration
+ required: true
+ /agents/sessions/{session_id}:
+ delete:
+ description: Removes a durably idle or failed Session and its history from the public API. A Session whose root Turn is queued, in progress or waiting (including required actions) or whose input reservation is pending returns 409 conflict_error and is left unchanged; cancel it and wait until it is idle before deleting. Subagent child Turns and pending Environment file writes are not checked and do not block deletion. Repeating the deletion of the caller's own deleted Session returns the same confirmation; missing and foreign Sessions return 404. Internal records and native history are retained pending separate physical cleanup; overlapping stream timing remains unverified.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SessionDeleted'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '409':
+ description: Conflict
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Delete an execution Session
+ tags:
+ - Sessions
+ get:
+ description: Returns supported none, self_hosted and basic openai_hosted Session environments. Self-hosted pending input can require a caller connection before a Turn exists. Hosted initial provisioning remains idle until a Turn starts; connection observations are not native execution readiness.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Session'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve an execution Session
+ tags:
+ - Sessions
+ post:
+ description: The metadata field is required in an update body. Send null or {} to clear it, or supply an object to replace all pairs. Up to 16 string pairs, with keys at most 64 characters and values at most 512 characters; violations and non-string values return invalid_request_error with a metadata or metadata. param. U+0000 is rejected as a local storage limit. Malformed, missing and foreign Session IDs share the not-found response. Execution configuration and activity are unchanged. Returns the same safe Environment and pending-input activity projection as Session retrieval.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Session'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Update execution Session metadata
+ tags:
+ - Sessions
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.UpdateSessionRequest'
+ description: Session metadata
+ required: true
+ /agents/sessions/{session_id}/artifacts:
+ get:
+ description: Lists published outputs independently of Environment availability. Sorting uses publication time and ID. A later Turn publishes a path again only when it is new, its bytes changed, or no Artifact remains for it. A malformed environment_id matches nothing. An after value that is not an Artifact of this Session, including a malformed one, returns 400 invalid_request_error with the message "after is not a valid artifact ID". The local default page size is 20; exact upstream defaults remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Producing Environment ID; an unknown or malformed ID returns an empty page
+ in: query
+ name: environment_id
+ - schema:
+ type: string
+ description: Last immutable artifact ID
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 100
+ minimum: 1
+ description: Page size
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Publication order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SessionArtifactList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List immutable Session artifacts
+ tags:
+ - Artifacts
+ /agents/sessions/{session_id}/artifacts/{artifact_id}:
+ delete:
+ description: Deletes the published copy without modifying its original workspace file. Already admitted content reads may finish; later reads reject.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Artifact ID
+ in: path
+ name: artifact_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SessionArtifactDeleted'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Delete a published artifact
+ tags:
+ - Artifacts
+ get:
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Artifact ID
+ in: path
+ name: artifact_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SessionArtifact'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve immutable artifact metadata
+ tags:
+ - Artifacts
+ /agents/sessions/{session_id}/artifacts/{artifact_id}/content:
+ get:
+ description: Streams stored bytes after tenant and Session authorization, including after Environment expiration. Exact upstream headers and Range behavior remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Artifact ID
+ in: path
+ name: artifact_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/octet-stream:
+ schema:
+ type: string
+ format: binary
+ '400':
+ description: Bad Request
+ content:
+ application/octet-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/octet-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/octet-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/octet-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/octet-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Download immutable artifact bytes
+ tags:
+ - Artifacts
+ /agents/sessions/{session_id}/events:
+ get:
+ description: Live-only events, including command output fragments from capable Codex peers as agent.output.command_execution_output.delta with stable Item/output indexes. Native text conversion and output quotas apply; completion snapshots remain authoritative. Reconnect through Session, Turn and Items reads; missed events are not replayed. A lagging stream closes with an error when its bounded buffer is exceeded. When a hosted Environment fails to provision, the stream sends agent.session.environment.failed, an error event (environment_error/sandbox_error with the safe step and exit-status reason, never command output) and agent.session.failed, then ends. Session activity includes immutable pending-input connection actions before Turn creation; self_hosted environments use the same safe output as Session retrieval.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.SessionEvent'
+ '400':
+ description: Bad Request
+ content:
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ text/event-stream:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Stream live Session events
+ tags:
+ - Events
+ post:
+ description: An empty events array is a resource-authorized no-op; it creates no execution retry identity, Turn, Item or input receipt. For environment none, atomically accepts text messages, cancellation and function results. Messages steer active work or start a queued Turn. The supported self_hosted profile accepts text-only messages; qualified Codex and Claude SDK openai_hosted profiles also accept inline PNG/JPEG. Under the Session lock, matching retries retain their original target; new active messages append to the current Turn, while idle messages reserve work and wait up to the original five-minute connection/admission deadline. Return 202 only after durable admission, without claiming native application; active messages create no Turn or reservation. Cancellation-only prepared-environment batches use existing durable cancellation admission and return 202 without waiting for native exit; a new cancellation conflicts while a pre-Turn reservation is pending. Homogeneous tool_result-only prepared-environment batches reuse existing scoped result admission and application receipts without creating a Turn or bypassing a pending reservation. Mixed prepared-environment batches remain unsupported. HTTP expiry/cancellation use local 409 environment_input_expired/environment_input_cancelled errors. New input on a Session whose hosted Environment failed to provision returns the observed 409 conflict_error "the hosted environment failed to provision"; input already waiting when it fails and expired Environments keep the local 409 environment_unavailable. Input the Session cannot accept in its current state, such as a result after cancellation or a batch while earlier input is pending, and a result that differs from the call's saved result return 409 with type and code conflict_error; reusing an Idempotency-Key with a different batch returns the local 409 idempotency_conflict. Inside an owned Session, a result for an unknown call or for a call of another Turn returns 400 invalid_request_error and changes nothing; missing and foreign Sessions return 404. Losing execution ownership returns 503. The response write deadline accommodates the admission window for either prepared Environment, independently of new-hosted-admission and executor URL settings. Disconnecting the waiting HTTP request does not cancel retained work or restart its deadline. Retry keys identify the whole ordered batch. Function output accepts text or ordered text/image parts subject to engine support; Claude SDK accepts text results and, on none and qualified openai_hosted, successful inline PNG/JPEG results, preserving ordered content; error images and remote references reject before admission. Native image resizing may change bytes. Runtime image-result support is checked only for image-bearing delivery. Codex and Claude SDK on none and qualified openai_hosted accept ordered inline PNG/JPEG image messages. Self-hosted profiles and other engines remain text-only; remote image URLs are unsupported. Image references are retained unchanged without service-side downloads.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Retry key, up to 128 bytes
+ in: header
+ name: Idempotency-Key
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ responses:
+ '202':
+ description: Accepted
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '409':
+ description: Conflict
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Submit Session input events
+ tags:
+ - Sessions
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.CreateEventsRequest'
+ description: Ordered input events
+ required: true
+ /agents/sessions/{session_id}/items:
+ get:
+ description: Returns supported message and tool Items in first-observation order. Native engine fields are projected explicitly; unfinished Items on terminal Turns are incomplete. Cursors are Items of the same tenant and Session. Any other after value, including a malformed one, returns 400 invalid_request_error with the message "Invalid session item ID in `after`".
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Last Item ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ minimum: 0
+ description: Page size; 0 is treated as 1 and values above 100 as 100
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ItemList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List persisted execution Items
+ tags:
+ - Items
+ /agents/sessions/{session_id}/subagents:
+ get:
+ description: Includes nested and closed Subagents. Cursors are Subagents of the same tenant and Session. Any other after value, including a malformed one, returns 400 invalid_request_error with the message "Invalid resource ID in `after`". A limit outside 1–100 is rejected.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Last Subagent ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 100
+ minimum: 1
+ description: Page size
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Resource order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SubagentList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List Session Subagents
+ tags:
+ - Subagents
+ /agents/sessions/{session_id}/subagents/{subagent_id}:
+ get:
+ description: Returns this Session's persisted Subagent. Active includes idle between Turns. Resuming preserves opened_at and clears closed_at. Unknown or inaccessible parent scopes return not found.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Subagent ID
+ in: path
+ name: subagent_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Subagent'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve a Session Subagent
+ tags:
+ - Subagents
+ /agents/sessions/{session_id}/subagents/{subagent_id}/items:
+ get:
+ description: Returns only this Subagent's own Items across all its Turns, not its descendants' Items. Cursors are Items of the same tenant, Session and Subagent. Any other after value, including a malformed one, returns 400 invalid_request_error with the message "Invalid session item ID in `after`".
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Subagent ID
+ in: path
+ name: subagent_id
+ required: true
+ - schema:
+ type: string
+ description: Last Item ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ minimum: 0
+ description: Page size; 0 is treated as 1 and values above 100 as 100
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Resource order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ItemList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List a Subagent's Items
+ tags:
+ - Subagents
+ /agents/sessions/{session_id}/subagents/{subagent_id}/turns:
+ get:
+ description: Includes this Subagent's Turns after resume, with the Session's Agent ID as agent_id. Cursors are Turns of the same tenant, Session and Subagent. Any other after value, including a malformed one, returns 400 invalid_request_error with the message "Invalid resource ID in `after`". Missing recorded usage remains null. A limit outside 1–100 is rejected.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Subagent ID
+ in: path
+ name: subagent_id
+ required: true
+ - schema:
+ type: string
+ description: Last Turn ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 100
+ minimum: 1
+ description: Page size
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.TurnList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List a Subagent's Turns
+ tags:
+ - Subagents
+ /agents/sessions/{session_id}/subagents/{subagent_id}/turns/{turn_id}:
+ get:
+ description: Returns a Turn owned by this Subagent. Its agent_id is the Session's Agent ID and its subagent_id identifies the Subagent. Session Turn routes do not return child Turns. Unknown or inaccessible parent scopes return not found.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Subagent ID
+ in: path
+ name: subagent_id
+ required: true
+ - schema:
+ type: string
+ description: Turn ID
+ in: path
+ name: turn_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Turn'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve a Subagent Turn
+ tags:
+ - Subagents
+ /agents/sessions/{session_id}/subagents/{subagent_id}/turns/{turn_id}/items:
+ get:
+ description: Returns Items owned by this exact Subagent Turn. Cursors are Items of the same tenant, Session, Subagent and Turn. Any other after value, including a malformed one, returns 400 invalid_request_error with the message "Invalid session item ID in `after`".
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Subagent ID
+ in: path
+ name: subagent_id
+ required: true
+ - schema:
+ type: string
+ description: Turn ID
+ in: path
+ name: turn_id
+ required: true
+ - schema:
+ type: string
+ description: Last Item ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ minimum: 0
+ description: Page size; 0 is treated as 1 and values above 100 as 100
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Resource order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ItemList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List a Subagent Turn's Items
+ tags:
+ - Subagents
+ /agents/sessions/{session_id}/turns:
+ get:
+ description: Returns the Session's root Turns in creation order; Subagent Turns are listed through the Subagent Turn routes. The cursor belongs to the same Session and tenant; any other after value, including a malformed one or a Subagent Turn ID, returns not found. Usage contains the latest recorded complete token breakdown; missing measurements remain null.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Last Turn ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 100
+ minimum: 1
+ description: Page size
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.TurnList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List execution Turns
+ tags:
+ - Turns
+ /agents/sessions/{session_id}/turns/{turn_id}:
+ get:
+ description: Returns a root Turn of this Session. A Subagent Turn ID returns the same not found error as a missing Turn; read it through the Subagent Turn routes.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Session ID
+ in: path
+ name: session_id
+ required: true
+ - schema:
+ type: string
+ description: Turn ID
+ in: path
+ name: turn_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Turn'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve an execution Turn
+ tags:
+ - Turns
+ /files:
+ get:
+ description: Lists project-owned Files without reading their bodies. The limit defaults to 10000 and must be 1–10000. Equal creation times use ID ordering. Purpose validation precedes cursor lookup; current storage contains only user_data. An explicit empty purpose is treated as omitted. Repeated purpose values remain rejected. Hosted positive filtering, default order and concurrent-page behavior remain unverified. No Beta header is required.
+ parameters:
+ - schema:
+ type: string
+ description: Last File ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 10000
+ minimum: 1
+ description: Maximum page size, 1–10000
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ - schema:
+ type: string
+ description: Only return Files with this purpose
+ in: query
+ name: purpose
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SourceFileList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List source files
+ tags:
+ - Files
+ post:
+ description: Accepts one multipart file and purpose=user_data in either order, with a private 512 MiB content limit and 64 KiB envelope allowance. Commits only after the entire request validates. The source is project-owned, independent of Sessions and workspace copies. No Beta header is required. Other purposes, expires_after, listing, resumable Uploads, quotas/rate-limit and complete hosted error/status parity remain unsupported or unverified.
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SourceFile'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Upload a source file
+ tags:
+ - Files
+ requestBody:
+ content:
+ application/x-www-form-urlencoded:
+ schema:
+ type: object
+ properties:
+ file:
+ type: string
+ description: Source bytes
+ purpose:
+ type: string
+ description: user_data
+ required:
+ - file
+ - purpose
+ /files/{file_id}:
+ delete:
+ description: Atomically deletes project-owned metadata and stored bytes. Already-admitted reads or copies may finish. Workspace copies remain independent. Historical WAL/backups are not erased. No Beta header is required; exact hosted concurrent deletion/error semantics remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: Source file ID
+ in: path
+ name: file_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SourceFileDeleted'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Delete a source file
+ tags:
+ - Files
+ get:
+ description: Returns immutable project-owned user_data file metadata. No Beta header is required. Other purposes, expiration and full hosted status/error semantics remain unimplemented or unverified.
+ parameters:
+ - schema:
+ type: string
+ description: Source file ID
+ in: path
+ name: file_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SourceFile'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve source file metadata
+ tags:
+ - Files
+ /files/{file_id}/content:
+ get:
+ description: Resolves project-owned File metadata before enforcing download policy. Public download of user_data Files returns 400; missing and foreign Files return the same 404. Internal initial-file and workspace copies remain available. No Beta header is required.
+ parameters:
+ - schema:
+ type: string
+ description: Source file ID
+ in: path
+ name: file_id
+ required: true
+ responses:
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Download source file bytes
+ tags:
+ - Files
+ /skills:
+ get:
+ description: Lists tenant-owned metadata in timestamp order. Default page size 20, maximum 100. Limit 0 returns an empty page whose has_more reports whether any Skill follows the cursor; exact hosted defaults remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: Skill resource cursor
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 100
+ minimum: 0
+ description: Page size; 0 returns an empty page
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillList'
+ security:
+ - BearerAuth: []
+ summary: List Skills
+ tags:
+ - Skills
+ post:
+ description: Accepts one ZIP in files or a directory in files[]. Applies the qualified portable Skill bundle profile. No Beta header is required; full hosted upload limits and activation extensions are not qualified.
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Skill'
+ security:
+ - BearerAuth: []
+ summary: Upload a Skill
+ tags:
+ - Skills
+ requestBody:
+ content:
+ application/x-www-form-urlencoded:
+ schema:
+ type: object
+ properties:
+ files:
+ type: string
+ description: Skill ZIP or directory files
+ required:
+ - files
+ /skills/{skill_id}:
+ delete:
+ description: Deletes tenant-owned source bundles. Existing Session installation snapshots remain independent.
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillDeleted'
+ security:
+ - BearerAuth: []
+ summary: Delete a Skill and its versions
+ tags:
+ - Skills
+ get:
+ description: Returns tenant-owned metadata without decrypting contents or starting Runtime. No Beta header is required.
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Skill'
+ security:
+ - BearerAuth: []
+ summary: Retrieve Skill metadata
+ tags:
+ - Skills
+ post:
+ description: Changes only the tenant-owned default pointer; immutable versions and existing Session snapshots remain unchanged.
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Skill'
+ security:
+ - BearerAuth: []
+ summary: Update the default Skill version
+ tags:
+ - Skills
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillUpdateRequest'
+ description: Default version
+ required: true
+ /skills/{skill_id}/content:
+ get:
+ description: Downloads an authorized ZIP using the default pointer when no concrete version is supplied. Exact upstream unversioned selection, content headers and range semantics remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/octet-stream:
+ schema:
+ type: string
+ format: binary
+ security:
+ - BearerAuth: []
+ summary: Download Skill content
+ tags:
+ - Skills
+ /skills/{skill_id}/versions:
+ get:
+ description: Orders by version number; after identifies a version resource, not a version number. An after value that does not begin with skillver, or a version of another Skill, returns 400 invalid_value with param after; a missing version returns not found. No contents are decrypted. Limit 0 returns an empty page whose has_more reports whether any version follows the cursor.
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ - schema:
+ type: string
+ description: Version resource cursor
+ in: query
+ name: after
+ - schema:
+ type: integer
+ maximum: 100
+ minimum: 0
+ description: Page size; 0 returns an empty page
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Version order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillVersionList'
+ security:
+ - BearerAuth: []
+ summary: List Skill versions
+ tags:
+ - Skills
+ post:
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillVersion'
+ security:
+ - BearerAuth: []
+ summary: Upload an immutable Skill version
+ tags:
+ - Skills
+ requestBody:
+ content:
+ application/x-www-form-urlencoded:
+ schema:
+ type: object
+ properties:
+ files:
+ type: string
+ description: Skill ZIP or directory files
+ default:
+ type: boolean
+ description: Set as default
+ required:
+ - files
+ /skills/{skill_id}/versions/{version}:
+ delete:
+ description: Deleting the only remaining version also deletes the Skill; existing Session installation snapshots remain independent. The default version cannot be deleted while other versions remain. Version numbers are never reused.
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ - schema:
+ type: string
+ description: Concrete version number
+ in: path
+ name: version
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillVersionDeleted'
+ security:
+ - BearerAuth: []
+ summary: Delete a Skill version
+ tags:
+ - Skills
+ get:
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ - schema:
+ type: string
+ description: Concrete version number
+ in: path
+ name: version
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.SkillVersion'
+ security:
+ - BearerAuth: []
+ summary: Retrieve Skill version metadata
+ tags:
+ - Skills
+ /skills/{skill_id}/versions/{version}/content:
+ get:
+ parameters:
+ - schema:
+ type: string
+ description: Skill ID
+ in: path
+ name: skill_id
+ required: true
+ - schema:
+ type: string
+ description: Concrete version number
+ in: path
+ name: version
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/octet-stream:
+ schema:
+ type: string
+ format: binary
+ security:
+ - BearerAuth: []
+ summary: Download immutable Skill version content
+ tags:
+ - Skills
+ /vaults:
+ get:
+ description: Lists project-owned Vaults independently of execution. An unknown, malformed or foreign after cursor returns not found. Includes active and archived records by default. Status accepts a scalar, the SDK's status[] array or both, filtering by their union; a repeated scalar is rejected. Limits default to 20 and clamp to 1–100. Equal creation times use ID ordering; exact hosted errors and concurrent-page behavior remain unverified. Archive/delete lifecycle is not implemented.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Last Vault ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ description: Requested page size, clamped to 1–100
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ - schema:
+ type: string
+ enum:
+ - active
+ - archived
+ description: Scalar status filter
+ in: query
+ name: status
+ - schema:
+ type: array
+ items:
+ enum:
+ - active
+ - archived
+ type: string
+ style: form
+ explode: true
+ description: Array status filter; combined with status as a union
+ in: query
+ name: status[]
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.VaultList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List Vaults
+ tags:
+ - Vaults
+ post:
+ description: Creates a project-owned Vault independently of execution. Omitted name stays null; a supplied string is trimmed and must contain 1–256 UTF-8 bytes. Explicit null name is invalid. Omitted/null metadata becomes an empty object; non-string values return invalid_request_error with a metadata. param. Metadata has a local 64 KiB encoded storage bound. U+0000 in stored strings is rejected as a local storage limit. Credentials, Session binding and hosted error/retry parity remain incomplete.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ responses:
+ '201':
+ description: Created
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Vault'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Create a Vault
+ tags:
+ - Vaults
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.CreateVaultRequest'
+ description: Vault name and metadata
+ required: true
+ /vaults/{vault_id}:
+ delete:
+ description: Atomically removes the authenticated project's Vault and all its stored Credentials without an encryption key, decryption or external requests. Existing Session snapshots, history and recorded retries retain their frozen identities; subsequent credential lookups fail without reselection or anonymous fallback. Already-resolved tokens and running Sessions are not revoked or cancelled. Missing/repeated deletion locally returns 404. Exact hosted archive, post-delete visibility and concurrent/error semantics remain unverified; physical erasure from native history, WAL or backups is not established.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.VaultDeleted'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Delete a Vault and all its Credentials
+ tags:
+ - Vaults
+ get:
+ description: Reads a Vault owned by the authenticated project without resolving credentials, Sessions or execution devices. Missing and foreign IDs share the same not-found response; exact hosted error semantics remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Vault'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve a Vault
+ tags:
+ - Vaults
+ /vaults/{vault_id}/credentials:
+ get:
+ description: Lists only metadata from the authenticated project's requested Vault, without decryption or execution. An unknown, malformed or foreign after cursor, including another Vault's Credential, returns not found. Includes active and archived Credentials by default, independently of Vault status. Status accepts a scalar, the SDK status[] array or both, filtering by their union; a repeated scalar is rejected. Limits default to 20 and clamp to 1–100. Equal creation times use ID ordering. Hosted errors, concurrent-page behavior and archive/delete lifecycle remain unverified or unimplemented.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ - schema:
+ type: string
+ description: Last Credential ID from the previous page
+ in: query
+ name: after
+ - schema:
+ type: integer
+ description: Requested page size, clamped to 1–100
+ in: query
+ name: limit
+ - schema:
+ type: string
+ enum:
+ - asc
+ - desc
+ description: Creation order; omit for descending, explicit empty values are invalid
+ in: query
+ name: order
+ - schema:
+ type: string
+ enum:
+ - active
+ - archived
+ description: Scalar status filter
+ in: query
+ name: status
+ - schema:
+ type: array
+ items:
+ enum:
+ - active
+ - archived
+ type: string
+ style: form
+ explode: true
+ description: Array status filter; combined with status as a union
+ in: query
+ name: status[]
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.CredentialList'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: List safe Vault Credential metadata
+ tags:
+ - Credentials
+ post:
+ description: Stores static_bearer or mcp_oauth secrets as execution-owned authenticated ciphertext without contacting any endpoint. Static bearer and OAuth access tokens must be nonempty strings; their bytes are preserved. OAuth accepts a required access token, nullable RFC3339 expiry and optional refresh configuration with none, client_secret_basic or client_secret_post authentication. Required name is trimmed to 1–256 UTF-8 bytes. Credential and token endpoints require HTTPS without userinfo or fragments. Responses contain safe metadata only, including explicit nullable OAuth expiry, refresh, resource and scope. Missing encryption configuration returns local 503. External authorization and provider revocation remain caller responsibilities; exact hosted error/default semantics remain unverified.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ responses:
+ '201':
+ description: Created
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Credential'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Create a Vault Credential
+ tags:
+ - Credentials
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.CreateCredentialRequest'
+ description: Write-only credential authentication union
+ required: true
+ /vaults/{vault_id}/credentials/{credential_id}:
+ delete:
+ description: Removes one Credential and its encrypted token within the authenticated project and owning Vault, without an encryption key or secret decryption. Subsequent metadata reads, updates and dispatch lookups cannot use it. Existing Session snapshots and history retain their frozen identities; already-resolved tokens and running Sessions are not revoked or cancelled. This local policy removes the row rather than defining archived lifecycle; missing/repeated deletion returns 404. Exact hosted archive, post-delete visibility and retry/error semantics remain unverified. Provider revocation and physical erasure from native history, WAL or backups are separate concerns.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ - schema:
+ type: string
+ description: Credential ID
+ in: path
+ name: credential_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.CredentialDeleted'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Delete a Vault Credential
+ tags:
+ - Credentials
+ get:
+ description: Reads only non-secret metadata scoped to the authenticated project and owning Vault. No token decryption, network request or execution is performed. Unknown, foreign, wrong-Vault and malformed IDs use the same local not-found response; hosted error parity remains unverified.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ - schema:
+ type: string
+ description: Credential ID
+ in: path
+ name: credential_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Credential'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Retrieve safe Vault Credential metadata
+ tags:
+ - Credentials
+ post:
+ description: Explicitly empty static bearer or OAuth access tokens and OAuth patches without a mutable field are rejected before storage. Omitted OAuth access tokens preserve the existing grant when expiry or refresh fields change. Updates the existing static_bearer or mcp_oauth authentication method without network requests. OAuth access_token omission/null retains the token; a new token clears omitted expiry, explicit null clears expiry, and other omitted fields remain unchanged. OAuth refresh patches cannot add configuration or change client, endpoint, resource or authentication method; nullable token/client-secret values retain stored secrets while explicit null scope clears scope. Whole-null refresh and token_endpoint_auth retain existing configuration under local policy. Identity, destination, creation time and Session bindings remain unchanged. Responses expose safe metadata only. Already-dispatched work is not revoked; provider revocation, storage-key rotation and exact hosted concurrent-update/error semantics remain separate.
+ parameters:
+ - schema:
+ type: string
+ description: agents=v1
+ in: header
+ name: OpenAI-Beta
+ required: true
+ - schema:
+ type: string
+ description: Vault ID
+ in: path
+ name: vault_id
+ required: true
+ - schema:
+ type: string
+ description: Credential ID
+ in: path
+ name: credential_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.Credential'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '413':
+ description: Request Entity Too Large
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - BearerAuth: []
+ summary: Replace Vault Credential authentication secrets
+ tags:
+ - Credentials
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.UpdateCredentialRequest'
+ description: Write-only credential authentication replacement union
+ required: true
+schemes:
+ - http
+ - https
+openapi: 3.1.0
+servers:
+ - url: https://core.example.com/v1
+ description: Documentation placeholder; substitute your Core public origin.
+components:
+ schemas:
+ v1.APIError:
+ properties:
+ code:
+ anyOf:
+ - type: string
+ - type: 'null'
+ message:
+ type: string
+ param:
+ anyOf:
+ - type: string
+ - type: 'null'
+ type:
+ type: string
+ required:
+ - message
+ - type
+ type: object
+ v1.Agent:
+ properties:
+ id:
+ type: string
+ instructions:
+ anyOf:
+ - type: string
+ - type: 'null'
+ model:
+ type: string
+ multi_agent:
+ $ref: '#/components/schemas/v1.MultiAgentConfig'
+ name:
+ anyOf:
+ - type: string
+ - type: 'null'
+ reasoning:
+ $ref: '#/components/schemas/v1.Reasoning'
+ service_tier:
+ enum:
+ - auto
+ type: string
+ text:
+ $ref: '#/components/schemas/v1.TextConfig'
+ tools:
+ items:
+ type: object
+ type: array
+ x_agents_core:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.AgentsCore'
+ - type: 'null'
+ required:
+ - id
+ - model
+ - multi_agent
+ - reasoning
+ - service_tier
+ - text
+ - tools
+ type: object
+ v1.AgentContent:
+ properties:
+ encrypted_content:
+ type: string
+ text:
+ type: string
+ type:
+ enum:
+ - output_text
+ - encrypted_content
+ type: string
+ required:
+ - type
+ type: object
+ v1.AgentDeleted:
+ properties:
+ deleted:
+ enum:
+ - true
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - agent.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.AgentsCore:
+ properties:
+ harness:
+ enum:
+ - codex
+ - claude_sdk
+ - mcode
+ type: string
+ required:
+ - harness
+ type: object
+ v1.CreateAgentRequest:
+ properties:
+ instructions:
+ anyOf:
+ - type: string
+ - type: 'null'
+ metadata:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ model:
+ type: string
+ multi_agent:
+ anyOf:
+ - type: object
+ - type: 'null'
+ name:
+ anyOf:
+ - maxLength: 128
+ type: string
+ - type: 'null'
+ reasoning:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.Reasoning'
+ - type: 'null'
+ service_tier:
+ anyOf:
+ - enum:
+ - auto
+ - default
+ - flex
+ - priority
+ - fast
+ type: string
+ - type: 'null'
+ text:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.SavedAgentTextInput'
+ - type: 'null'
+ tools:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ x_agents_core:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.SavedAgentCoreInput'
+ - type: 'null'
+ required:
+ - model
+ type: object
+ v1.CreateCredentialRequest:
+ properties:
+ auth:
+ $ref: '#/components/schemas/v1.CredentialAuthInput'
+ name:
+ type: string
+ required:
+ - auth
+ - name
+ type: object
+ v1.CreateEventsRequest:
+ properties:
+ events:
+ items:
+ $ref: '#/components/schemas/v1.SessionInput'
+ type: array
+ required:
+ - events
+ type: object
+ v1.CreateSessionRequest:
+ properties:
+ agent:
+ $ref: '#/components/schemas/v1.InlineAgent'
+ agent_id:
+ type: string
+ environment:
+ $ref: '#/components/schemas/v1.Environment'
+ input:
+ anyOf:
+ - {}
+ - type: 'null'
+ description: |-
+ Input accepts a string or an ordered array of user InputMessage objects.
+ Required for none and streamed creation outside self_hosted; otherwise optional.
+ metadata:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ stream:
+ default: false
+ type: boolean
+ vault_ids:
+ items:
+ type: string
+ type: array
+ x_agents_core:
+ $ref: '#/components/schemas/v1.SessionExecutionInput'
+ required:
+ - environment
+ type: object
+ v1.CreateVaultRequest:
+ properties:
+ metadata:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ name:
+ type: string
+ type: object
+ v1.Credential:
+ properties:
+ auth:
+ $ref: '#/components/schemas/v1.CredentialAuth'
+ created_at:
+ type: integer
+ id:
+ type: string
+ name:
+ type: string
+ object:
+ enum:
+ - vault.credential
+ type: string
+ updated_at:
+ type: integer
+ vault_id:
+ type: string
+ required:
+ - auth
+ - created_at
+ - id
+ - name
+ - object
+ - updated_at
+ - vault_id
+ type: object
+ v1.CredentialAuth:
+ properties:
+ expires_at:
+ anyOf:
+ - type: string
+ - type: 'null'
+ mcp_server_url:
+ type: string
+ refresh:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.OAuthCredentialRefresh'
+ - type: 'null'
+ type:
+ enum:
+ - static_bearer
+ - mcp_oauth
+ type: string
+ required:
+ - mcp_server_url
+ - type
+ type: object
+ v1.CredentialAuthInput:
+ properties:
+ access_token:
+ minLength: 1
+ type: string
+ expires_at:
+ anyOf:
+ - type: string
+ - type: 'null'
+ mcp_server_url:
+ type: string
+ refresh:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.OAuthCredentialRefreshInput'
+ - type: 'null'
+ token:
+ minLength: 1
+ type: string
+ type:
+ enum:
+ - static_bearer
+ - mcp_oauth
+ type: string
+ required:
+ - mcp_server_url
+ - type
+ type: object
+ v1.CredentialAuthReplacement:
+ properties:
+ access_token:
+ anyOf:
+ - minLength: 1
+ type: string
+ - type: 'null'
+ expires_at:
+ anyOf:
+ - type: string
+ - type: 'null'
+ refresh:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.OAuthCredentialRefreshReplacement'
+ - type: 'null'
+ token:
+ minLength: 1
+ type: string
+ type:
+ enum:
+ - static_bearer
+ - mcp_oauth
+ type: string
+ required:
+ - type
+ type: object
+ v1.CredentialDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - vault.credential.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.CredentialList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Credential'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.Environment:
+ properties:
+ capability_directories:
+ anyOf:
+ - items:
+ type: string
+ type: array
+ - type: 'null'
+ env:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ environment_template_id:
+ type: string
+ files:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ network:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.EnvironmentNetworkInput'
+ - type: 'null'
+ packages:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.EnvironmentPackages'
+ - type: 'null'
+ plugins:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ setup_commands:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ skills:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ type:
+ enum:
+ - none
+ - self_hosted
+ - openai_hosted
+ type: string
+ workspace_directory:
+ type: string
+ required:
+ - type
+ type: object
+ v1.EnvironmentFile:
+ properties:
+ environment_id:
+ type: string
+ object:
+ enum:
+ - agent.environment.file
+ type: string
+ path:
+ type: string
+ size_bytes:
+ minimum: 0
+ type: integer
+ required:
+ - environment_id
+ - object
+ - path
+ - size_bytes
+ type: object
+ v1.EnvironmentFileCreateRequest:
+ properties:
+ data:
+ type: string
+ file_id:
+ type: string
+ path:
+ type: string
+ type:
+ enum:
+ - inline
+ - file_id
+ type: string
+ required:
+ - path
+ - type
+ type: object
+ v1.EnvironmentFileList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.EnvironmentFile'
+ type: array
+ has_more:
+ type: boolean
+ next:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - page
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.EnvironmentInfo:
+ properties:
+ files:
+ items:
+ type: object
+ type: array
+ id:
+ type: string
+ object:
+ enum:
+ - agent.environment
+ type: string
+ plugins:
+ items:
+ type: object
+ type: array
+ skills:
+ items:
+ type: object
+ type: array
+ status:
+ enum:
+ - pending
+ - connected
+ - disconnected
+ - expired
+ - failed
+ type: string
+ type:
+ enum:
+ - openai_hosted
+ - self_hosted
+ type: string
+ required:
+ - files
+ - id
+ - object
+ - plugins
+ - skills
+ - status
+ - type
+ type: object
+ v1.EnvironmentNetwork:
+ properties:
+ access:
+ enum:
+ - enabled
+ - disabled
+ - restricted
+ type: string
+ allowed_domains:
+ items:
+ type: string
+ type: array
+ required:
+ - access
+ - allowed_domains
+ type: object
+ v1.EnvironmentNetworkInput:
+ properties:
+ access:
+ enum:
+ - enabled
+ - disabled
+ - restricted
+ type: string
+ allowed_domains:
+ anyOf:
+ - items:
+ type: string
+ type: array
+ - type: 'null'
+ required:
+ - access
+ type: object
+ v1.EnvironmentPackages:
+ properties:
+ npm:
+ items:
+ type: string
+ type: array
+ python:
+ items:
+ type: string
+ type: array
+ system:
+ items:
+ type: string
+ type: array
+ required:
+ - npm
+ - python
+ - system
+ type: object
+ v1.EnvironmentPackagesInput:
+ properties:
+ npm:
+ anyOf:
+ - items:
+ type: string
+ type: array
+ - type: 'null'
+ python:
+ anyOf:
+ - items:
+ type: string
+ type: array
+ - type: 'null'
+ system:
+ anyOf:
+ - items:
+ type: string
+ type: array
+ - type: 'null'
+ type: object
+ v1.EnvironmentTemplate:
+ properties:
+ capability_directories:
+ items:
+ type: string
+ type: array
+ created_at:
+ type: integer
+ files:
+ items:
+ type: object
+ type: array
+ id:
+ type: string
+ name:
+ anyOf:
+ - type: string
+ - type: 'null'
+ network:
+ $ref: '#/components/schemas/v1.EnvironmentNetwork'
+ object:
+ enum:
+ - agent.environment.template
+ type: string
+ packages:
+ $ref: '#/components/schemas/v1.EnvironmentPackages'
+ plugins:
+ items:
+ type: object
+ type: array
+ skills:
+ items:
+ type: object
+ type: array
+ updated_at:
+ type: integer
+ required:
+ - capability_directories
+ - created_at
+ - files
+ - id
+ - network
+ - object
+ - packages
+ - plugins
+ - skills
+ - updated_at
+ type: object
+ v1.EnvironmentTemplateDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - agent.environment.template.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.EnvironmentTemplateList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.EnvironmentTemplate'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.EnvironmentTemplateRequest:
+ properties:
+ capability_directories:
+ anyOf:
+ - items:
+ type: string
+ type: array
+ - type: 'null'
+ env:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ files:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ name:
+ anyOf:
+ - type: string
+ - type: 'null'
+ network:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.EnvironmentNetworkInput'
+ - type: 'null'
+ packages:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.EnvironmentPackagesInput'
+ - type: 'null'
+ plugins:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ setup_commands:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ skills:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ type: object
+ v1.ErrorResponse:
+ properties:
+ error:
+ $ref: '#/components/schemas/v1.APIError'
+ required:
+ - error
+ type: object
+ v1.InlineAgent:
+ properties:
+ instructions:
+ anyOf:
+ - type: string
+ - type: 'null'
+ model:
+ type: string
+ multi_agent:
+ anyOf:
+ - type: object
+ - type: 'null'
+ reasoning:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.Reasoning'
+ - type: 'null'
+ service_tier:
+ anyOf:
+ - enum:
+ - auto
+ - default
+ - flex
+ - priority
+ - fast
+ type: string
+ - type: 'null'
+ text:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.SavedAgentTextInput'
+ - type: 'null'
+ tools:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ x_agents_core:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.AgentsCore'
+ - type: 'null'
+ type: object
+ v1.InputContent:
+ properties:
+ image_url:
+ type: string
+ text:
+ type: string
+ type:
+ enum:
+ - input_text
+ - input_image
+ type: string
+ required:
+ - type
+ type: object
+ v1.InputMessage:
+ properties:
+ content:
+ items:
+ $ref: '#/components/schemas/v1.InputContent'
+ type: array
+ role:
+ enum:
+ - user
+ type: string
+ type:
+ enum:
+ - message
+ type: string
+ required:
+ - content
+ - role
+ type: object
+ v1.InputTokenDetails:
+ properties:
+ cached_tokens:
+ type: integer
+ required:
+ - cached_tokens
+ type: object
+ v1.Item:
+ properties:
+ action:
+ $ref: '#/components/schemas/v1.WebSearchAction'
+ agent_id:
+ type: string
+ arguments: {}
+ call_id:
+ type: string
+ command:
+ type: string
+ content:
+ items:
+ $ref: '#/components/schemas/v1.ItemContent'
+ type: array
+ cwd:
+ type: string
+ duration_ms:
+ type: integer
+ error: {}
+ exit_code:
+ type: integer
+ id:
+ type: string
+ model:
+ type: string
+ name:
+ type: string
+ output: {}
+ phase:
+ anyOf:
+ - enum:
+ - commentary
+ - final_answer
+ type: string
+ - type: 'null'
+ reasoning_effort:
+ type: string
+ recipient_agent_id:
+ type: string
+ recipient_agent_ids:
+ items:
+ type: string
+ type: array
+ role:
+ enum:
+ - user
+ - assistant
+ type: string
+ sender_agent_id:
+ type: string
+ server_label:
+ type: string
+ status:
+ enum:
+ - in_progress
+ - completed
+ - failed
+ - incomplete
+ type: string
+ summary:
+ items:
+ $ref: '#/components/schemas/v1.SummaryText'
+ type: array
+ turn_id:
+ type: string
+ type:
+ enum:
+ - message
+ - command_execution
+ - mcp_call
+ - function_call
+ - function_call_output
+ - web_search_call
+ - reasoning
+ - agent_message
+ - create_subagent_call
+ - send_subagent_input_call
+ - resume_subagent_call
+ - wait_for_subagents_call
+ - interrupt_subagent_call
+ - close_subagent_call
+ type: string
+ required:
+ - id
+ - turn_id
+ - type
+ type: object
+ v1.ItemContent:
+ properties:
+ encrypted_content:
+ type: string
+ image_url:
+ type: string
+ text:
+ type: string
+ type:
+ enum:
+ - input_text
+ - output_text
+ - input_image
+ - encrypted_content
+ type: string
+ required:
+ - type
+ type: object
+ v1.ItemList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Item'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.ModelProviderInput:
+ properties:
+ api_key:
+ type: string
+ base_url:
+ type: string
+ context_window:
+ type: integer
+ max_output_tokens:
+ type: integer
+ protocol:
+ enum:
+ - anthropic
+ - responses
+ type: string
+ required:
+ - api_key
+ - base_url
+ - protocol
+ type: object
+ v1.ModelProviderView:
+ properties:
+ api_key_configured:
+ type: boolean
+ base_url:
+ type: string
+ context_window:
+ type: integer
+ max_output_tokens:
+ type: integer
+ protocol:
+ enum:
+ - anthropic
+ - responses
+ type: string
+ required:
+ - api_key_configured
+ - base_url
+ - protocol
+ type: object
+ v1.MultiAgentConfig:
+ properties:
+ enabled:
+ type: boolean
+ max_concurrent_subagents:
+ anyOf:
+ - type: integer
+ - type: 'null'
+ required:
+ - enabled
+ type: object
+ v1.OAuthCredentialRefresh:
+ properties:
+ client_id:
+ type: string
+ resource:
+ anyOf:
+ - type: string
+ - type: 'null'
+ scope:
+ anyOf:
+ - type: string
+ - type: 'null'
+ token_endpoint:
+ type: string
+ token_endpoint_auth:
+ $ref: '#/components/schemas/v1.OAuthEndpointAuth'
+ required:
+ - client_id
+ - token_endpoint
+ - token_endpoint_auth
+ type: object
+ v1.OAuthCredentialRefreshInput:
+ properties:
+ client_id:
+ type: string
+ refresh_token:
+ type: string
+ resource:
+ anyOf:
+ - type: string
+ - type: 'null'
+ scope:
+ anyOf:
+ - type: string
+ - type: 'null'
+ token_endpoint:
+ type: string
+ token_endpoint_auth:
+ $ref: '#/components/schemas/v1.OAuthEndpointAuthInput'
+ required:
+ - client_id
+ - refresh_token
+ - token_endpoint
+ - token_endpoint_auth
+ type: object
+ v1.OAuthCredentialRefreshReplacement:
+ properties:
+ refresh_token:
+ anyOf:
+ - type: string
+ - type: 'null'
+ scope:
+ anyOf:
+ - type: string
+ - type: 'null'
+ token_endpoint_auth:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.OAuthEndpointAuthReplacement'
+ - type: 'null'
+ type: object
+ v1.OAuthEndpointAuth:
+ properties:
+ type:
+ enum:
+ - none
+ - client_secret_basic
+ - client_secret_post
+ type: string
+ required:
+ - type
+ type: object
+ v1.OAuthEndpointAuthInput:
+ properties:
+ client_secret:
+ type: string
+ type:
+ enum:
+ - none
+ - client_secret_basic
+ - client_secret_post
+ type: string
+ required:
+ - type
+ type: object
+ v1.OAuthEndpointAuthReplacement:
+ properties:
+ client_secret:
+ anyOf:
+ - type: string
+ - type: 'null'
+ type:
+ enum:
+ - client_secret_basic
+ - client_secret_post
+ type: string
+ required:
+ - type
+ type: object
+ v1.OutputTokenDetails:
+ properties:
+ reasoning_tokens:
+ type: integer
+ required:
+ - reasoning_tokens
+ type: object
+ v1.Reasoning:
+ properties:
+ effort:
+ anyOf:
+ - type: string
+ - type: 'null'
+ summary:
+ anyOf:
+ - type: string
+ - type: 'null'
+ type: object
+ v1.RequiredAction:
+ properties:
+ arguments: {}
+ call_id:
+ type: string
+ environment_id:
+ type: string
+ name:
+ type: string
+ turn_id:
+ type: string
+ type:
+ enum:
+ - function_call
+ - environment_connection
+ type: string
+ required:
+ - type
+ type: object
+ v1.SavedAgent:
+ properties:
+ created_at:
+ type: integer
+ id:
+ type: string
+ instructions:
+ anyOf:
+ - type: string
+ - type: 'null'
+ metadata:
+ additionalProperties:
+ type: string
+ type: object
+ model:
+ type: string
+ multi_agent:
+ $ref: '#/components/schemas/v1.MultiAgentConfig'
+ name:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - agent
+ type: string
+ reasoning:
+ $ref: '#/components/schemas/v1.Reasoning'
+ service_tier:
+ enum:
+ - auto
+ - default
+ - flex
+ - priority
+ - fast
+ type: string
+ text:
+ $ref: '#/components/schemas/v1.SavedAgentText'
+ tools:
+ items:
+ type: object
+ type: array
+ updated_at:
+ type: integer
+ x_agents_core:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.SavedAgentCore'
+ - type: 'null'
+ required:
+ - created_at
+ - id
+ - metadata
+ - model
+ - multi_agent
+ - object
+ - reasoning
+ - service_tier
+ - text
+ - tools
+ - updated_at
+ type: object
+ v1.SavedAgentCore:
+ properties:
+ harness:
+ enum:
+ - codex
+ - claude_sdk
+ - mcode
+ type: string
+ model_provider:
+ $ref: '#/components/schemas/v1.ModelProviderView'
+ type: object
+ v1.SavedAgentCoreInput:
+ properties:
+ harness:
+ enum:
+ - codex
+ - claude_sdk
+ - mcode
+ type: string
+ model_provider:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.ModelProviderInput'
+ - type: 'null'
+ type: object
+ v1.SavedAgentList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.SavedAgent'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.SavedAgentText:
+ properties:
+ format:
+ $ref: '#/components/schemas/v1.SavedAgentTextFormat'
+ verbosity:
+ enum:
+ - low
+ - medium
+ - high
+ type: string
+ required:
+ - format
+ - verbosity
+ type: object
+ v1.SavedAgentTextFormat:
+ properties:
+ schema:
+ type: object
+ type:
+ enum:
+ - text
+ - json_schema
+ type: string
+ required:
+ - type
+ type: object
+ v1.SavedAgentTextInput:
+ properties:
+ format:
+ anyOf:
+ - type: object
+ - type: 'null'
+ verbosity:
+ anyOf:
+ - enum:
+ - low
+ - medium
+ - high
+ type: string
+ - type: 'null'
+ type: object
+ v1.Session:
+ properties:
+ agent:
+ $ref: '#/components/schemas/v1.Agent'
+ created_at:
+ type: integer
+ environment:
+ $ref: '#/components/schemas/v1.SessionEnvironment'
+ error:
+ anyOf:
+ - type: string
+ - type: 'null'
+ id:
+ type: string
+ last_active_at:
+ type: integer
+ metadata:
+ additionalProperties:
+ type: string
+ type: object
+ object:
+ enum:
+ - agent.session
+ type: string
+ required_actions:
+ items:
+ $ref: '#/components/schemas/v1.RequiredAction'
+ type: array
+ status:
+ enum:
+ - idle
+ - in_progress
+ - requires_action
+ - failed
+ type: string
+ usage:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.TokenUsage'
+ - type: 'null'
+ vault_ids:
+ items:
+ type: string
+ type: array
+ required:
+ - agent
+ - created_at
+ - environment
+ - id
+ - last_active_at
+ - metadata
+ - object
+ - required_actions
+ - status
+ - vault_ids
+ type: object
+ v1.SessionArtifact:
+ properties:
+ created_at:
+ type: integer
+ environment_id:
+ type: string
+ id:
+ type: string
+ object:
+ enum:
+ - agent.session.artifact
+ type: string
+ path:
+ type: string
+ session_id:
+ type: string
+ size_bytes:
+ type: integer
+ turn_id:
+ type: string
+ required:
+ - created_at
+ - environment_id
+ - id
+ - object
+ - path
+ - session_id
+ - size_bytes
+ - turn_id
+ type: object
+ v1.SessionArtifactDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - agent.session.artifact.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.SessionArtifactList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.SessionArtifact'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.SessionDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - agent.session.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.SessionEnvironment:
+ properties:
+ capability_directories:
+ items:
+ type: string
+ type: array
+ files:
+ items:
+ type: object
+ type: array
+ id:
+ type: string
+ network:
+ $ref: '#/components/schemas/v1.EnvironmentNetwork'
+ packages:
+ $ref: '#/components/schemas/v1.EnvironmentPackages'
+ plugins:
+ items:
+ type: object
+ type: array
+ remote_url:
+ type: string
+ skills:
+ items:
+ type: object
+ type: array
+ type:
+ enum:
+ - none
+ - self_hosted
+ - openai_hosted
+ type: string
+ workspace_directory:
+ type: string
+ required:
+ - type
+ type: object
+ v1.SessionEnvironmentState:
+ properties:
+ error:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.StreamError'
+ - type: 'null'
+ id:
+ type: string
+ status:
+ enum:
+ - pending
+ - ready
+ - connected
+ - disconnected
+ - failed
+ type: string
+ type:
+ type: string
+ required:
+ - id
+ - status
+ - type
+ type: object
+ v1.SessionEvent:
+ properties:
+ content_index:
+ type: integer
+ delta:
+ type: string
+ environment:
+ $ref: '#/components/schemas/v1.SessionEnvironmentState'
+ error:
+ $ref: '#/components/schemas/v1.StreamError'
+ event_id:
+ type: string
+ item:
+ $ref: '#/components/schemas/v1.Item'
+ item_id:
+ type: string
+ output_index:
+ anyOf:
+ - type: integer
+ - type: 'null'
+ part:
+ $ref: '#/components/schemas/v1.ItemContent'
+ session:
+ $ref: '#/components/schemas/v1.Session'
+ session_id:
+ type: string
+ subagent:
+ $ref: '#/components/schemas/v1.Subagent'
+ text:
+ type: string
+ turn:
+ $ref: '#/components/schemas/v1.Turn'
+ turn_id:
+ type: string
+ type:
+ type: string
+ usage:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.TokenUsage'
+ - type: 'null'
+ description: |-
+ Usage is present only on terminal Turn events, where it mirrors the Turn
+ snapshot and is null when unknown. Other events omit it.
+ required:
+ - event_id
+ - type
+ type: object
+ v1.SessionExecutionInput:
+ properties:
+ model_provider:
+ $ref: '#/components/schemas/v1.ModelProviderInput'
+ type: object
+ v1.SessionInput:
+ properties:
+ call_id:
+ type: string
+ error:
+ anyOf:
+ - type: string
+ - type: 'null'
+ input:
+ items:
+ $ref: '#/components/schemas/v1.InputMessage'
+ type: array
+ output:
+ anyOf:
+ - {}
+ - type: 'null'
+ success:
+ type: boolean
+ turn_id:
+ type: string
+ type:
+ enum:
+ - agent.session.input.message
+ - agent.session.input.cancel
+ - agent.session.input.tool_result
+ type: string
+ required:
+ - type
+ type: object
+ v1.SessionList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Session'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.Skill:
+ properties:
+ created_at:
+ type: integer
+ default_version:
+ type: string
+ description:
+ type: string
+ id:
+ type: string
+ latest_version:
+ type: string
+ name:
+ type: string
+ object:
+ enum:
+ - skill
+ type: string
+ required:
+ - created_at
+ - default_version
+ - description
+ - id
+ - latest_version
+ - name
+ - object
+ type: object
+ v1.SkillDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - skill.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.SkillList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Skill'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.SkillUpdateRequest:
+ properties:
+ default_version:
+ type: string
+ required:
+ - default_version
+ type: object
+ v1.SkillVersion:
+ properties:
+ created_at:
+ type: integer
+ description:
+ type: string
+ id:
+ type: string
+ name:
+ type: string
+ object:
+ enum:
+ - skill.version
+ type: string
+ skill_id:
+ type: string
+ version:
+ type: string
+ required:
+ - created_at
+ - description
+ - id
+ - name
+ - object
+ - skill_id
+ - version
+ type: object
+ v1.SkillVersionDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - skill.version.deleted
+ type: string
+ version:
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ - version
+ type: object
+ v1.SkillVersionList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.SkillVersion'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.SourceFile:
+ properties:
+ bytes:
+ minimum: 0
+ type: integer
+ created_at:
+ type: integer
+ expires_at:
+ anyOf:
+ - type: integer
+ - type: 'null'
+ filename:
+ type: string
+ id:
+ type: string
+ object:
+ enum:
+ - file
+ type: string
+ purpose:
+ enum:
+ - user_data
+ type: string
+ status:
+ enum:
+ - processed
+ type: string
+ status_details:
+ anyOf:
+ - type: string
+ - type: 'null'
+ required:
+ - bytes
+ - created_at
+ - filename
+ - id
+ - object
+ - purpose
+ - status
+ type: object
+ v1.SourceFileDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - file
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.SourceFileList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.SourceFile'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.StreamError:
+ properties:
+ code:
+ type: string
+ message:
+ type: string
+ param:
+ anyOf:
+ - type: string
+ - type: 'null'
+ description: |-
+ Param is the pinned SessionError field. An error SessionEvent always
+ carries it, null when unset; Environment state errors and Core's own
+ stream_interrupted frame omit it.
+ type:
+ type: string
+ type: object
+ v1.Subagent:
+ properties:
+ closed_at:
+ anyOf:
+ - type: integer
+ - type: 'null'
+ id:
+ type: string
+ instructions:
+ anyOf:
+ - items:
+ $ref: '#/components/schemas/v1.AgentContent'
+ type: array
+ - type: 'null'
+ name:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - agent.session.subagent
+ type: string
+ opened_at:
+ type: integer
+ parent_agent_id:
+ type: string
+ session_id:
+ type: string
+ status:
+ enum:
+ - active
+ - closed
+ type: string
+ required:
+ - id
+ - object
+ - opened_at
+ - parent_agent_id
+ - session_id
+ - status
+ type: object
+ v1.SubagentList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Subagent'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.SummaryText:
+ properties:
+ text:
+ type: string
+ type:
+ enum:
+ - summary_text
+ type: string
+ required:
+ - text
+ - type
+ type: object
+ v1.TextConfig:
+ properties:
+ format:
+ $ref: '#/components/schemas/v1.TextFormat'
+ verbosity:
+ enum:
+ - low
+ - medium
+ - high
+ type: string
+ required:
+ - format
+ - verbosity
+ type: object
+ v1.TextFormat:
+ properties:
+ schema:
+ type: object
+ type:
+ enum:
+ - text
+ - json_schema
+ type: string
+ required:
+ - type
+ type: object
+ v1.TokenUsage:
+ properties:
+ input_tokens:
+ type: integer
+ input_tokens_details:
+ $ref: '#/components/schemas/v1.InputTokenDetails'
+ output_tokens:
+ type: integer
+ output_tokens_details:
+ $ref: '#/components/schemas/v1.OutputTokenDetails'
+ total_tokens:
+ type: integer
+ required:
+ - input_tokens
+ - input_tokens_details
+ - output_tokens
+ - output_tokens_details
+ - total_tokens
+ type: object
+ v1.Turn:
+ properties:
+ agent_id:
+ type: string
+ completed_at:
+ anyOf:
+ - type: integer
+ - type: 'null'
+ created_at:
+ type: integer
+ error:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.TurnError'
+ - type: 'null'
+ id:
+ type: string
+ object:
+ enum:
+ - agent.session.turn
+ type: string
+ session_id:
+ type: string
+ started_at:
+ anyOf:
+ - type: integer
+ - type: 'null'
+ status:
+ enum:
+ - queued
+ - in_progress
+ - waiting
+ - completed
+ - failed
+ - cancelled
+ type: string
+ subagent_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ usage:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.TokenUsage'
+ - type: 'null'
+ required:
+ - agent_id
+ - created_at
+ - id
+ - object
+ - session_id
+ - status
+ type: object
+ v1.TurnError:
+ properties:
+ code:
+ enum:
+ - context_length_exceeded
+ - session_budget_exceeded
+ - usage_limit_exceeded
+ - rate_limit_exceeded
+ - server_overloaded
+ - cyber_policy
+ - connection_failed
+ - server_error
+ - authentication_error
+ - invalid_request
+ - resource_not_found
+ - sandbox_error
+ - executor_version_incompatible
+ - active_turn_not_steerable
+ - request_timeout
+ - internal_error
+ type: string
+ message:
+ type: string
+ required:
+ - code
+ - message
+ type: object
+ v1.TurnList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Turn'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.UpdateAgentRequest:
+ properties:
+ instructions:
+ anyOf:
+ - type: string
+ - type: 'null'
+ metadata:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ model:
+ type: string
+ multi_agent:
+ anyOf:
+ - type: object
+ - type: 'null'
+ name:
+ anyOf:
+ - maxLength: 128
+ type: string
+ - type: 'null'
+ reasoning:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.Reasoning'
+ - type: 'null'
+ service_tier:
+ anyOf:
+ - enum:
+ - auto
+ - default
+ - flex
+ - priority
+ - fast
+ type: string
+ - type: 'null'
+ text:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.SavedAgentTextInput'
+ - type: 'null'
+ tools:
+ anyOf:
+ - items:
+ type: object
+ type: array
+ - type: 'null'
+ x_agents_core:
+ anyOf:
+ - allOf:
+ - $ref: '#/components/schemas/v1.SavedAgentCoreInput'
+ - type: 'null'
+ type: object
+ v1.UpdateCredentialRequest:
+ properties:
+ auth:
+ $ref: '#/components/schemas/v1.CredentialAuthReplacement'
+ required:
+ - auth
+ type: object
+ v1.UpdateSessionRequest:
+ properties:
+ metadata:
+ anyOf:
+ - additionalProperties:
+ type: string
+ type: object
+ - type: 'null'
+ required:
+ - metadata
+ type: object
+ v1.Vault:
+ properties:
+ created_at:
+ type: integer
+ id:
+ type: string
+ metadata:
+ additionalProperties:
+ type: string
+ type: object
+ name:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - vault
+ type: string
+ required:
+ - created_at
+ - id
+ - metadata
+ - object
+ type: object
+ v1.VaultDeleted:
+ properties:
+ deleted:
+ type: boolean
+ id:
+ type: string
+ object:
+ enum:
+ - vault.deleted
+ type: string
+ required:
+ - deleted
+ - id
+ - object
+ type: object
+ v1.VaultList:
+ properties:
+ data:
+ items:
+ $ref: '#/components/schemas/v1.Vault'
+ type: array
+ first_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ has_more:
+ type: boolean
+ last_id:
+ anyOf:
+ - type: string
+ - type: 'null'
+ object:
+ enum:
+ - list
+ type: string
+ required:
+ - data
+ - has_more
+ - object
+ type: object
+ v1.WebSearchAction:
+ properties:
+ pattern:
+ type: string
+ queries:
+ items:
+ type: string
+ type: array
+ query:
+ type: string
+ type:
+ enum:
+ - search
+ - open_page
+ - find_in_page
+ - other
+ type: string
+ url:
+ type: string
+ required:
+ - type
+ type: object
+ securitySchemes:
+ BearerAuth:
+ type: http
+ scheme: bearer
+tags:
+ - name: Agents
+ description: 'Agents. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Environments
+ description: 'Environments. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Environment Templates
+ description: 'Environment Templates. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Sessions
+ description: 'Sessions. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Artifacts
+ description: 'Artifacts. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Events
+ description: 'Events. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Items
+ description: 'Items. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Subagents
+ description: 'Subagents. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Turns
+ description: 'Turns. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Files
+ description: 'Files. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Skills
+ description: 'Skills. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Vaults
+ description: 'Vaults. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
+ - name: Credentials
+ description: 'Credentials. Application API: Project API key. Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.'
diff --git a/apps/docs/openapi/runtime-api.yaml b/apps/docs/openapi/runtime-api.yaml
new file mode 100644
index 000000000..140773236
--- /dev/null
+++ b/apps/docs/openapi/runtime-api.yaml
@@ -0,0 +1,331 @@
+# Generated documentation projection; do not edit.
+info:
+ contact: {}
+ description: Machine connection routes under /api/v1. Sandbox nodes authenticate with a one-use enrollment token or their node credential; Project API keys and the Core key are not accepted. See each operation's security requirements.
+ license:
+ name: Apache 2.0
+ url: https://www.apache.org/licenses/LICENSE-2.0.html
+ title: OpenAgentCore Machine Connections
+ version: '1'
+paths:
+ /api/v1/sandbox-node/configuration:
+ get:
+ description: Authenticates with an unconsumed enrollment token, or a retained node credential with X-OAC-Node-ID. Does not consume the token or expose E2B credentials. Node files cannot override this specification.
+ parameters:
+ - schema:
+ type: string
+ description: Retained node UUID
+ in: header
+ name: X-OAC-Node-ID
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/store.RuntimeNodeConfiguration'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '409':
+ description: Conflict
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - NodeEnrollmentAuth: []
+ summary: Read the active configuration for node installation
+ tags:
+ - Sandbox Node
+ /api/v1/sandbox-node/enroll:
+ post:
+ description: Node machine connection. Consumes a one-use enrollment token; grants no project or administrator access. Responses contain only explicit safe fields. core_url is required and must equal the installation public URL; a different address gets 409 sandbox_node_address_mismatch and leaves the token unused.
+ responses:
+ '201':
+ description: Created
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/store.RuntimeNodeIdentity'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '409':
+ description: Conflict
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - NodeEnrollmentAuth: []
+ summary: Enroll a sandbox node
+ tags:
+ - Sandbox Node
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/store.RuntimeNodeEnrollment'
+ description: Request
+ required: true
+ /api/v1/sandbox-node/identity:
+ get:
+ description: Node machine connection. Authenticates with the retained node credential; grants no project or administrator access. Responses contain only explicit safe fields.
+ parameters:
+ - schema:
+ type: string
+ description: Sandbox node UUID
+ in: query
+ name: node_id
+ required: true
+ responses:
+ '200':
+ description: OK
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/store.RuntimeNodeStatus'
+ '400':
+ description: Bad Request
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '401':
+ description: Unauthorized
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '404':
+ description: Not Found
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '409':
+ description: Conflict
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '500':
+ description: Internal Server Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ '503':
+ description: Service Unavailable
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/v1.ErrorResponse'
+ security:
+ - NodeAuth: []
+ summary: Recover an enrolled sandbox node identity and observe its readiness
+ tags:
+ - Sandbox Node
+schemes:
+ - http
+ - https
+openapi: 3.1.0
+servers:
+ - url: https://core.example.com
+ description: Documentation placeholder; substitute your Core public origin.
+components:
+ schemas:
+ sandbox.DeploymentSpec:
+ properties:
+ resources:
+ $ref: '#/components/schemas/sandbox.Resources'
+ runtime:
+ $ref: '#/components/schemas/sandbox.RuntimeRelease'
+ type: object
+ sandbox.Resources:
+ properties:
+ cpus:
+ type: integer
+ environment_disk_mib:
+ type: integer
+ memory_mib:
+ type: integer
+ root_disk_mib:
+ type: integer
+ type: object
+ sandbox.RuntimeRelease:
+ properties:
+ firmware_sha256:
+ type: string
+ image_id:
+ type: string
+ image_manifest_digest:
+ type: string
+ microsandbox_ref:
+ type: string
+ runtime_sha256:
+ type: string
+ source_commit:
+ type: string
+ type: object
+ store.RuntimeNodeConfiguration:
+ properties:
+ core_url:
+ type: string
+ generation:
+ type: integer
+ installation_id:
+ type: string
+ max_active:
+ type: integer
+ max_retained:
+ type: integer
+ provider:
+ type: string
+ specification:
+ $ref: '#/components/schemas/sandbox.DeploymentSpec'
+ specification_digest:
+ type: string
+ type: object
+ store.RuntimeNodeEnrollment:
+ properties:
+ backend_fingerprint:
+ type: string
+ core_url:
+ description: The Core origin this node stores and connects to, such as https://core.example. It must equal the installation public URL; otherwise enrollment gets 409 sandbox_node_address_mismatch and the token stays unused.
+ type: string
+ credential:
+ type: string
+ deployment_generation:
+ type: integer
+ name:
+ type: string
+ node_id:
+ type: string
+ provider:
+ type: string
+ specification_digest:
+ type: string
+ type: object
+ store.RuntimeNodeIdentity:
+ properties:
+ deployment_generation:
+ type: integer
+ installation_id:
+ type: string
+ max_active:
+ type: integer
+ max_retained:
+ type: integer
+ node_id:
+ type: string
+ provider:
+ type: string
+ specification_digest:
+ type: string
+ type: object
+ store.RuntimeNodeStatus:
+ properties:
+ connected:
+ type: boolean
+ deployment_generation:
+ type: integer
+ installation_id:
+ type: string
+ max_active:
+ type: integer
+ max_retained:
+ type: integer
+ node_id:
+ type: string
+ provider:
+ type: string
+ provider_ready:
+ type: boolean
+ specification_digest:
+ type: string
+ type: object
+ v1.APIError:
+ properties:
+ code:
+ anyOf:
+ - type: string
+ - type: 'null'
+ message:
+ type: string
+ param:
+ anyOf:
+ - type: string
+ - type: 'null'
+ type:
+ type: string
+ required:
+ - message
+ - type
+ type: object
+ v1.ErrorResponse:
+ properties:
+ error:
+ $ref: '#/components/schemas/v1.APIError'
+ required:
+ - error
+ type: object
+ securitySchemes:
+ NodeAuth:
+ type: http
+ scheme: bearer
+ NodeEnrollmentAuth:
+ type: http
+ scheme: bearer
+tags:
+ - name: Sandbox Node
+ description: 'Sandbox Node. Machine connection API: Route-specific node enrollment, node, daemon, or executor credential. Generated local machine contract. These connections reach Core directly, never through Web.'
diff --git a/apps/docs/openapi/sources.json b/apps/docs/openapi/sources.json
new file mode 100644
index 000000000..ddcaef8ac
--- /dev/null
+++ b/apps/docs/openapi/sources.json
@@ -0,0 +1,51 @@
+{
+ "sources": {
+ "contracts/agents-api/openapi.yaml": "a8896e8b67d78ed0608c7cc5636077ec33f4b4895a04bd6cfb8b038afe941e01",
+ "contracts/agents-api/core.openapi.yaml": "488a50fa308194224ee5ee879b7f6e38166d1b08dedc2bbc5bb39f38a844c87f",
+ "contracts/agents-api/runtime.openapi.yaml": "b3fb025b20a0bcf4635d60339479b2b07f6dbed80f51e72f40a63b31e42b5f4a"
+ },
+ "outputs": {
+ "content/docs/api-reference/agents.mdx": "1f7697959e9c52c9d24fbe70e116e807f49912b9a27ac638b86782e2f326af44",
+ "content/docs/api-reference/environments.mdx": "6a9e08a67479a745983c45b9711137617c13fdf7599a64533997b00a26ac7282",
+ "content/docs/api-reference/environment-templates.mdx": "c1daeaec159aea40b0aa5ed72b1e77ac1715471431b558d0d89e05bfe9ad8945",
+ "content/docs/api-reference/sessions.mdx": "cbebb6a1705b486fb228cbe0065df893227132f9b3884180a3871a3e8c78f311",
+ "content/docs/api-reference/artifacts.mdx": "8df8d008126b49b1df88f28a676c4b237ccffc45a470b35ec30eab2daf1c0f7f",
+ "content/docs/api-reference/events.mdx": "83d7f56a788d073e0b19f0bc9197f39ec364375b9cc3a7ec69b79b54bc71e3eb",
+ "content/docs/api-reference/items.mdx": "fa4d248ac5623beb3f00a4ebb5a6c4ff477865ebee351e0c543a970a7ec3654d",
+ "content/docs/api-reference/subagents.mdx": "90e2a1a9129111332e36715de2078ee595590c4c25c7b355962e4185bdeb5388",
+ "content/docs/api-reference/turns.mdx": "46ee9e43aae4ec85b3ee335939dc1e0a238cfda0fb996c6af4d2831bef3377f1",
+ "content/docs/api-reference/files.mdx": "531c835c66b194ab8876c7663b79e42f0090e12420ae32fafeda24e3143740f4",
+ "content/docs/api-reference/skills.mdx": "774ea05a7a8250fe5af5164388b98dafca99d56dc2eae686e8f628acb4e7c10b",
+ "content/docs/api-reference/vaults.mdx": "d80eade1c2f8100030866abbb0fb6b7a09c94250a859c97cdf1abce32fdfdf1e",
+ "content/docs/api-reference/credentials.mdx": "f129a51f74a3c7021c016600518e2350023f8d29571666ac5d64b7584cd7c7d0",
+ "openapi/public-api.yaml": "84ae8a33717c817950d757990018edd10a4d31d5a343c8172baa099d101c5a1f",
+ "content/docs/api-reference/meta.json": "56bf1dc145ccc8adde38c5f956f1a06f18ef18b646122250d01a294c516f8f83",
+ "content/docs/api-reference/index.mdx": "9fd6b1c54149874d2999235067c101326f9e8a2e707a70b6672c81eb3ebfe63f",
+ "content/docs/api-reference/core/core-administration.mdx": "a1261c7998017de3761ca90ca073a0b89a6c528ff37a634f3d8b986ee9540fc5",
+ "content/docs/api-reference/core/deployment-model-providers.mdx": "b2795fadcc05a1e7195b6d34c3f234cb29cc5e3f580d1521e31965453e654347",
+ "content/docs/api-reference/core/administrator-projects.mdx": "8fd687bb2a7119fa16e938d7c71710c2816afb9cf959eb6849ef5e6300c5419b",
+ "content/docs/api-reference/core/agents.mdx": "b6c089fbea4b07bc4249e7c7ca5699d47f1512a4fc2d8ee01cb26910ae541a84",
+ "content/docs/api-reference/core/environment-templates.mdx": "05907f35d7f02d66af9da8b1efaa3765badb4cdf7b94d0f6c3ab0413a2cfa1a9",
+ "content/docs/api-reference/core/executor-credentials.mdx": "f73656c850bf982b187ac5586669dabae1e4d3b714293a7bae090127b25e479b",
+ "content/docs/api-reference/core/files.mdx": "05ce1d2296dbb3fc76cf4cf98d24dff249114c73529335214cee97363229f384",
+ "content/docs/api-reference/core/write-audit.mdx": "1298590ab7037077e56f6ab8adb020277763f7a670be796d24142323b2f95411",
+ "content/docs/api-reference/core/sessions.mdx": "e8519b5d3b21296b0ea1edede3160766ad6a49197b92b201ee1a845542d99619",
+ "content/docs/api-reference/core/artifacts.mdx": "620fe72cd41d19b9694fe7080eb8935ef44292852400c7be1c03a893613ca89c",
+ "content/docs/api-reference/core/execution-configuration.mdx": "f6a9ed4cdb73e87f5f4ce16b4f6fa14b756d07c97f2741bd5cade34a3472c548",
+ "content/docs/api-reference/core/items.mdx": "7c7b006536d155d003097a504e9931e3dc4d9fd0426852573244453634729250",
+ "content/docs/api-reference/core/runtime-history.mdx": "eec6384c6fd5a2bf223ec7dc7ee19332440936e18fc67f782fe81b96e299f634",
+ "content/docs/api-reference/core/runtime-observations.mdx": "db3a238ba77d1fcb887835d51b6f3f8f2b6bdf9cc5e14ac6dd11074a1c75ed48",
+ "content/docs/api-reference/core/turns.mdx": "e6f7a154b3c70e1555417e44a7888295afb8f8bd475621300e1b2bbd2fc94933",
+ "content/docs/api-reference/core/skills.mdx": "ed899ade7b032b1732b3097d81419a8fdbb9ead0594fca9f2107da644b97031f",
+ "content/docs/api-reference/core/vaults.mdx": "12d0aac96cd4a3472ef4eaa287f7945f78862017956e79bfc3ed0ef8e772e78a",
+ "content/docs/api-reference/core/credentials.mdx": "27d586b9a8fd738b9947802f32c80458195370252886bc26abedccf2125ee981",
+ "content/docs/api-reference/core/sandbox-manager.mdx": "36f2895b9969d27be843d5cebf935bf14ca9400ad076e56074a25905e3df5d1b",
+ "openapi/core-api.yaml": "9872f80cec2661c8539b6652a294c16c668f581399afd20f76b198279faae9ed",
+ "content/docs/api-reference/core/meta.json": "588b163ed2de2100b0f8376688274f80698a6bf6ac037eef56d17c93fa8a5062",
+ "content/docs/api-reference/core/index.mdx": "ddf0a8d87a6c21761beac703a32f2a40486a1c74abb341bd726f40c44a866405",
+ "content/docs/api-reference/machine/sandbox-node.mdx": "5b367a08d43cea82686345d2ba1c75cc90627a7b2970fe42a0df9d77fb3e1e80",
+ "openapi/runtime-api.yaml": "bca127037ffb1e132e7f26bffada5e3da70f4b2534926a04e1e65029d885afe9",
+ "content/docs/api-reference/machine/meta.json": "12a1a6534c1cae32918282da2110e4b64c43f17abb868486b5eff50ceb0b01c1",
+ "content/docs/api-reference/machine/index.mdx": "792c1ce86a6653943021eb5cd03a2c6b5c604f7f012da5ef06f3ffa027b12973"
+ }
+}
diff --git a/apps/docs/package.json b/apps/docs/package.json
new file mode 100644
index 000000000..d736c306b
--- /dev/null
+++ b/apps/docs/package.json
@@ -0,0 +1,46 @@
+{
+ "name": "@oac/docs",
+ "private": true,
+ "version": "0.1.0",
+ "type": "module",
+ "scripts": {
+ "postinstall": "fumadocs-mdx",
+ "dev": "next dev --port 4000",
+ "build": "fumadocs-mdx && next build && node scripts/verify-prerender.mjs",
+ "api:generate": "node scripts/generate-api-reference.mjs",
+ "verify": "pnpm verify:contracts && pnpm verify:routes && pnpm verify:copy && pnpm verify:docs && pnpm verify:links",
+ "verify:contracts": "node scripts/verify-contract-freshness.mjs",
+ "verify:routes": "node scripts/check-python.mjs routes",
+ "verify:copy": "node scripts/verify-api-copy.mjs",
+ "verify:docs": "node scripts/verify-docs-facts.mjs",
+ "verify:links": "node scripts/verify-links.mjs",
+ "check:prerender": "node scripts/verify-prerender.mjs",
+ "check:site": "node scripts/check-site.mjs",
+ "start": "next start",
+ "typecheck": "fumadocs-mdx && tsc --noEmit",
+ "test": "node --test && node scripts/check-python.mjs tests",
+ "guides:generate": "node scripts/generate-guides.mjs",
+ "generate": "pnpm guides:generate && pnpm api:generate",
+ "check:browser": "node scripts/check-browser.mjs"
+ },
+ "dependencies": {
+ "@scalar/openapi-upgrader": "0.1.1",
+ "fumadocs-core": "15.8.5",
+ "fumadocs-mdx": "^12.0.3",
+ "fumadocs-openapi": "9.5.1",
+ "fumadocs-ui": "15.8.5",
+ "js-yaml": "^4.1.0",
+ "next": "^15.5.16",
+ "next-themes": "^0.4.6",
+ "react": "^19.2.7",
+ "react-dom": "^19.2.7"
+ },
+ "devDependencies": {
+ "@tailwindcss/postcss": "^4.3.2",
+ "@types/react": "^19.2.17",
+ "@types/react-dom": "^19.1.0",
+ "@types/node": "^22.0.0",
+ "tailwindcss": "^4.3.2",
+ "typescript": "^5.8.3"
+ }
+}
diff --git a/apps/docs/postcss.config.mjs b/apps/docs/postcss.config.mjs
new file mode 100644
index 000000000..2f8795a93
--- /dev/null
+++ b/apps/docs/postcss.config.mjs
@@ -0,0 +1,7 @@
+const config = {
+ plugins: {
+ "@tailwindcss/postcss": {},
+ },
+}
+
+export default config
diff --git a/apps/docs/public/images/architecture.svg b/apps/docs/public/images/architecture.svg
new file mode 100644
index 000000000..9f8abb1de
--- /dev/null
+++ b/apps/docs/public/images/architecture.svg
@@ -0,0 +1,10 @@
+
+OpenAgentCore API and execution boundaries Applications call Core with Project API keys. Administrator browsers sign into Web; Web holds the Core key. Nodes and Runtime daemons connect directly to Core using scoped machine credentials. Core owns execution and its PostgreSQL state.
+Application / SDK Administrator browser Web server Core Execution owner PostgreSQL Node / Runtime / native harness /v1 · Project API key Session /core/v1 Core key /api/v1 Scoped machine credentials Application API and administration API are separate. Machine connections never pass through Web.
+
diff --git a/apps/docs/public/images/source/apps/web/public/onboarding/monitor-en.webp b/apps/docs/public/images/source/apps/web/public/onboarding/monitor-en.webp
new file mode 100644
index 000000000..70aab640b
Binary files /dev/null and b/apps/docs/public/images/source/apps/web/public/onboarding/monitor-en.webp differ
diff --git a/apps/docs/scripts/check-browser.mjs b/apps/docs/scripts/check-browser.mjs
new file mode 100644
index 000000000..bf1781696
--- /dev/null
+++ b/apps/docs/scripts/check-browser.mjs
@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// Local documentation acceptance only: never enter credentials or call Core.
+const { chromium } = await import(process.env.DOCS_PLAYWRIGHT_MODULE ?? '@playwright/test')
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+const origin = process.argv[2] ?? 'http://127.0.0.1:4275'
+assert.ok(['127.0.0.1', 'localhost'].includes(new URL(origin).hostname), 'Use a task-owned local documentation server')
+const browser = await chromium.launch({ headless: true, channel: 'chromium', ...(process.env.DOCS_BROWSER_EXECUTABLE ? { executablePath: process.env.DOCS_BROWSER_EXECUTABLE } : {}) })
+const context = await browser.newContext({ viewport: { width: 1440, height: 1000 } })
+const failures = []
+const unexpected = []
+context.on('request', request => {
+ if (!request.url().startsWith(origin + '/') && request.url() !== origin) unexpected.push(request.url())
+})
+const page = await context.newPage()
+page.on('pageerror', error => failures.push(error.message))
+const screenshots = process.env.DOCS_SCREENSHOT_DIR
+if (screenshots) fs.mkdirSync(screenshots, { recursive: true })
+try {
+ for (const route of ['/', '/install', '/configure', '/console', '/execution-model', '/api-reference/agents', '/api-reference/core/sandbox-manager', '/api-reference/machine/sandbox-node', '/zh/install']) {
+ const response = await page.goto(origin + route, { waitUntil: 'networkidle' })
+ assert.equal(response.status(), 200, route)
+ assert.ok(await page.locator('h1').count(), 'Missing page title: ' + route)
+ assert.ok((await page.locator('body').innerText()).includes('OpenAgentCore Docs'), 'Wrong visible wordmark: ' + route)
+ assert.ok((await page.title()).includes('OpenAgentCore Docs'), 'Wrong page metadata: ' + route)
+ if (route.includes('/api-reference/')) {
+ assert.equal(await page.locator('input, form, textarea').count(), 0, 'Reference exposes request controls: ' + route)
+ assert.ok((await page.locator('body').innerText()).includes('Authorization'), 'Missing credential documentation: ' + route)
+ }
+ if (screenshots && ['/', '/console', '/execution-model', '/api-reference/core/sandbox-manager', '/zh/install'].includes(route)) {
+ await page.screenshot({ path: path.join(screenshots, (route.replaceAll('/', '-') || 'home') + '.png'), fullPage: false })
+ }
+ }
+ await page.setViewportSize({ width: 390, height: 844 })
+ await page.goto(origin + '/install', { waitUntil: 'networkidle' })
+ assert.ok(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth + 1), 'Mobile page overflows viewport')
+ assert.deepEqual(failures, [], 'Browser runtime errors')
+ assert.deepEqual(unexpected, [], 'Documentation made external requests')
+ console.log('Nine desktop routes, both language paths, mobile layout and read-only API controls passed; no external requests.')
+} finally {
+ await context.close()
+ await browser.close()
+}
diff --git a/apps/docs/scripts/check-python.mjs b/apps/docs/scripts/check-python.mjs
new file mode 100644
index 000000000..96bb15afd
--- /dev/null
+++ b/apps/docs/scripts/check-python.mjs
@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// Decode YAML with the locked Node dependency; Python checks need only stdlib.
+import fs from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import yaml from 'js-yaml'
+import { appRoot, surfaces, sourcePath } from './contracts.mjs'
+
+const mode = process.argv[2]
+if (!['routes', 'tests'].includes(mode)) throw new Error('Expected routes or tests')
+const args = mode === 'routes'
+ ? ['scripts/verify-contract-routes.py']
+ : ['-m', 'unittest', 'discover', '-s', 'scripts', '-p', 'test_*.py']
+const input = mode === 'routes' ? JSON.stringify(surfaces.map(surface => ({
+ label: surface.id, document: yaml.load(fs.readFileSync(sourcePath(surface), 'utf8')),
+}))) : undefined
+const result = spawnSync(process.env.OAC_TEST_OFFICIAL_SDK_PYTHON || 'python3', ['-S', ...args], {
+ cwd: appRoot, input, stdio: ['pipe', 'inherit', 'inherit'],
+})
+if (result.error) throw result.error
+process.exit(result.status ?? 1)
diff --git a/apps/docs/scripts/check-python.test.mjs b/apps/docs/scripts/check-python.test.mjs
new file mode 100644
index 000000000..e6bce3365
--- /dev/null
+++ b/apps/docs/scripts/check-python.test.mjs
@@ -0,0 +1,30 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { appRoot } from './contracts.mjs'
+
+test('route gate and Python regressions honor the selected interpreter without site packages', (t) => {
+ const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'oac-docs-python-'))
+ t.after(() => fs.rmSync(directory, { recursive: true, force: true }))
+ const selected = path.join(directory, 'selected-python')
+ const log = path.join(directory, 'arguments.jsonl')
+ const python = spawnSync(process.env.OAC_TEST_OFFICIAL_SDK_PYTHON || 'python3', ['-S', '-c', 'import sys; print(sys.executable)'], { encoding: 'utf8' })
+ assert.equal(python.status, 0, python.stderr)
+ const executable = python.stdout.trim()
+ // This task-owned wrapper records selection, then delegates unchanged to Python.
+ fs.writeFileSync(selected, `#!${executable}\nimport json, os, sys\nwith open(${JSON.stringify(log)}, "a") as output:\n output.write(json.dumps(sys.argv[1:]) + "\\n")\nos.execv(${JSON.stringify(executable)}, [${JSON.stringify(executable)}, *sys.argv[1:]])\n`, { mode: 0o700 })
+ for (const mode of ['routes', 'tests']) {
+ const result = spawnSync(process.execPath, ['scripts/check-python.mjs', mode], {
+ cwd: appRoot, env: { ...process.env, OAC_TEST_OFFICIAL_SDK_PYTHON: selected }, encoding: 'utf8',
+ })
+ assert.equal(result.status, 0, result.stdout + result.stderr)
+ if (mode === 'routes') assert.match(result.stdout, /Contract operations:\s+130/)
+ else assert.match(result.stderr, /Ran 2 tests/)
+ }
+ const invocations = fs.readFileSync(log, 'utf8').trim().split('\n').map(line => JSON.parse(line))
+ assert.equal(invocations.length, 2)
+ assert.ok(invocations.every(args => args[0] === '-S'), 'Checks must not depend on ambient site packages')
+})
diff --git a/apps/docs/scripts/check-site.mjs b/apps/docs/scripts/check-site.mjs
new file mode 100644
index 000000000..310b01a42
--- /dev/null
+++ b/apps/docs/scripts/check-site.mjs
@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+// Smoke-checks every documentation page against a running server.
+//
+// A page that exists on disk but 404s in the browser is the failure this catches:
+// a missing layout, a bad slug, or a locale route that was never generated.
+//
+// Both locales are probed for every page, including pages that have no translated
+// twin. That is deliberate: Fumadocs falls back to the default language for an
+// untranslated page, so `/zh/api-reference/files` is a real, reachable URL even
+// though only `api-reference/files.mdx` exists on disk. The Chinese manual links
+// into those pages freely, so both forms have to resolve.
+//
+// Not part of `pnpm verify`, because it needs a built site that is already
+// serving. Usage, after `pnpm build && pnpm start`:
+//
+// node scripts/check-site.mjs [origin] # default http://127.0.0.1:4001
+
+import fs from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const contentRoot = path.resolve(here, "../content/docs")
+const origin = (process.argv[2] ?? "http://127.0.0.1:4001").replace(/\/+$/, "")
+
+function walk(dir) {
+ const out = []
+ for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+ const full = path.join(dir, entry.name)
+ if (entry.isDirectory()) out.push(...walk(full))
+ else if (entry.name.endsWith(".mdx")) out.push(full)
+ }
+ return out
+}
+
+// content/docs/index.mdx -> /
+// content/docs/foo.mdx -> /foo
+// content/docs/foo.zh.mdx -> /foo (the zh twin of the same route)
+// content/docs/a/index.mdx -> /a
+// content/docs/a/b.mdx -> /a/b
+function slugFor(file) {
+ let rel = path.relative(contentRoot, file).split(path.sep).join("/")
+ rel = rel.replace(/\.zh\.mdx$/, "").replace(/\.mdx$/, "").replace(/(^|\/)index$/, "")
+ return rel.replace(/\/$/, "")
+}
+
+const slugs = [...new Set(walk(contentRoot).map(slugFor))].sort()
+const routes = []
+for (const slug of slugs) {
+ routes.push(slug ? `/${slug}` : "/")
+ routes.push(slug ? `/zh/${slug}` : "/zh")
+}
+
+const failures = []
+let checked = 0
+const concurrency = 8
+
+async function check(route) {
+ try {
+ const response = await fetch(`${origin}${route}`, { redirect: "manual" })
+ checked += 1
+ if (response.status !== 200) failures.push(`${response.status} ${route}`)
+ } catch (error) {
+ checked += 1
+ failures.push(`ERR ${route} (${error.message})`)
+ }
+}
+
+const queue = [...routes]
+await Promise.all(
+ Array.from({ length: concurrency }, async () => {
+ while (queue.length > 0) await check(queue.shift())
+ }),
+)
+
+if (failures.length > 0) {
+ console.error(`\n${failures.length} of ${checked} routes did not return 200:`)
+ for (const line of failures.sort()) console.error(` ${line}`)
+ process.exit(1)
+}
+console.log(`${checked} routes returned 200 at ${origin} (${slugs.length} pages, both locales).`)
\ No newline at end of file
diff --git a/apps/docs/scripts/contracts.mjs b/apps/docs/scripts/contracts.mjs
new file mode 100644
index 000000000..e8b6356e3
--- /dev/null
+++ b/apps/docs/scripts/contracts.mjs
@@ -0,0 +1,91 @@
+// The public schema is constrained by the pinned upstream route/field snapshots.
+// Core and machine schemas are local generated contracts, with separate authority.
+import { upgrade } from '@scalar/openapi-upgrader'
+import yaml from 'js-yaml'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+export const appRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+export const repoRoot = path.resolve(appRoot, '../..')
+export const methods = ['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'trace']
+export const surfaces = [
+ { id: 'public-api', file: 'openapi.yaml', directory: '', title: 'Application API', prefix: '/v1', credential: 'Project API key', authority: 'Public schema constrained by the pinned OpenAI Agents API baseline; documented x_agents_core fields remain Core extensions.' },
+ { id: 'core-api', file: 'core.openapi.yaml', directory: '/core', title: 'Core administration API', prefix: '/core/v1', credential: 'Core key held by Web’s server or an operator script', authority: 'Generated local management contract. This is not part of the public OpenAI API.' },
+ { id: 'runtime-api', file: 'runtime.openapi.yaml', directory: '/machine', title: 'Machine connection API', prefix: '/api/v1', credential: 'Route-specific node enrollment, node, daemon, or executor credential', authority: 'Generated local machine contract. These connections reach Core directly, never through Web.' },
+]
+export function sourcePath(surface) { return path.join(repoRoot, 'contracts/agents-api', surface.file) }
+export function normalise(surface, source = yaml.load(fs.readFileSync(sourcePath(surface), 'utf8'))) {
+ if (source.swagger !== '2.0' && !/^3\./.test(source.openapi ?? '')) throw new Error('Unsupported contract format: ' + surface.file)
+ const base = source.basePath === '/' ? '' : (source.basePath ?? '')
+ const document = source.swagger === '2.0' ? upgrade(structuredClone(source), '3.0') : structuredClone(source)
+ projectSchemas(document)
+ document.servers = [{ url: (surface.id === 'core-api' ? 'https://core-direct.example.com' : 'https://core.example.com') + base, description: surface.id === 'core-api' ? 'Operator-script placeholder: replace with the Core loopback origin, not the public Web entry.' : 'Documentation placeholder; substitute your Core public origin.' }]
+ for (const scheme of Object.values(document.components?.securitySchemes ?? {})) {
+ if (scheme.type === 'apiKey' && scheme.in === 'header' && scheme.name?.toLowerCase() === 'authorization') {
+ delete scheme.in; delete scheme.name; scheme.type = 'http'; scheme.scheme = 'bearer'
+ }
+ }
+ const tags = new Set()
+ for (const [route, item] of Object.entries(document.paths ?? {})) {
+ for (const method of methods) {
+ const operation = item[method]
+ if (!operation) continue
+ if (!(base + route).startsWith(surface.prefix + '/')) throw new Error('Route crosses credential boundary: ' + surface.id + ' ' + route)
+ for (const tag of operation.tags ?? ['Operations']) tags.add(tag)
+ }
+ }
+ document.tags = [...tags].map(name => ({ name, description: `${name}. ${surface.title}: ${surface.credential}. ${surface.authority}` }))
+ return document
+}
+
+// OpenAPI 3.1 can express nullable references and compositions without relying on
+// Swagger extensions that the reference renderer ignores. Visit schema locations
+// only: example payloads may themselves contain keys named type or x-nullable.
+function projectSchemas(document) {
+ const from30 = document.openapi.startsWith('3.0')
+ function schema(value) {
+ if (!value || typeof value !== 'object') return value
+ for (const key of ['properties', 'patternProperties', '$defs', 'dependentSchemas']) {
+ for (const [name, child] of Object.entries(value[key] ?? {})) value[key][name] = schema(child)
+ }
+ for (const key of ['items', 'additionalProperties', 'not', 'contains', 'propertyNames', 'if', 'then', 'else', 'unevaluatedProperties', 'unevaluatedItems']) {
+ if (key in value) value[key] = schema(value[key])
+ }
+ for (const key of ['allOf', 'anyOf', 'oneOf', 'prefixItems']) {
+ if (Array.isArray(value[key])) value[key] = value[key].map(schema)
+ }
+ if (from30) {
+ for (const bound of ['Minimum', 'Maximum']) {
+ const key = 'exclusive' + bound
+ if (value[key] === true) value[key] = value[bound.toLowerCase()]
+ else if (value[key] === false) delete value[key]
+ }
+ }
+ const nullable = value['x-nullable'] === true || (from30 && value.nullable === true)
+ delete value['x-nullable']
+ if (from30) delete value.nullable
+ if (!nullable) return value
+ // A union also permits null for enum, $ref and allOf schemas; adding only
+ // type: [..., 'null'] would leave enum/composition constraints excluding null.
+ const result = { anyOf: [value, { type: 'null' }] }
+ for (const key of ['description', 'readOnly', 'writeOnly', 'deprecated', 'example', 'examples', 'default']) {
+ if (key in value) { result[key] = value[key]; delete value[key] }
+ }
+ return result
+ }
+ function visit(value) {
+ if (!value || typeof value !== 'object') return
+ for (const [key, child] of Object.entries(value)) {
+ if (key === 'schema') value[key] = schema(child)
+ else if (!['example', 'examples', 'default', 'enum'].includes(key) && !key.startsWith('x-')) visit(child)
+ }
+ }
+ for (const [name, value] of Object.entries(document.components?.schemas ?? {})) {
+ document.components.schemas[name] = schema(value)
+ }
+ // Components schemas were already handled and must not be interpreted as
+ // document objects (a property can legally be named "schema").
+ const { schemas, ...otherComponents } = document.components ?? {}
+ visit({ ...document, components: otherComponents })
+ if (from30) document.openapi = '3.1.0'
+}
diff --git a/apps/docs/scripts/contracts.test.mjs b/apps/docs/scripts/contracts.test.mjs
new file mode 100644
index 000000000..bf191d9af
--- /dev/null
+++ b/apps/docs/scripts/contracts.test.mjs
@@ -0,0 +1,85 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import yaml from 'js-yaml'
+import { createOpenAPI } from 'fumadocs-openapi/server'
+import { schemaToString } from '../node_modules/fumadocs-openapi/dist/utils/schema-to-string.js'
+import { appRoot, normalise, surfaces } from './contracts.mjs'
+
+test('public rendering preserves operation prose, schemas and project authentication', () => {
+ const fixture = { swagger: '2.0', info: { title: 'Example', version: '1' }, basePath: '/v1', paths: {
+ '/agents': { get: { tags: ['Agents'], description: 'A constraint that must remain visible.', security: [{ ProjectKey: [] }], responses: { 200: { description: 'Result', schema: { $ref: '#/definitions/Agent' } } } } },
+ }, definitions: { Agent: { type: 'object', properties: { id: { type: 'string' } } } }, securityDefinitions: { ProjectKey: { type: 'apiKey', in: 'header', name: 'Authorization' } } }
+ const rendered = normalise(surfaces[0], fixture)
+ assert.equal(rendered.paths['/agents'].get.description, fixture.paths['/agents'].get.description)
+ assert.deepEqual(rendered.paths['/agents'].get.security, [{ ProjectKey: [] }])
+ assert.equal(rendered.components.schemas.Agent.properties.id.type, 'string')
+ assert.equal(rendered.components.securitySchemes.ProjectKey.scheme, 'bearer')
+ assert.equal(rendered.servers[0].url, 'https://core.example.com/v1')
+})
+
+test('OpenAPI 3 is accepted without guessing its authority or changing its schemas', () => {
+ const fixture = { openapi: '3.0.3', info: { title: 'Example', version: '1' }, paths: {
+ '/core/v1/example': { get: { tags: ['Example'], responses: { 200: { description: 'OK' } } } },
+ }, components: { schemas: { Payload: { type: 'string', enum: ['exact'] } } } }
+ assert.deepEqual(normalise(surfaces[1], fixture).components.schemas, fixture.components.schemas)
+ assert.throws(() => normalise(surfaces[0], fixture), /credential boundary/)
+ assert.throws(() => normalise(surfaces[1], { ...fixture, openapi: '9.0' }), /Unsupported/)
+})
+
+test('actual Fumadocs renderer preserves nullable values, references and compositions', async (t) => {
+ const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'oac-docs-nullable-'))
+ t.after(() => fs.rmSync(directory, { recursive: true, force: true }))
+ const example = { schema: { type: 'string', 'x-nullable': true } }
+ const fixture = { swagger: '2.0', info: { title: 'Example', version: '1' }, paths: {}, definitions: {
+ Text: { type: 'string' },
+ Payload: { type: 'object', properties: {
+ text: { type: 'string', 'x-nullable': true, description: 'May be null.' },
+ reference: { $ref: '#/definitions/Text', 'x-nullable': true },
+ composed: { allOf: [{ $ref: '#/definitions/Text' }], 'x-nullable': true },
+ choice: { type: 'string', enum: ['only'], 'x-nullable': true },
+ titled: { type: 'string', title: 'Label', 'x-nullable': true },
+ requiredText: { type: 'string' },
+ sample: { type: 'object', example },
+ } },
+ } }
+ const original = structuredClone(fixture)
+ const projected = normalise(surfaces[0], fixture)
+ assert.equal(projected.openapi, '3.1.0')
+ assert.deepEqual(fixture, original, 'Canonical source must not be mutated')
+ assert.deepEqual(projected.components.schemas.Payload.properties.sample.example, example)
+ assert.deepEqual(projected.components.schemas.Payload.properties.choice.anyOf, [
+ { type: 'string', enum: ['only'] }, { type: 'null' },
+ ], 'Null must be allowed outside the enum constraint')
+ const file = path.join(directory, 'fixture.yaml')
+ fs.writeFileSync(file, yaml.dump(projected))
+ const docs = await createOpenAPI({ input: [file], disablePlayground: true }).getSchemas()
+ const properties = docs[file].dereferenced.components.schemas.Payload.properties
+ for (const [field, expected] of Object.entries({ text: 'string | null', reference: 'Text | null', composed: 'Text | null', choice: 'string | null', titled: 'Label | null', requiredText: 'string' })) {
+ assert.equal(schemaToString(properties[field], docs[file]), expected, field)
+ }
+ assert.equal(properties.text.description, 'May be null.')
+})
+
+test('actual generated public reference renders the pinned nullable error fields', async () => {
+ const file = path.join(appRoot, 'openapi/public-api.yaml')
+ const docs = await createOpenAPI({ input: [file], disablePlayground: true }).getSchemas()
+ const schemas = docs[file].dereferenced.components.schemas
+ for (const [name, field] of [['v1.Session', 'error'], ['v1.APIError', 'code'], ['v1.APIError', 'param']]) {
+ assert.equal(schemaToString(schemas[name].properties[field], docs[file]), 'string | null', `${name}.${field}`)
+ }
+})
+
+test('OpenAPI 3.0 schema conversion preserves bounds and binary annotations', () => {
+ const fixture = { openapi: '3.0.3', info: { title: 'Example', version: '1' }, paths: {}, components: { schemas: {
+ Number: { type: 'number', minimum: 1, exclusiveMinimum: true, maximum: 10, exclusiveMaximum: false, nullable: true },
+ File: { type: 'string', format: 'binary' },
+ } } }
+ const schemas = normalise(surfaces[0], fixture).components.schemas
+ assert.deepEqual(schemas.Number.anyOf, [
+ { type: 'number', minimum: 1, exclusiveMinimum: 1, maximum: 10 }, { type: 'null' },
+ ])
+ assert.deepEqual(schemas.File, fixture.components.schemas.File)
+})
diff --git a/apps/docs/scripts/generate-api-reference.mjs b/apps/docs/scripts/generate-api-reference.mjs
new file mode 100644
index 000000000..b9b706b46
--- /dev/null
+++ b/apps/docs/scripts/generate-api-reference.mjs
@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// Render the actual contracts without copying prose from superseded API surfaces.
+import { generateFilesOnly } from 'fumadocs-openapi'
+import { createOpenAPI } from 'fumadocs-openapi/server'
+import yaml from 'js-yaml'
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { appRoot, repoRoot, surfaces, sourcePath, normalise } from './contracts.mjs'
+const root = path.join(appRoot, 'content/docs/api-reference')
+fs.rmSync(root, { recursive: true, force: true })
+fs.mkdirSync(root, { recursive: true })
+fs.rmSync(path.join(appRoot, 'openapi'), { recursive: true, force: true })
+fs.mkdirSync(path.join(appRoot, 'openapi'))
+const record = { sources: {}, outputs: {} }
+const digest = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')
+for (const surface of surfaces) {
+ const output = path.join(appRoot, 'openapi', surface.id + '.yaml')
+ fs.writeFileSync(output, '# Generated documentation projection; do not edit.\n' + yaml.dump(normalise(surface), { lineWidth: -1, noRefs: true }))
+ const files = await generateFilesOnly({ input: createOpenAPI({ input: [output] }), per: 'tag' })
+ const directory = root + surface.directory
+ fs.mkdirSync(directory, { recursive: true })
+ for (const file of files) {
+ const target = path.join(directory, file.path)
+ fs.writeFileSync(target, file.content.replace(/document=\{[^}]*\}/, `document={${JSON.stringify(surface.id)}}`))
+ record.outputs[path.relative(appRoot, target)] = digest(target)
+ }
+ const pages = ['index', ...files.map(file => file.path.replace(/\.mdx$/, ''))]
+ if (!surface.directory) pages.push('core', 'machine')
+ fs.writeFileSync(path.join(directory, 'meta.json'), JSON.stringify({ title: surface.title, pages }, null, 2) + '\n')
+ const body = `---\ntitle: ${surface.title}\ndescription: ${surface.prefix} — ${surface.credential}.\n---\n\n${surface.authority}\n\n**Credential:** ${surface.credential}. Examples use reserved \`example.com\` origins. This reference does not send requests or collect credentials.\n\n${surface.id === 'runtime-api' ? 'This schema covers node configuration, enrollment and identity. Daemon WebSockets and executor connection details are described in the [machine overview](/public-api#machine-connection-api).\n\n' : ''}${surface.id === 'core-api' ? 'Operator scripts use Core’s loopback port. The public entry routes management through Web, which requires its signed-in session and supplies the Core key on the server.\n\n' : ''}[API namespaces and credentials](/public-api) · [Application reference](/api-reference) · [Administration reference](/api-reference/core) · [Machine reference](/api-reference/machine)\n\n` + files.map(file => `- [${file.path.replace(/\.mdx$/, '')}](/api-reference${surface.directory}/${file.path.replace(/\.mdx$/, '')})`).join('\n') + '\n'
+ fs.writeFileSync(path.join(directory, 'index.mdx'), body)
+ record.sources[path.relative(repoRoot, sourcePath(surface))] = digest(sourcePath(surface))
+ record.outputs[path.relative(appRoot, output)] = digest(output)
+ for (const name of ['meta.json', 'index.mdx']) record.outputs[path.relative(appRoot, path.join(directory, name))] = digest(path.join(directory, name))
+ console.log(surface.id + ': ' + files.length + ' tag pages')
+}
+fs.writeFileSync(path.join(appRoot, 'openapi/sources.json'), JSON.stringify(record, null, 2) + '\n')
diff --git a/apps/docs/scripts/generate-guides.mjs b/apps/docs/scripts/generate-guides.mjs
new file mode 100644
index 000000000..a40b69592
--- /dev/null
+++ b/apps/docs/scripts/generate-guides.mjs
@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+// The site renders current repository guides instead of maintaining a second manual.
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+const app = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const repo = path.resolve(app, '../..')
+const guides = JSON.parse(fs.readFileSync(path.join(app, 'scripts/guides.json'), 'utf8'))
+const routes = new Map(guides.map(g => [g.source, g.slug === 'index' ? '/' : '/' + g.slug]))
+const sourceRevision = '75bf4484ba957344ae374354858bbdfe104f5c4f'
+const sourceURL = relative => `https://github.com/MiniMax-AI/parsar-core/blob/${sourceRevision}/${relative}`
+const digest = text => crypto.createHash('sha256').update(text).digest('hex')
+function mdx(text) {
+ let fence = false
+ return text.split('\n').map(line => {
+ if (/^\s*(```|~~~)/.test(line)) { fence = !fence; return line }
+ if (fence) return line
+ return line.split(/(`+[^`]*`+)/g).map((part, i) => i % 2 ? part : part.replaceAll('{', '{').replaceAll('}', '}').replaceAll('<', '<')).join('')
+ }).join('\n')
+}
+const record = { revision: sourceRevision, sources: {}, outputs: {} }
+// Only this generated asset directory is cleared; authored diagrams remain separate.
+fs.rmSync(path.join(app, 'public/images/source'), { recursive: true, force: true })
+for (const guide of guides) {
+ const original = fs.readFileSync(path.join(repo, guide.source), 'utf8')
+ let body = original.replace(/^# [^\n]*\n/, '').replace(//g, '').replace(/^```caddyfile$/gm, '```text')
+ body = body.replace(/(!?\[[^\]]*\])\(([^\s)]+)\)/g, (full, label, target) => {
+ if (/^(?:[a-z]+:|#|\/)/i.test(target)) return full
+ const [file, anchor] = target.split('#')
+ const relative = path.posix.normalize(path.posix.join(path.posix.dirname(guide.source), file))
+ if (!fs.existsSync(path.join(repo, relative))) throw new Error('Missing guide link: ' + guide.source + ' -> ' + target)
+ let url = routes.get(relative) ?? sourceURL(relative)
+ if (label.startsWith('!')) {
+ const imageSource = guide.images?.[relative] ?? relative
+ const asset = 'public/images/source/' + imageSource
+ const bytes = fs.readFileSync(path.join(repo, imageSource))
+ fs.mkdirSync(path.dirname(path.join(app, asset)), { recursive: true })
+ fs.writeFileSync(path.join(app, asset), bytes)
+ record.sources[imageSource] = digest(bytes)
+ record.outputs[asset] = digest(bytes)
+ url = '/' + asset.slice('public/'.length)
+ }
+ return label + '(' + url + (anchor ? '#' + anchor : '') + ')'
+ })
+ const en = `---\ntitle: ${JSON.stringify(guide.title)}\ndescription: ${JSON.stringify(guide.description)}\n---\n\n` + (guide.slug === 'execution-model' ? '\n\n' : '') + mdx(body.trim()) + `\n\n[Repository source](${sourceURL(guide.source)})\n`
+ const zh = `---\ntitle: ${JSON.stringify(guide.title + ' · 中文导读')}\ndescription: "当前版本的中文导读；完整操作步骤见英文正文。"\n---\n\n${guide.zh.replaceAll('<', '<')}\n\n此页为中文导读，完整且与当前源码同步的步骤请阅读[英文正文](/en/${guide.slug === 'index' ? '' : guide.slug})。\n\n[安装](/install) · [配置](/configure) · [API 与凭据](/public-api) · [节点](/hosted-providers) · [应用示例](/quickstart)\n`
+ for (const [suffix, text] of [['', en], ['.zh', zh]]) {
+ const relative = `content/docs/${guide.slug}${suffix}.mdx`
+ fs.writeFileSync(path.join(app, relative), text)
+ record.outputs[relative] = digest(text)
+ }
+ record.sources[guide.source] = digest(original)
+}
+record.sources['apps/docs/scripts/guides.json'] = digest(fs.readFileSync(path.join(app, 'scripts/guides.json')))
+fs.writeFileSync(path.join(app, 'content/guide-sources.json'), JSON.stringify(record, null, 2) + '\n')
+console.log('Rendered ' + guides.length + ' current guides and Chinese reading notes.')
diff --git a/apps/docs/scripts/guides.json b/apps/docs/scripts/guides.json
new file mode 100644
index 000000000..a842dfc8a
--- /dev/null
+++ b/apps/docs/scripts/guides.json
@@ -0,0 +1,124 @@
+[
+ {
+ "slug": "index",
+ "source": "docs/getting-started/README.md",
+ "title": "OpenAgentCore documentation",
+ "description": "Install Core and Web, create a Project API key, and add execution capacity.",
+ "zh": "安装 Core 与 Web，用 Core key 登录 Web，创建项目并签发应用 API key，然后添加执行节点。应用使用 /v1；Web 的服务端使用 /core/v1；机器连接使用 /api/v1。"
+ },
+ {
+ "slug": "concepts",
+ "source": "docs/design-principles.md",
+ "title": "Concepts and ownership",
+ "description": "Projects, credentials and the boundary between applications, administration and execution.",
+ "zh": "Project 拥有应用资源和执行身份。同一项目的 API keys 共享资源；Core key 只用于管理。Core 负责执行事实，Web 不复制执行所有权。"
+ },
+ {
+ "slug": "execution-model",
+ "source": "docs/web/architecture.md",
+ "title": "Execution and API architecture",
+ "description": "Applications call the public API; the administrator browser calls Web; Runtime connects to Core.",
+ "zh": "应用直接用 Project API key 调用 Core 的 /v1。管理员浏览器通过 Web 会话操作管理界面，Web 服务端持有 Core key。节点和 Runtime 用专属凭据直接连接 Core。"
+ },
+ {
+ "slug": "install",
+ "source": "docs/getting-started/install.md",
+ "title": "Install Core and Web",
+ "description": "Current distribution, host prerequisites, HTTPS, first sign-in and installation options.",
+ "zh": "安装器默认在 ~/.oac/core 安装 Core、Web 和专用 PostgreSQL，初始没有执行节点。先确定公网 HTTPS 地址，按当前版本的校验步骤下载并安装，再用 Core key 登录 Web。"
+ },
+ {
+ "slug": "configure",
+ "source": "docs/configuration.md",
+ "title": "Configuration reference",
+ "description": "The operator config.json, generated files and database-owned runtime settings.",
+ "zh": "安装配置的唯一编辑入口是 config.json；运行 oac apply 应用变更。generated 目录由安装器生成。运行时后端、节点和默认模型由 Web 管理并保存在 PostgreSQL 中。"
+ },
+ {
+ "slug": "bootstrap-projects-keys",
+ "source": "docs/web/core-connection.md",
+ "title": "Sign in and issue application keys",
+ "description": "Keep the Core key on the management side and issue Project API keys through Web.",
+ "zh": "使用 Core key 登录 Web。应用开发者在项目中获取 Project API key，设置 OPENAI_BASE_URL 与 OPENAI_API_KEY。Core key 不能用来调用 /v1，应用 key 也不能调用管理或机器接口。"
+ },
+ {
+ "slug": "quickstart",
+ "source": "docs/getting-started/quickstart.md",
+ "title": "Call the Agent API",
+ "description": "Use the pinned SDK, a Project API key and an explicit model provider to run a Session.",
+ "zh": "应用设置 OPENAI_BASE_URL=https://core.example.com/v1 和 OPENAI_API_KEY=，使用文档固定的 SDK 版本。先配置执行后端和模型，再创建 Session 并读取 Turn 结果。"
+ },
+ {
+ "slug": "public-api",
+ "source": "docs/api/README.md",
+ "title": "API namespaces and credentials",
+ "description": "The public application API, private administration API and machine connection interface.",
+ "zh": "/v1 使用 Project API key；/core/v1 使用 Core key，由 Web 服务端或管理员脚本调用；/api/v1 只接受对应的节点、注册、daemon 或 executor 凭据。这三类凭据不能互换。"
+ },
+ {
+ "slug": "agents-and-tools",
+ "source": "contracts/agents-api/execution-tools.md",
+ "title": "Agents, tools and harnesses",
+ "description": "Native harness tools, shared declarations and the limits of execution support.",
+ "zh": "保存 Agent 只保存配置，不启动执行。工具声明由所选原生 harness 执行；Codex、Claude Code 与 MiniMax Code 的能力和限制不同。x_agents_core 保留原有扩展字段名称。"
+ },
+ {
+ "slug": "sessions",
+ "source": "docs/api/public-agent-api.md",
+ "title": "Sessions and public resources",
+ "description": "Agents, Sessions, Turns, events and resources in the pinned public contract.",
+ "zh": "Session 是持久对话上下文，绑定一个 Environment。输入事件启动或引导 Turn。Session、Turn 和 Environment 的状态各有含义，不应互相替代；具体字段以公共参考为准。"
+ },
+ {
+ "slug": "environments-and-files",
+ "source": "contracts/agents-api/environments.md",
+ "title": "Environments and files",
+ "description": "Execution placement, Environment resources and workspace ownership.",
+ "zh": "Environment 与 Session 一起创建。none、self_hosted、openai_hosted 是协议中的执行位置名称；openai_hosted 在这里表示 Core 管理的计算资源。文件和工作区仍由对应资源及执行所有者管理。"
+ },
+ {
+ "slug": "hosted-providers",
+ "source": "docs/getting-started/nodes.md",
+ "title": "Nodes and hosted providers",
+ "description": "Add and remove Docker or microsandbox nodes; diagnose connection and readiness.",
+ "zh": "在 Web 的 Nodes 页面添加节点，并在目标主机执行经过校验的命令。sudo 模式使用 oac-node 系统账户；无 sudo 模式使用用户服务。旧名称的同一安装实例必须先按旧版本流程移除，再添加。"
+ },
+ {
+ "slug": "self-hosted-execution",
+ "source": "docs/getting-started/self-hosted.md",
+ "title": "Self-hosted executors",
+ "description": "Connect a user-owned Runtime to its Environment with a restricted executor credential.",
+ "zh": "self_hosted 执行器由用户拥有，Core 不管理它的容器。通过 Web 为对应 Environment 签发 executor 凭据，安装器通过隐藏输入或私有文件读取凭据；不要把凭据放入命令行。"
+ },
+ {
+ "slug": "console",
+ "source": "docs/web/README.md",
+ "title": "Administrator console",
+ "description": "Monitor Core, inspect resources and manage deployment settings through Web.",
+ "zh": "Web 是管理员控制台，提供 Monitor、Resources 和 Platform 操作。浏览器使用管理会话；Core key 作为上游凭据保留在 Web 服务端。应用 API 的执行请求不经过 Web。",
+ "images": {
+ "docs/web/images/overview.png": "apps/web/public/onboarding/monitor-en.webp"
+ }
+ },
+ {
+ "slug": "admin-api",
+ "source": "docs/api/web-management.md",
+ "title": "Core administration API",
+ "description": "Management operations and their server-side credential boundary.",
+ "zh": "管理员脚本通过 Core 的回环端口调用 /core/v1，并使用 Core key。公网入口的 /core/v1 由 Web 管理会话处理；不能把它当成应用 API 或机器连接的代理。"
+ },
+ {
+ "slug": "observability",
+ "source": "contracts/agents-api/runtime-observability-api.md",
+ "title": "Runtime observations",
+ "description": "Current Runtime observations, recorded history and their availability limits.",
+ "zh": "当前 Runtime 观测与已保存历史是不同的数据。离线或陈旧数据不代表当前健康状态；查看来源、时间和可用性，执行事实仍以 Core 为准。"
+ },
+ {
+ "slug": "troubleshooting",
+ "source": "docs/getting-started/operations.md",
+ "title": "Operations and troubleshooting",
+ "description": "oac lifecycle commands, backups, key rotation, upgrades and diagnostics.",
+ "zh": "使用 oac status 查看安装状态，oac doctor 诊断配置，oac apply 应用 config.json。备份必须同时保留数据库、配置和密钥。升级按当前指南执行；不要假设在线 generation 更新或 reset 已实现。"
+ }
+]
diff --git a/apps/docs/scripts/test_contract_routes.py b/apps/docs/scripts/test_contract_routes.py
new file mode 100644
index 000000000..243b9dd75
--- /dev/null
+++ b/apps/docs/scripts/test_contract_routes.py
@@ -0,0 +1,28 @@
+"""Regression coverage for nested router helpers and exact namespace inheritance."""
+import importlib.util
+from pathlib import Path
+import unittest
+
+spec = importlib.util.spec_from_file_location("routes", Path(__file__).with_name("verify-contract-routes.py"))
+routes = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(routes)
+
+
+class RouteTests(unittest.TestCase):
+ def test_nested_registration_inherits_parent_scope(self):
+ region = routes.Region('''router.Route("/core/v1", func(r chi.Router) {
+ r.Group(func(inner chi.Router) {
+ h.registerNestedRoutes(inner)
+ })
+ })''')
+ self.assertEqual(region.calls({"router": ""}), [("registerNestedRoutes", "/core/v1")])
+ child = routes.Region('r.Get("/projects/{project_id}", h.getProject)')
+ self.assertEqual(child.routes({"r": "/core/v1"}), [("/core/v1/projects/{project_id}", "GET")])
+
+ def test_unrelated_router_does_not_acquire_a_prefix(self):
+ region = routes.Region('unknown.Get("/projects", handler)')
+ self.assertEqual(region.routes({"r": "/core/v1"}), [])
+
+
+if __name__ == "__main__":
+ unittest.main()
diff --git a/apps/docs/scripts/verify-api-copy.mjs b/apps/docs/scripts/verify-api-copy.mjs
new file mode 100644
index 000000000..743a100ef
--- /dev/null
+++ b/apps/docs/scripts/verify-api-copy.mjs
@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+// Compare every rendered operation and schema with the current contract projection.
+import fs from 'node:fs'
+import path from 'node:path'
+import yaml from 'js-yaml'
+import assert from 'node:assert/strict'
+import { appRoot, surfaces, normalise, methods } from './contracts.mjs'
+let count = 0
+for (const surface of surfaces) {
+ const actual = yaml.load(fs.readFileSync(path.join(appRoot, 'openapi', surface.id + '.yaml'), 'utf8'))
+ assert.deepEqual(actual, normalise(surface), surface.id + ': rendered contract differs')
+ const listed = []
+ const dir = path.join(appRoot, 'content/docs/api-reference') + surface.directory
+ for (const name of fs.readdirSync(dir).filter(n => n.endsWith('.mdx') && n !== 'index.mdx')) {
+ const content = fs.readFileSync(path.join(dir, name), 'utf8')
+ assert.ok(content.includes('document={' + JSON.stringify(surface.id) + '}'), 'Wrong reference credential surface: ' + name)
+ const operations = content.match(/operations=\{(\[[\s\S]*?\])\}/)
+ assert.ok(operations, 'Missing operations: ' + name)
+ for (const op of JSON.parse(operations[1])) listed.push(op.method + ' ' + op.path)
+ }
+ const expected = Object.entries(actual.paths).flatMap(([route, item]) => methods.filter(m => item[m]).map(m => m + ' ' + route))
+ assert.deepEqual([...new Set(listed)].sort(), expected.sort(), 'Missing or obsolete API page: ' + surface.id)
+ count += expected.length
+}
+console.log(count + ' operations, schemas, descriptions and credential surfaces match current contracts.')
diff --git a/apps/docs/scripts/verify-contract-freshness.mjs b/apps/docs/scripts/verify-contract-freshness.mjs
new file mode 100644
index 000000000..785c6dc3c
--- /dev/null
+++ b/apps/docs/scripts/verify-contract-freshness.mjs
@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// Source and output digests catch both stale generation and edited generated prose.
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import assert from 'node:assert/strict'
+import { appRoot, repoRoot, surfaces } from './contracts.mjs'
+const record = JSON.parse(fs.readFileSync(path.join(appRoot, 'openapi/sources.json')))
+assert.deepEqual(Object.keys(record.sources).sort(), surfaces.map(s => 'contracts/agents-api/' + s.file).sort())
+function filesUnder(directory) {
+ return fs.readdirSync(directory, { withFileTypes: true }).flatMap(entry => {
+ const file = path.join(directory, entry.name)
+ return entry.isDirectory() ? filesUnder(file) : [path.relative(appRoot, file)]
+ })
+}
+const rendered = [...filesUnder(path.join(appRoot, 'openapi')), ...filesUnder(path.join(appRoot, 'content/docs/api-reference'))]
+ .filter(file => file !== 'openapi/sources.json')
+assert.deepEqual(rendered.sort(), Object.keys(record.outputs).sort(), 'Unexpected or missing generated reference files')
+for (const [root, entries] of [[repoRoot, record.sources], [appRoot, record.outputs]]) {
+ for (const [relative, digest] of Object.entries(entries)) {
+ assert.equal(crypto.createHash('sha256').update(fs.readFileSync(path.join(root, relative))).digest('hex'), digest, 'Regenerate API reference: ' + relative)
+ }
+}
+console.log('All three contract sources and generated references are current.')
diff --git a/apps/docs/scripts/verify-contract-routes.py b/apps/docs/scripts/verify-contract-routes.py
new file mode 100644
index 000000000..c9f51d2f5
--- /dev/null
+++ b/apps/docs/scripts/verify-contract-routes.py
@@ -0,0 +1,227 @@
+#!/usr/bin/env python3
+"""Check the generated OpenAPI contracts against the routes the code registers.
+
+The public contract is constrained by its pinned upstream baseline; Core and
+machine contracts are generated from handler annotations. This reads the real
+`chi` route table from services/agents-api/internal/api and compares all three
+contracts with the registered paths.
+
+Two checks:
+ [A] routes the code registers that no contract publishes
+ [B] paths a contract publishes that the code never registers <- the real bug
+
+Scope resolution is brace-matched rather than line-based, because chi nests
+`Route(prefix, func(r chi.Router) { ... })` and the same variable name is reused
+at each level.
+
+Read-only. Usage (from apps/docs):
+ node scripts/check-python.mjs routes
+"""
+
+from __future__ import annotations
+
+import json
+import pathlib
+import re
+import sys
+
+
+APP = pathlib.Path(__file__).resolve().parent.parent
+REPO = APP.parent.parent
+API = REPO / "services/agents-api/internal/api"
+
+
+VERBS = ("Get", "Post", "Put", "Patch", "Delete", "Head", "Options", "Trace")
+ROUTE = re.compile(r"\b(\w+)\.(%s)\(\s*([^,)]+?)\s*[,)]" % "|".join(VERBS))
+METHOD = re.compile(r"\b(\w+)\.Method\(\s*(\"[^\"]+\"|[\w.]+)\s*,\s*(\"[A-Za-z]+\"|http\.Method[A-Za-z]+)")
+BLOCK = re.compile(r"\b(\w+)\.(Route|Group)\(\s*(?:\"([^\"]*)\"\s*,\s*)?func\(\s*(\w+)\s+chi\.Router")
+CALL = re.compile(r"\bh\.(register\w+Routes)\(\s*(\w+)\s*\)")
+FUNC = re.compile(r"^func\s+(?:\([^)]*\)\s+)?(register\w+Routes)\(\s*(\w+)\s+chi\.Router", re.M)
+CONST = re.compile(r"\bconst\s+(\w+)\s*=\s*\"([^\"]*)\"")
+
+IGNORED = {("/healthz", "GET"): "liveness probe, not part of the Agent API"}
+
+# Differences between the contract and the registered route that the reference
+# accepts on purpose, keyed (path, method) as the contract spells them.
+ACCEPTED = {}
+
+# A HEAD route wired to `methodNotAllowed` is an explicit 405 guard, not an API.
+GUARD = re.compile(r"\.(Head|Options|Get|Post)\(\s*([^,]+),\s*methodNotAllowed\s*\)")
+
+
+def brace_end(text: str, start: int) -> int:
+ depth = 0
+ for index in range(start, len(text)):
+ if text[index] == "{":
+ depth += 1
+ elif text[index] == "}":
+ depth -= 1
+ if depth == 0:
+ return index
+ return len(text)
+
+
+class Region:
+ def __init__(self, text: str):
+ self.text = text
+ self.consts = {name: value for name, value in CONST.findall(text)}
+ self.blocks = []
+ for match in BLOCK.finditer(text):
+ brace = text.find("{", match.end())
+ if brace < 0:
+ continue
+ self.blocks.append(
+ {
+ "outer": match.group(1),
+ "inner": match.group(4),
+ "prefix": match.group(3) or "",
+ "own": match.group(2) == "Route",
+ "start": match.start(),
+ "open": brace,
+ "end": brace_end(text, brace),
+ }
+ )
+
+ def _enclosing(self, position: int):
+ inside = [b for b in self.blocks if b["open"] < position < b["end"]]
+ inside.sort(key=lambda b: b["open"])
+ return inside
+
+ def prefix_of(self, var: str, position: int, seed: dict[str, str]) -> str | None:
+ """Prefix for a router variable at a position, or None if unknown."""
+ for block in reversed(self._enclosing(position)):
+ if block["inner"] == var:
+ outer = self.prefix_of(block["outer"], block["start"], seed)
+ if outer is None:
+ return None
+ return outer + block["prefix"] if block["own"] else outer
+ return seed.get(var)
+
+ def literal(self, expr: str) -> str | None:
+ parts = re.split(r"\s*\+\s*", expr.strip())
+ out = ""
+ for part in parts:
+ part = part.strip()
+ if len(part) >= 2 and part[0] == '"' and part[-1] == '"':
+ out += part[1:-1]
+ elif part in self.consts:
+ out += self.consts[part]
+ else:
+ return None
+ return out or None
+
+ def routes(self, seed: dict[str, str]):
+ found: list[tuple[str, str]] = []
+ for match in ROUTE.finditer(self.text):
+ var, verb, expr = match.group(1), match.group(2), match.group(3)
+ path = self.literal(expr)
+ if path is None or not path.startswith("/"):
+ continue
+ prefix = self.prefix_of(var, match.start(), seed)
+ if prefix is None:
+ continue
+ found.append((prefix + path, verb.upper()))
+ for match in METHOD.finditer(self.text):
+ var, target, verb = match.group(1), match.group(2), match.group(3)
+ path = self.literal(target)
+ if path is None or not path.startswith("/"):
+ continue
+ prefix = self.prefix_of(var, match.start(), seed)
+ if prefix is None:
+ continue
+ method = verb.split(".")[-1] if verb.startswith("http.") else verb.strip('"')
+ found.append((prefix + path, method.upper()))
+ return found
+
+ def calls(self, seed: dict[str, str]):
+ out = []
+ for match in CALL.finditer(self.text):
+ prefix = self.prefix_of(match.group(2), match.start(), seed)
+ out.append((match.group(1), prefix if prefix is not None else ""))
+ return out
+
+
+def main() -> int:
+ files = [f for f in sorted(API.glob("*.go")) if not f.name.endswith("_test.go")]
+ texts = {f.name: f.read_text(encoding="utf-8").replace("\r\n", "\n") for f in files}
+
+ helpers = {}
+ for name, text in texts.items():
+ for match in FUNC.finditer(text):
+ brace = text.find("{", match.end())
+ helpers[match.group(1)] = (name, match.group(2), brace, brace_end(text, brace))
+
+ # Pass 1: everything except helper bodies.
+ code: dict[tuple[str, str], str] = {}
+ calls: list[tuple[str, str]] = []
+ for name, text in texts.items():
+ masked = list(text)
+ for fn, (hfile, _, brace, end) in helpers.items():
+ if hfile != name:
+ continue
+ for index in range(brace, min(end + 1, len(masked))):
+ if masked[index] != "\n":
+ masked[index] = " "
+ region = Region("".join(masked))
+ root = {"router": "", "r": ""}
+ for path, method in region.routes(root):
+ code.setdefault((path, method), name)
+ calls.extend(region.calls(root))
+
+ # Follow nested registration calls with the actual prefix from their caller.
+ seen = set()
+ while calls:
+ fn, prefix = calls.pop()
+ if (fn, prefix) in seen:
+ continue
+ seen.add((fn, prefix))
+ if fn not in helpers:
+ raise ValueError("Unknown route registration helper: " + fn)
+ name, param, brace, end = helpers[fn]
+ region = Region(texts[name][brace : end + 1])
+ for route, method in region.routes({param: prefix}):
+ code.setdefault((route, method), name)
+ calls.extend(region.calls({param: prefix}))
+
+ documented: dict[tuple[str, str], str] = {}
+ # YAML is decoded by the declared Node dependency; Python uses only stdlib.
+ for contract in json.load(sys.stdin):
+ document, label = contract["document"], contract["label"]
+ base = (document.get("basePath") or "").rstrip("/")
+ for route, item in (document.get("paths") or {}).items():
+ for method in item:
+ if method in ("get", "post", "put", "patch", "delete", "head", "options"):
+ documented.setdefault(((base + route) or "/", method.upper()), label)
+
+ guard_paths = set()
+ for name, text in texts.items():
+ for match in GUARD.finditer(text):
+ guard_paths.add(match.group(2).strip().strip('"'))
+
+ unpublished = sorted(k for k in code if k not in documented)
+ missing = sorted(k for k in documented if k not in code)
+
+ print(" Registered (method, path): %d" % len(code))
+ print(" Contract operations: %d" % len(documented))
+ print()
+ guards = [k for k in unpublished if k[1] == "HEAD" and any(k[0].endswith(suffix) for suffix in guard_paths)]
+ real = [k for k in unpublished if k not in guards]
+ undocumented = [k for k in real if k not in IGNORED]
+ print(" [A] Registered but not published: %d (%d explicit HEAD guards)" % (len(unpublished), len(guards)))
+ for path, method in real:
+ note = IGNORED.get((path, method), "")
+ print(" %-6s %-72s %s%s" % (method, path, code[(path, method)], (" <- " + note) if note else ""))
+ print()
+ accepted = [k for k in missing if k in ACCEPTED]
+ real = [k for k in missing if k not in ACCEPTED]
+
+ print(" [B] Published but not registered: %d (%d accepted differences)" % (len(missing), len(accepted)))
+ for path, method in real:
+ print(" %-6s %-72s [%s]" % (method, path, documented[(path, method)]))
+ for path, method in accepted:
+ print(" ok %-72s %s" % (path, ACCEPTED[(path, method)]))
+ return 1 if real or undocumented else 0
+
+
+if __name__ == "__main__":
+ sys.exit(main())
diff --git a/apps/docs/scripts/verify-docs-facts.mjs b/apps/docs/scripts/verify-docs-facts.mjs
new file mode 100644
index 000000000..d8c7522ae
--- /dev/null
+++ b/apps/docs/scripts/verify-docs-facts.mjs
@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// Guide source drift requires regeneration and a review of the Chinese reading notes.
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import assert from 'node:assert/strict'
+import { fileURLToPath } from 'node:url'
+const app = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const repo = path.resolve(app, '../..')
+const record = JSON.parse(fs.readFileSync(path.join(app, 'content/guide-sources.json')))
+for (const [root, entries] of [[repo, record.sources], [app, record.outputs]]) {
+ for (const [relative, digest] of Object.entries(entries)) {
+ assert.equal(crypto.createHash('sha256').update(fs.readFileSync(path.join(root, relative))).digest('hex'), digest, 'Regenerate guides and review translations: ' + relative)
+ }
+}
+const source = slug => fs.readFileSync(path.join(app, 'content/docs', slug + '.mdx'), 'utf8')
+for (const token of ['/v1', '/core/v1', '/api/v1', 'Project API key', 'Core key', 'executor']) assert.ok(source('public-api').includes(token), 'Credential matrix omits ' + token)
+for (const token of ['config.json', 'oac apply']) assert.ok(source('configure').includes(token), 'Configuration guide omits ' + token)
+for (const token of ['oac-node', '~/.oac/nodes']) assert.ok(source('hosted-providers').includes(token), 'Node guide omits ' + token)
+for (const token of ['oac-selfhost', '~/.oac/self-hosted']) assert.ok(source('self-hosted-execution').includes(token), 'Executor guide omits ' + token)
+for (const file of fs.readdirSync(path.join(app, 'content/docs')).filter(n => n.endsWith('.mdx'))) {
+ const text = fs.readFileSync(path.join(app, 'content/docs', file), 'utf8')
+ for (const retired of ['/core/v1/admin', 'sandbox-manager.openapi.yaml']) assert.ok(!text.includes(retired), 'Obsolete claim in ' + file + ': ' + retired)
+}
+assert.ok(fs.readFileSync(path.join(app, 'FOLLOW-UP.md'), 'utf8').includes('design 50'), 'Missing deferred feature inventory')
+assert.deepEqual(fs.readFileSync(path.join(app, 'app/icon.png')), fs.readFileSync(path.join(repo, 'apps/web/public/favicon.png')), 'Docs favicon must match the approved Web asset')
+console.log('Guide copies, source authority and namespace/configuration facts are current.')
diff --git a/apps/docs/scripts/verify-links.mjs b/apps/docs/scripts/verify-links.mjs
new file mode 100644
index 000000000..bcef7a532
--- /dev/null
+++ b/apps/docs/scripts/verify-links.mjs
@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+// Fails when a page links to a route that does not exist.
+//
+// The manual is a reading path: install, configure, bootstrap a Project, make a
+// request, add capacity. A link that 404s breaks that path silently, because the
+// page it lives on still renders. This resolves every root-relative link against
+// the page files themselves, so it needs no running server.
+//
+// `content/docs/api-reference/*` is generated in English only, and fumadocs
+// serves the default language for a missing translation, so a Chinese page may
+// link to the English route and have it resolve. A link is therefore accepted
+// when the target exists in either locale.
+//
+// Markdown that is not a page - the README - is checked too, against the
+// filesystem, because its links are relative file paths. Removing a file it
+// points at is otherwise invisible until a reviewer clicks it.
+//
+// Read-only. Run from apps/docs: node scripts/verify-links.mjs
+
+import fs from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const contentRoot = path.resolve(here, "../content/docs")
+const appRoot = path.resolve(here, "..")
+
+function mdxFiles(dir) {
+ const out = []
+ for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+ const full = path.join(dir, entry.name)
+ if (entry.isDirectory()) out.push(...mdxFiles(full))
+ else if (entry.name.endsWith(".mdx")) out.push(full)
+ }
+ return out
+}
+
+// index.mdx is the directory itself; index.zh.mdx is its Chinese counterpart.
+function routeOf(file) {
+ const rel = path.relative(contentRoot, file).replace(/\.mdx$/, "")
+ const parts = rel.split(path.sep)
+ let name = parts.pop()
+ const isZh = name.endsWith(".zh")
+ if (isZh) name = name.slice(0, -3)
+ const slug = name === "index" ? parts.join("/") : [...parts, name].join("/")
+ const base = slug ? `/${slug}` : "/"
+ return isZh ? (base === "/" ? "/zh" : `/zh${base}`) : base
+}
+
+const files = mdxFiles(contentRoot)
+const routes = new Set(files.map(routeOf))
+
+function resolves(target) {
+ const [rawPath, anchor] = target.split("#")
+ const clean = rawPath.split("?")[0].replace(/^\/en(?=\/|$)/, "") || "/"
+ if (clean.startsWith("/images/")) return fs.existsSync(path.join(appRoot, "public", clean))
+ const route = clean.length > 1 ? clean.replace(/\/+$/, "") : clean
+ const bare = route === "/zh" ? "/" : route.startsWith("/zh/") ? route.slice(3) : route
+ const targetFile = files.find(file => routeOf(file) === bare)
+ if (!targetFile) return false
+ if (!anchor) return true
+ const text = fs.readFileSync(targetFile, "utf8")
+ const seen = new Map()
+ const anchors = []
+ let fence = false
+ for (const line of text.split("\n")) {
+ if (/^\s*(```|~~~)/.test(line)) { fence = !fence; continue }
+ if (fence) continue
+ const heading = line.match(/^#{1,6} (.+)$/)
+ if (!heading) continue
+ const value = heading[1].replace(/`/g, "").replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
+ .toLowerCase().replace(/[^\p{L}\p{N}_\s-]/gu, "").replace(/\s/g, "-")
+ const previous = seen.get(value) ?? 0
+ seen.set(value, previous + 1)
+ anchors.push(value + (previous ? "-" + previous : ""))
+ }
+ return anchors.includes(decodeURIComponent(anchor))
+}
+
+const link = /\]\(([^)\s]+)/g
+let checked = 0
+let broken = 0
+
+for (const file of files) {
+ const source = fs.readFileSync(file, "utf8")
+ for (const [, target] of source.matchAll(link)) {
+ if (!target.startsWith("/")) continue
+ checked += 1
+ if (!resolves(target)) {
+ console.error(
+ `BROKEN ${path.relative(contentRoot, file)}\n` +
+ ` claim: every root-relative link points at a page that exists\n` +
+ ` link: ${target}`,
+ )
+ broken += 1
+ }
+ }
+}
+
+// This package also ships markdown that is not a page. Its links are relative
+// file paths, so they are resolved against the filesystem instead of the routes.
+const packageDocs = fs
+ .readdirSync(appRoot, { withFileTypes: true })
+ .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
+ .map((entry) => path.join(appRoot, entry.name))
+
+let fileLinks = 0
+for (const file of packageDocs) {
+ const source = fs.readFileSync(file, "utf8")
+ for (const [, target] of source.matchAll(link)) {
+ if (target.startsWith("/") || /^[a-z][a-z0-9+.-]*:/i.test(target)) continue
+ fileLinks += 1
+ const resolved = path.resolve(path.dirname(file), target.split("#")[0])
+ if (!fs.existsSync(resolved)) {
+ console.error(
+ `BROKEN ${path.relative(appRoot, file)}\n` +
+ ` claim: every relative link points at a file that exists\n` +
+ ` link: ${target}`,
+ )
+ broken += 1
+ }
+ }
+}
+
+if (broken > 0) {
+ console.error(`\n${broken} of ${checked + fileLinks} links are unresolvable.`)
+ process.exit(1)
+}
+console.log(
+ `${checked} root-relative links resolve across ${files.length} pages, and ` +
+ `${fileLinks} relative links resolve across ${packageDocs.length} package files.`,
+)
diff --git a/apps/docs/scripts/verify-prerender.mjs b/apps/docs/scripts/verify-prerender.mjs
new file mode 100644
index 000000000..17f53b6cc
--- /dev/null
+++ b/apps/docs/scripts/verify-prerender.mjs
@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// Asserts that `next build` actually wrote a prerendered page for every route.
+//
+// This guards a regression that is invisible in the build log. A single
+// request-scoped API anywhere in the `[lang]/[[...slug]]` render tree — in the
+// page, in a layout, or in the `not-found` boundary — makes Next render every
+// docs page per request. The build summary still prints `● (SSG)` and still
+// lists all the paths, but no `.html`/`.rsc` files are emitted and every
+// response comes back `Cache-Control: no-store`.
+//
+// The cost lands hardest on the generated API reference: those pages render a
+// whole OpenAPI surface, so a navigation that should take 30 ms took 2–3 s.
+//
+// Usage, after `pnpm build`:
+//
+// node scripts/verify-prerender.mjs
+
+import fs from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const root = path.resolve(here, "..")
+const contentRoot = path.join(root, "content/docs")
+const appRoot = path.join(root, ".next/server/app")
+
+if (!fs.existsSync(appRoot)) {
+ console.error(`No build output at ${path.relative(root, appRoot)}. Run \`pnpm build\` first.`)
+ process.exit(1)
+}
+
+function walk(dir) {
+ const out = []
+ for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+ const full = path.join(dir, entry.name)
+ if (entry.isDirectory()) out.push(...walk(full))
+ else if (entry.name.endsWith(".mdx")) out.push(full)
+ }
+ return out
+}
+
+function slugFor(file) {
+ let rel = path.relative(contentRoot, file).split(path.sep).join("/")
+ rel = rel.replace(/\.zh\.mdx$/, "").replace(/\.mdx$/, "").replace(/(^|\/)index$/, "")
+ return rel.replace(/\/$/, "")
+}
+
+// Every page is generated in both locales: an untranslated page falls back to
+// the default language, so `/zh/` is a real route either way.
+const slugs = [...new Set(walk(contentRoot).map(slugFor))].sort()
+const locales = ["en", "zh"]
+
+const missing = []
+for (const locale of locales) {
+ for (const slug of slugs) {
+ // `.../en.html` for the locale root, `.../en/.html` otherwise.
+ const file = slug
+ ? path.join(appRoot, locale, `${slug}.html`)
+ : path.join(appRoot, `${locale}.html`)
+ if (!fs.existsSync(file)) missing.push(path.relative(root, file))
+ else if (slug.startsWith("api-reference/")) {
+ const html = fs.readFileSync(file, "utf8")
+ if (/)/i.test(html) || /)/i.test(html)) {
+ throw new Error("API reference must not collect credentials or send requests: " + file)
+ }
+ }
+ }
+}
+
+const expected = slugs.length * locales.length
+if (missing.length > 0) {
+ console.error(
+ `\n${missing.length} of ${expected} routes were not prerendered. ` +
+ `The docs route is rendering per request:`,
+ )
+ for (const file of missing.slice(0, 12)) console.error(` ${file}`)
+ if (missing.length > 12) console.error(` … and ${missing.length - 12} more`)
+ console.error(
+ "\nLook for a request-scoped API (headers, cookies, searchParams, " +
+ "`dynamic = \"force-dynamic\"`) in app/[lang]/**.",
+ )
+ process.exit(1)
+}
+console.log(`${expected} routes prerendered (${slugs.length} pages, ${locales.length} locales).`)
diff --git a/apps/docs/source.config.ts b/apps/docs/source.config.ts
new file mode 100644
index 000000000..1d83698d7
--- /dev/null
+++ b/apps/docs/source.config.ts
@@ -0,0 +1,9 @@
+import { defineConfig, defineDocs } from "fumadocs-mdx/config"
+
+export const docs = defineDocs({
+ dir: "content/docs",
+})
+
+export default defineConfig({
+ mdxOptions: {},
+})
diff --git a/apps/docs/tsconfig.json b/apps/docs/tsconfig.json
new file mode 100644
index 000000000..73915d7f3
--- /dev/null
+++ b/apps/docs/tsconfig.json
@@ -0,0 +1,25 @@
+{
+ "compilerOptions": {
+ "target": "ES2017",
+ "lib": ["dom", "dom.iterable", "esnext"],
+ "allowJs": false,
+ "skipLibCheck": true,
+ "strict": true,
+ "noEmit": true,
+ "esModuleInterop": true,
+ "module": "esnext",
+ "moduleResolution": "bundler",
+ "resolveJsonModule": true,
+ "isolatedModules": true,
+ "jsx": "preserve",
+ "incremental": true,
+ "plugins": [{ "name": "next" }],
+ "paths": { "@/*": ["./*"] },
+ // The `*.test.ts` files run under `node --test` with native type stripping,
+ // whose ESM resolver requires explicit file extensions. Safe because this
+ // project never emits: `noEmit` is set below.
+ "allowImportingTsExtensions": true
+ },
+ "include": ["next-env.d.ts", ".next/types/**/*.ts", "**/*.ts", "**/*.tsx", ".source/**/*.ts"],
+ "exclude": ["node_modules"]
+}
\ No newline at end of file
diff --git a/contracts/agents-api/admin-api.md b/contracts/agents-api/admin-api.md
index db90042e9..490f63135 100644
--- a/contracts/agents-api/admin-api.md
+++ b/contracts/agents-api/admin-api.md
@@ -11,6 +11,12 @@ Core records without verifying. Web sends `console`; direct Core key scripts
normally send none but could set any label. Never use it for authorization or as
proof of origin.
+## Error envelope
+
+See [Core administration errors](core-errors.md) for the optional flat `details`
+object and the distinct console proxy failure codes. Public and machine response
+shapes remain unchanged.
+
## Projects and keys
A Project owns one tenant and shared principal. Its keys have equal access to all
diff --git a/contracts/agents-api/core-errors.md b/contracts/agents-api/core-errors.md
new file mode 100644
index 000000000..38210a623
--- /dev/null
+++ b/contracts/agents-api/core-errors.md
@@ -0,0 +1,60 @@
+# Core administration errors
+
+Errors on `/core/v1` retain the envelope below. `message` is safe English text;
+`code` and `param` are nullable. Clients use stable `code` values and the optional
+field `param`, and fall back to `message` for an unknown code. They do not parse
+messages or retry rejected mutations automatically.
+
+```json
+{"error":{"message":"A valid Core key is required as the bearer credential.","type":"invalid_request_error","code":"invalid_admin_key","param":null}}
+```
+
+## Optional details
+
+`error.details`, when present, is a nonempty flat object. Its values may only be
+strings, finite numbers, booleans, null or arrays of strings (including empty
+arrays). It contains documented Core-owned facts, never submitted names, URLs,
+keys, echoed request values, native error text or provider response bodies. Each
+operation that adds details must document its exact keys alongside its error
+code. This foundation does not add operation-specific validators, diagnostics
+endpoints or new details to existing operations.
+
+The typed Go `CoreErrorDetails` values have string, number, boolean, null and
+string-array constructors. `writeCoreError` emits them only through the marked
+Core router; empty or invalid details are omitted as a whole. The mark preserves
+error observation, flushing and `http.ResponseController` access. A shared
+handler or a Core-looking request path alone cannot change a public or machine
+error envelope. Core authentication still runs before operation configuration
+checks, and unknown paths retain their existing status and admission rules.
+
+`AgentCoreError.details` is optional `CoreErrorDetails` in the TypeScript client.
+The Core clients accept only the flat value types above, snapshot string arrays,
+and ignore malformed or empty details without changing the error's message,
+status, code, param or type. The public `OpenAIAgentsClient` does not read this
+Core-only field. `/v1` and `/api/v1` response shapes remain unchanged.
+
+## Console-generated failures
+
+The console uses the same envelope for its sign-in, origin, unsafe-request and
+transport failures in the `/core` namespace. It does not expose request values
+or transport exceptions. Core responses pass
+through the proxy; the console does not reinterpret their codes or details.
+
+| HTTP status | Code | Meaning | Param / details |
+| --- | --- | --- | --- |
+| 401 | `console_sign_in_required` | Console session is missing or expired | null / omitted |
+| 403 | `console_origin_rejected` | Host, Origin or Fetch Metadata checks failed | null / omitted |
+| 400 | `console_request_invalid` | Request path, method or upgrade is unsafe | null / omitted |
+| 502 | `core_unreachable` | Core transport failed or Core tried to redirect | null / omitted |
+
+The first three use `type: "invalid_request_error"`; the last uses
+`type: "server_error"`. A Core `401 invalid_admin_key` remains distinguishable
+from a missing console sign-in. `/console/auth` keeps its existing
+`{"error":"…"}` errors. Bare, retired and direct public/machine paths do not
+become proxyable operations. Host, origin, authentication, credential stripping,
+path checks and the no-retry rule are unchanged.
+
+Existing operation-specific codes remain documented in the [administrator
+contract](admin-api.md), [sandbox deployment contract](sandbox-deployment.md),
+[executor credential contract](environment-executor-credentials.md) and related
+resource contracts. This change does not reclassify their validation failures.
diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
index 88b00698d..d857e9a2d 100644
--- a/contracts/agents-api/core.openapi.yaml
+++ b/contracts/agents-api/core.openapi.yaml
@@ -180,6 +180,35 @@ definitions:
total_sessions:
type: integer
type: object
+ api.CoreAPIError:
+ properties:
+ code:
+ type: string
+ x-nullable: true
+ details:
+ description: |-
+ Details contains only documented, Core-owned facts: string, finite number,
+ boolean, null or string array values. Never include request echoes, secrets
+ or native/provider error text. Empty or invalid details are omitted.
+ type: object
+ message:
+ type: string
+ param:
+ type: string
+ x-nullable: true
+ type:
+ type: string
+ required:
+ - message
+ - type
+ type: object
+ api.CoreErrorResponse:
+ properties:
+ error:
+ $ref: '#/definitions/api.CoreAPIError'
+ required:
+ - error
+ type: object
api.CoreHarness:
properties:
default:
@@ -1177,22 +1206,6 @@ definitions:
next_cursor:
type: string
type: object
- v1.APIError:
- properties:
- code:
- type: string
- x-nullable: true
- message:
- type: string
- param:
- type: string
- x-nullable: true
- type:
- type: string
- required:
- - message
- - type
- type: object
v1.Agent:
properties:
id:
@@ -1465,13 +1478,6 @@ definitions:
- has_more
- object
type: object
- v1.ErrorResponse:
- properties:
- error:
- $ref: '#/definitions/v1.APIError'
- required:
- - error
- type: object
v1.ExecutionProviderSelection:
properties:
configuration:
@@ -3063,15 +3069,15 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Query committed administrator mutations
@@ -3090,11 +3096,11 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List harnesses and their deployment default model providers
@@ -3119,15 +3125,15 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Remove a harness's deployment default model provider
@@ -3155,15 +3161,15 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve a harness's deployment default model provider
@@ -3199,27 +3205,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"413":
description: Request Entity Too Large
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Replace a harness's deployment default model provider
@@ -3238,11 +3244,11 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve installation facts and process settings
@@ -3271,15 +3277,15 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve Core operational metrics
@@ -3310,19 +3316,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List Projects and active key counts
@@ -3348,19 +3354,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Create an empty independent Project
@@ -3392,23 +3398,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Rename a Project
@@ -3451,19 +3457,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List reusable Agents in a Project
@@ -3493,23 +3499,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"413":
description: Request Entity Too Large
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete a reusable Agent in a Project
@@ -3538,19 +3544,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve a reusable Agent in a Project
@@ -3574,19 +3580,19 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Archive a Project and revoke all its keys while retaining assets
@@ -3629,19 +3635,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List Environment Templates in a Project
@@ -3671,19 +3677,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete an Environment Template in a Project
@@ -3712,19 +3718,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve an Environment Template in a Project
@@ -3754,15 +3760,15 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List a self_hosted Environment's executor credentials
@@ -3799,23 +3805,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Issue or explicitly rotate a self_hosted Environment executor credential
@@ -3846,15 +3852,15 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Revoke a self_hosted Environment executor credential
@@ -3902,23 +3908,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List source files in a Project
@@ -3948,23 +3954,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete a source file in a Project
@@ -3993,23 +3999,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve source file metadata in a Project
@@ -4045,19 +4051,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List safe key metadata for a Project
@@ -4088,23 +4094,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Issue an independent secret in an existing Project
@@ -4133,19 +4139,19 @@ paths:
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Revoke one Project key while retaining shared assets
@@ -4180,19 +4186,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Batch lookup resource creation keys
@@ -4239,19 +4245,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List execution Sessions in a Project
@@ -4281,27 +4287,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"413":
description: Request Entity Too Large
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete an execution Session in a Project
@@ -4330,19 +4336,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve an execution Session in a Project
@@ -4372,23 +4378,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve a managed Session's resource cleanup state
@@ -4425,31 +4431,31 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"413":
description: Request Entity Too Large
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Release a managed Session's execution resources while retaining history
@@ -4502,23 +4508,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List immutable Session artifacts in a Project
@@ -4553,23 +4559,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete a published artifact in a Project
@@ -4603,23 +4609,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve immutable artifact metadata in a Project
@@ -4654,23 +4660,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Download immutable artifact bytes in a Project
@@ -4700,23 +4706,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve a Session's frozen execution configuration in a Project
@@ -4764,19 +4770,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List persisted execution Items in a Project
@@ -4826,23 +4832,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve Session Runtime history in a Project
@@ -4872,23 +4878,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve a Session Runtime observation in a Project
@@ -4937,19 +4943,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List execution Turns in a Project
@@ -4984,19 +4990,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve an execution Turn in a Project
@@ -5307,19 +5313,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List Vaults in a Project
@@ -5349,23 +5355,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"413":
description: Request Entity Too Large
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete a Vault and all its Credentials in a Project
@@ -5394,19 +5400,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve a Vault in a Project
@@ -5470,19 +5476,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List safe Vault Credential metadata in a Project
@@ -5517,23 +5523,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"413":
description: Request Entity Too Large
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Delete a Vault Credential in a Project
@@ -5567,19 +5573,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve safe Vault Credential metadata in a Project
@@ -5632,19 +5638,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Query API-key write operations
@@ -5663,27 +5669,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve sandbox deployment
@@ -5710,23 +5716,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Initialize the deployment sandbox provider
@@ -5753,23 +5759,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Change a fully drained deployment's sandbox configuration
@@ -5797,23 +5803,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Pause or resume new hosted allocations
@@ -5841,27 +5847,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Create a ten-minute one-use node enrollment token
@@ -5880,27 +5886,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List deployment sandbox nodes
@@ -5925,27 +5931,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Remove a sandbox node with no retained resources
@@ -5977,23 +5983,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Retrieve sandbox node and host history
@@ -6025,27 +6031,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Update sandbox node name and capacity
@@ -6070,27 +6076,27 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"409":
description: Conflict
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List retained allocations on a sandbox node
@@ -6129,23 +6135,23 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"503":
description: Service Unavailable
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: List Runtime observations across managed Projects
@@ -6205,19 +6211,19 @@ paths:
"400":
description: Bad Request
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"401":
description: Unauthorized
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"404":
description: Not Found
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
"500":
description: Internal Server Error
schema:
- $ref: '#/definitions/v1.ErrorResponse'
+ $ref: '#/definitions/api.CoreErrorResponse'
security:
- DeploymentAdminAuth: []
summary: Summarize resource counts and Session usage by Project, Agent or creator key
diff --git a/docs/api/README.md b/docs/api/README.md
index d7b2c2994..e332e8dd6 100644
--- a/docs/api/README.md
+++ b/docs/api/README.md
@@ -94,3 +94,7 @@ Generated schemas do not establish complete compatibility or real execution
support. The [coverage record](../../contracts/agents-api/README.md) identifies
qualified workflows, native differences and unresolved behavior. Update the
relevant contract and this index when adding or moving an API surface.
+
+Core administration failures use the [Core error envelope](../../contracts/agents-api/core-errors.md),
+including typed optional safe details and distinct console proxy rejection codes.
+The public and machine error contracts remain unchanged.
diff --git a/docs/api/web-management.md b/docs/api/web-management.md
index 4c81ea846..0b09b6017 100644
--- a/docs/api/web-management.md
+++ b/docs/api/web-management.md
@@ -5,6 +5,10 @@ resource inspection, Project and key management, credential issuance, audit, usa
and sandbox operations. It never calls `/v1` or `/api/v1`, and has no Agent
execution, copy or arbitrary asset editing operation.
+Core request failures use the [Core administration error envelope](../../contracts/agents-api/core-errors.md),
+including optional typed safe details. Console sign-in endpoints retain their
+separate error shape described below.
+
## Browser to console
The browser uses the console's own origin and signs in with the
diff --git a/package.json b/package.json
index 5810c7918..da7343977 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,10 @@
"test": "pnpm --filter @parsar/claude-sdk-adapter test && pnpm test:core-doctor && pnpm test:web",
"test:core-doctor": "node --test scripts/core-doctor.test.mjs",
"test:web": "pnpm --filter @agents-core-web/agents-client test && pnpm --filter @agents-core-web/web test",
- "test:web:acceptance": "playwright test"
+ "test:web:acceptance": "playwright test",
+ "dev:docs": "pnpm --dir apps/docs dev",
+ "build:docs": "pnpm --dir apps/docs build",
+ "check:docs": "pnpm --dir apps/docs verify && pnpm --dir apps/docs test && pnpm --dir apps/docs typecheck && pnpm --dir apps/docs build"
},
"devDependencies": {
"@playwright/test": "^1.63.0",
diff --git a/packages/agents-client/src/client.ts b/packages/agents-client/src/client.ts
index 181c1d504..d2d7ad0ba 100644
--- a/packages/agents-client/src/client.ts
+++ b/packages/agents-client/src/client.ts
@@ -118,11 +118,16 @@ interface APIErrorEnvelope {
};
}
+/** Safe optional facts on Core administration errors; never native error text. */
+export type CoreErrorDetail = string | number | boolean | null | readonly string[];
+export type CoreErrorDetails = Readonly>;
+
export class AgentCoreError extends Error {
readonly status: number;
readonly code?: string | null;
readonly param?: string | null;
readonly errorType?: string;
+ readonly details?: CoreErrorDetails;
constructor(
message: string,
@@ -130,6 +135,7 @@ export class AgentCoreError extends Error {
code?: string | null,
param?: string | null,
errorType?: string,
+ details?: CoreErrorDetails,
) {
super(message);
this.name = "AgentCoreError";
@@ -137,6 +143,7 @@ export class AgentCoreError extends Error {
this.code = code;
this.param = param;
this.errorType = errorType;
+ if (details !== undefined) this.details = details;
}
}
diff --git a/packages/agents-client/src/core-request.test.ts b/packages/agents-client/src/core-request.test.ts
new file mode 100644
index 000000000..82a204f5a
--- /dev/null
+++ b/packages/agents-client/src/core-request.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it, vi } from "vitest";
+import { AgentCoreError, OpenAIAgentsClient } from "./client";
+import { CoreRequester } from "./core-request";
+
+function requester(details: unknown) {
+ const fetch = vi.fn(async () => ({
+ ok: false, status: 409,
+ json: async () => ({ error: { message: "Refresh the configuration.", type: "conflict_error", code: "sandbox_generation_stale", param: "expected_generation", details } }),
+ }) as Response);
+ return { fetch, request: new CoreRequester("/core/v1", undefined, fetch, () => { throw new Error("invalid success body"); }) };
+}
+
+describe("Core error details", () => {
+ it("projects documented flat values and retains one-request semantics", async () => {
+ const details = { current_generation: 4, supported: ["docker", "microsandbox"], enabled: true, missing: null, label: "ready", empty: [] };
+ const { fetch, request } = requester(details);
+ const error = await request.response("/sandbox/deployment", undefined, "PUT", { expected_generation: 3 }).catch((value: unknown) => value);
+ expect(error).toBeInstanceOf(AgentCoreError);
+ expect(error).toMatchObject({ status: 409, code: "sandbox_generation_stale", param: "expected_generation", errorType: "conflict_error", details });
+ expect(fetch).toHaveBeenCalledTimes(1);
+ expect(fetch.mock.calls[0]).toEqual(["/core/v1/sandbox/deployment", expect.objectContaining({ method: "PUT", credentials: "same-origin", redirect: "error" })]);
+ details.supported[0] = "mutated";
+ expect((error as AgentCoreError).details?.supported).toEqual(["docker", "microsandbox"]);
+ });
+
+ it.each([
+ undefined, null, {}, [], "private native text", 5, true, new Date(),
+ { nested: { secret: "private" } }, { values: ["safe", 1] }, { values: [null] },
+ { value: Infinity }, { value: NaN }, { value: undefined }, { "": "invalid key" },
+ { good: 3, bad: { nested: true } }, { values: Array(2) },
+ ])("ignores malformed or empty optional details (%j)", async (details) => {
+ const { fetch, request } = requester(details);
+ const error = await request.response("/projects").catch((value: unknown) => value);
+ expect(error).toBeInstanceOf(AgentCoreError);
+ expect(error).toMatchObject({ status: 409, code: "sandbox_generation_stale", message: "Refresh the configuration." });
+ expect((error as AgentCoreError).details).toBeUndefined();
+ expect(fetch).toHaveBeenCalledTimes(1);
+ });
+
+ it("preserves literal keys without changing object prototypes", async () => {
+ const details = JSON.parse('{"__proto__":"literal","constructor":null}');
+ const error = await requester(details).request.response("/projects").catch((value: unknown) => value) as AgentCoreError;
+ expect(error.details).toEqual(details);
+ expect(Object.getPrototypeOf(error.details)).toBe(Object.prototype);
+ expect(Object.prototype.hasOwnProperty.call(error.details, "__proto__")).toBe(true);
+ });
+
+ it("does not add Core details to public-client errors", async () => {
+ const fetch = vi.fn(async () => new Response(JSON.stringify({ error: { message: "Rejected.", type: "invalid_request_error", code: "invalid_request", param: null, details: { max_length: 128 } } }), { status: 400 }));
+ const error = await new OpenAIAgentsClient({ fetch }).listAgents().catch((value: unknown) => value) as AgentCoreError;
+ expect(error).toBeInstanceOf(AgentCoreError);
+ expect(error.details).toBeUndefined();
+ expect(fetch).toHaveBeenCalledTimes(1);
+ });
+});
diff --git a/packages/agents-client/src/core-request.ts b/packages/agents-client/src/core-request.ts
index 8da5742eb..76afc1b6a 100644
--- a/packages/agents-client/src/core-request.ts
+++ b/packages/agents-client/src/core-request.ts
@@ -1,7 +1,26 @@
-import { AgentCoreError } from "./client";
+import { AgentCoreError, type CoreErrorDetail, type CoreErrorDetails } from "./client";
import { isRecord } from "./response-projection";
import type { ReadOptions } from "./types";
+function isCoreErrorDetail(value: unknown): value is CoreErrorDetail {
+ return value === null || typeof value === "string" || typeof value === "boolean"
+ || (typeof value === "number" && Number.isFinite(value))
+ || (Array.isArray(value) && Array.from(value).every((item) => typeof item === "string"));
+}
+
+function coreErrorDetails(value: unknown): CoreErrorDetails | undefined {
+ if (!isRecord(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return undefined;
+ const entries = Object.entries(value);
+ if (entries.length === 0) return undefined;
+ const projected: [string, CoreErrorDetail][] = [];
+ for (const [key, detail] of entries) {
+ if (!key || !isCoreErrorDetail(detail)) return undefined;
+ projected.push([key, Array.isArray(detail) ? Object.freeze([...detail]) : detail]);
+ }
+ // Object.fromEntries keeps a literal __proto__ key from changing the prototype.
+ return Object.freeze(Object.fromEntries(projected));
+}
+
/** Constructor options of the Core clients that take a plain bearer `token`. */
export interface CoreClientOptions {
/** Prefix that request paths are appended to: `/core/v1/sandbox` for SandboxAdminClient, `/core/v1` for CoreMetricsClient by default. */
@@ -50,6 +69,7 @@ export class CoreRequester {
typeof error.code === "string" || error.code === null ? error.code : undefined,
typeof error.param === "string" || error.param === null ? error.param : undefined,
typeof error.type === "string" ? error.type : undefined,
+ coreErrorDetails(error.details),
);
}
return response;
diff --git a/packages/agents-client/src/index.ts b/packages/agents-client/src/index.ts
index 0cb31e6b2..7a73d2078 100644
--- a/packages/agents-client/src/index.ts
+++ b/packages/agents-client/src/index.ts
@@ -1,5 +1,5 @@
export { AgentCoreError, CreationStreamRetryError, createIdempotencyKey, isSessionDeletionConflict, OpenAIAgentsClient } from "./client";
-export type { OpenAIAgentsClientOptions } from "./client";
+export type { OpenAIAgentsClientOptions, CoreErrorDetail, CoreErrorDetails } from "./client";
export { createSSEDecoder } from "./sse";
export type { SSEDecoder, SSEMessage } from "./sse";
export type * from "./types";
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7dd4aaf94..7d586b21d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -18,6 +18,58 @@ importers:
specifier: ^5.8.3
version: 5.9.3
+ apps/docs:
+ dependencies:
+ '@scalar/openapi-upgrader':
+ specifier: 0.1.1
+ version: 0.1.1
+ fumadocs-core:
+ specifier: 15.8.5
+ version: 15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ fumadocs-mdx:
+ specifier: ^12.0.3
+ version: 12.0.3(fumadocs-core@15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)
+ fumadocs-openapi:
+ specifier: 9.5.1
+ version: 9.5.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(tailwindcss@4.3.3)
+ fumadocs-ui:
+ specifier: 15.8.5
+ version: 15.8.5(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(tailwindcss@4.3.3)
+ js-yaml:
+ specifier: ^4.1.0
+ version: 4.3.2
+ next:
+ specifier: ^15.5.16
+ version: 15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ next-themes:
+ specifier: ^0.4.6
+ version: 0.4.6(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ react:
+ specifier: ^19.2.7
+ version: 19.3.0
+ react-dom:
+ specifier: ^19.2.7
+ version: 19.3.0(react@19.3.0)
+ devDependencies:
+ '@tailwindcss/postcss':
+ specifier: ^4.3.2
+ version: 4.3.3
+ '@types/node':
+ specifier: ^22.0.0
+ version: 22.20.4
+ '@types/react':
+ specifier: ^19.2.17
+ version: 19.3.0
+ '@types/react-dom':
+ specifier: ^19.1.0
+ version: 19.3.0(@types/react@19.3.0)
+ tailwindcss:
+ specifier: ^4.3.2
+ version: 4.3.3
+ typescript:
+ specifier: ^5.8.3
+ version: 5.9.3
+
apps/web:
dependencies:
'@agents-core-web/agents-client':
@@ -77,7 +129,7 @@ importers:
devDependencies:
'@tailwindcss/vite':
specifier: ^4.3.3
- version: 4.3.3(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))
+ version: 4.3.3(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))
'@types/react':
specifier: ^19.2.17
version: 19.3.0
@@ -86,7 +138,7 @@ importers:
version: 19.3.0(@types/react@19.3.0)
'@vitejs/plugin-react':
specifier: ^6.0.4
- version: 6.1.1(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))
+ version: 6.1.1(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))
shadow-plugin:
specifier: ^2.1.1
version: 2.1.1
@@ -98,10 +150,10 @@ importers:
version: 5.9.3
vite:
specifier: ^8.1.4
- version: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)
+ version: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0)
vitest:
specifier: ^4.1.9
- version: 4.1.11(@types/node@26.1.0)(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))
+ version: 4.1.11(@types/node@26.1.0)(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))
packages/agents-client:
devDependencies:
@@ -110,7 +162,7 @@ importers:
version: 5.9.3
vitest:
specifier: ^4.1.9
- version: 4.1.11(@types/node@26.1.0)(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))
+ version: 4.1.11(@types/node@26.1.0)(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))
packages/claude-sdk-adapter:
dependencies:
@@ -179,6 +231,10 @@ importers:
packages:
+ '@alloc/quick-lru@5.3.0':
+ resolution: {integrity: sha512-U4+70Pc5ZS9osnCBCE5Jha/ciHM+Yp+CNMNC/7HvYbNRk1Ldd+f7qO65W5qfhu/TCv+/ozljlXXe9Nj8419DMA==}
+ engines: {node: '>=10'}
+
'@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.269':
resolution: {integrity: sha512-o7vdVlbJjkX9RL7+Mwa6owEGFvHNVfbNRRpoYSJ0jzyvimxKa+8kSjwZo7nYBRr+5WydxB/ApSE+xrWflDUhKQ==}
cpu: [arm64]
@@ -240,6 +296,10 @@ packages:
zod:
optional: true
+ '@apidevtools/json-schema-ref-parser@11.9.3':
+ resolution: {integrity: sha512-60vepv88RwcJtSHrD6MjIL6Ta3SOYbgfnkHb+ppAVK+o9mXprRtulx7VlRl3lN3bbvysAfCS7WMVfhUYemB0IQ==}
+ engines: {node: '>= 16'}
+
'@babel/runtime@7.29.7':
resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
engines: {node: '>=6.9.0'}
@@ -271,156 +331,315 @@ packages:
'@types/react':
optional: true
+ '@emnapi/runtime@1.11.3':
+ resolution: {integrity: sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==}
+
+ '@esbuild/aix-ppc64@0.25.12':
+ resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+ engines: {node: '>=18'}
+ cpu: [ppc64]
+ os: [aix]
+
'@esbuild/aix-ppc64@0.28.2':
resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
engines: {node: '>=18'}
cpu: [ppc64]
os: [aix]
+ '@esbuild/android-arm64@0.25.12':
+ resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [android]
+
'@esbuild/android-arm64@0.28.2':
resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
engines: {node: '>=18'}
cpu: [arm64]
os: [android]
+ '@esbuild/android-arm@0.25.12':
+ resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+ engines: {node: '>=18'}
+ cpu: [arm]
+ os: [android]
+
'@esbuild/android-arm@0.28.2':
resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
engines: {node: '>=18'}
cpu: [arm]
os: [android]
+ '@esbuild/android-x64@0.25.12':
+ resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [android]
+
'@esbuild/android-x64@0.28.2':
resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
engines: {node: '>=18'}
cpu: [x64]
os: [android]
+ '@esbuild/darwin-arm64@0.25.12':
+ resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [darwin]
+
'@esbuild/darwin-arm64@0.28.2':
resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
engines: {node: '>=18'}
cpu: [arm64]
os: [darwin]
+ '@esbuild/darwin-x64@0.25.12':
+ resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [darwin]
+
'@esbuild/darwin-x64@0.28.2':
resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
engines: {node: '>=18'}
cpu: [x64]
os: [darwin]
+ '@esbuild/freebsd-arm64@0.25.12':
+ resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [freebsd]
+
'@esbuild/freebsd-arm64@0.28.2':
resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
engines: {node: '>=18'}
cpu: [arm64]
os: [freebsd]
+ '@esbuild/freebsd-x64@0.25.12':
+ resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [freebsd]
+
'@esbuild/freebsd-x64@0.28.2':
resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
engines: {node: '>=18'}
cpu: [x64]
os: [freebsd]
+ '@esbuild/linux-arm64@0.25.12':
+ resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [linux]
+
'@esbuild/linux-arm64@0.28.2':
resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
engines: {node: '>=18'}
cpu: [arm64]
os: [linux]
+ '@esbuild/linux-arm@0.25.12':
+ resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+ engines: {node: '>=18'}
+ cpu: [arm]
+ os: [linux]
+
'@esbuild/linux-arm@0.28.2':
resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
engines: {node: '>=18'}
cpu: [arm]
os: [linux]
+ '@esbuild/linux-ia32@0.25.12':
+ resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+ engines: {node: '>=18'}
+ cpu: [ia32]
+ os: [linux]
+
'@esbuild/linux-ia32@0.28.2':
resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
engines: {node: '>=18'}
cpu: [ia32]
os: [linux]
+ '@esbuild/linux-loong64@0.25.12':
+ resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+ engines: {node: '>=18'}
+ cpu: [loong64]
+ os: [linux]
+
'@esbuild/linux-loong64@0.28.2':
resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
engines: {node: '>=18'}
cpu: [loong64]
os: [linux]
+ '@esbuild/linux-mips64el@0.25.12':
+ resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+ engines: {node: '>=18'}
+ cpu: [mips64el]
+ os: [linux]
+
'@esbuild/linux-mips64el@0.28.2':
resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
engines: {node: '>=18'}
cpu: [mips64el]
os: [linux]
+ '@esbuild/linux-ppc64@0.25.12':
+ resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+ engines: {node: '>=18'}
+ cpu: [ppc64]
+ os: [linux]
+
'@esbuild/linux-ppc64@0.28.2':
resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
engines: {node: '>=18'}
cpu: [ppc64]
os: [linux]
+ '@esbuild/linux-riscv64@0.25.12':
+ resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+ engines: {node: '>=18'}
+ cpu: [riscv64]
+ os: [linux]
+
'@esbuild/linux-riscv64@0.28.2':
resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
engines: {node: '>=18'}
cpu: [riscv64]
os: [linux]
+ '@esbuild/linux-s390x@0.25.12':
+ resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+ engines: {node: '>=18'}
+ cpu: [s390x]
+ os: [linux]
+
'@esbuild/linux-s390x@0.28.2':
resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
engines: {node: '>=18'}
cpu: [s390x]
os: [linux]
+ '@esbuild/linux-x64@0.25.12':
+ resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [linux]
+
'@esbuild/linux-x64@0.28.2':
resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
engines: {node: '>=18'}
cpu: [x64]
os: [linux]
+ '@esbuild/netbsd-arm64@0.25.12':
+ resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [netbsd]
+
'@esbuild/netbsd-arm64@0.28.2':
resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
engines: {node: '>=18'}
cpu: [arm64]
os: [netbsd]
+ '@esbuild/netbsd-x64@0.25.12':
+ resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [netbsd]
+
'@esbuild/netbsd-x64@0.28.2':
resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
engines: {node: '>=18'}
cpu: [x64]
os: [netbsd]
+ '@esbuild/openbsd-arm64@0.25.12':
+ resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [openbsd]
+
'@esbuild/openbsd-arm64@0.28.2':
resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
engines: {node: '>=18'}
cpu: [arm64]
os: [openbsd]
+ '@esbuild/openbsd-x64@0.25.12':
+ resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [openbsd]
+
'@esbuild/openbsd-x64@0.28.2':
resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
engines: {node: '>=18'}
cpu: [x64]
os: [openbsd]
+ '@esbuild/openharmony-arm64@0.25.12':
+ resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [openharmony]
+
'@esbuild/openharmony-arm64@0.28.2':
resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
engines: {node: '>=18'}
cpu: [arm64]
os: [openharmony]
+ '@esbuild/sunos-x64@0.25.12':
+ resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [sunos]
+
'@esbuild/sunos-x64@0.28.2':
resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
engines: {node: '>=18'}
cpu: [x64]
os: [sunos]
+ '@esbuild/win32-arm64@0.25.12':
+ resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [win32]
+
'@esbuild/win32-arm64@0.28.2':
resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
engines: {node: '>=18'}
cpu: [arm64]
os: [win32]
+ '@esbuild/win32-ia32@0.25.12':
+ resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+ engines: {node: '>=18'}
+ cpu: [ia32]
+ os: [win32]
+
'@esbuild/win32-ia32@0.28.2':
resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
engines: {node: '>=18'}
cpu: [ia32]
os: [win32]
+ '@esbuild/win32-x64@0.25.12':
+ resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [win32]
+
'@esbuild/win32-x64@0.28.2':
resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
engines: {node: '>=18'}
@@ -448,357 +667,1033 @@ packages:
'@fontsource-variable/inter@5.3.0':
resolution: {integrity: sha512-OupL48va4JNofb97w6NYeF9S7W/kHNKM0Er8Dem5nqi4jeOLrVJDoE8tZEpnMJmtkvNbB1EIPPwHcdkF6b1oUA==}
+ '@formatjs/intl-localematcher@0.6.2':
+ resolution: {integrity: sha512-XOMO2Hupl0wdd172Y06h6kLpBz6Dv+J4okPLl4LPtzbr8f66WbIoy4ev98EBuZ6ZK4h5ydTN6XneT4QVpD7cdA==}
+
+ '@fumari/json-schema-to-typescript@1.1.3':
+ resolution: {integrity: sha512-KnaZAo5W769nOaxhPqEMTdjHdngugxmPpNS+Yr2U90iVxgmNAWwhSr8Nx3l+CUehJKNFzJi2C7clQXOfuPJegA==}
+ engines: {node: '>=18.0.0'}
+
'@hono/node-server@2.1.1':
resolution: {integrity: sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==}
engines: {node: '>=20'}
peerDependencies:
hono: ^4
- '@jridgewell/gen-mapping@0.3.13':
- resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+ '@img/colour@1.1.0':
+ resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+ engines: {node: '>=18'}
- '@jridgewell/remapping@2.3.5':
- resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+ '@img/sharp-darwin-arm64@0.35.5':
+ resolution: {integrity: sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg==}
+ engines: {node: '>=20.9.0'}
+ cpu: [arm64]
+ os: [darwin]
- '@jridgewell/resolve-uri@3.1.2':
- resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
- engines: {node: '>=6.0.0'}
+ '@img/sharp-darwin-x64@0.35.5':
+ resolution: {integrity: sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw==}
+ engines: {node: '>=20.9.0'}
+ cpu: [x64]
+ os: [darwin]
- '@jridgewell/sourcemap-codec@1.6.0':
- resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+ '@img/sharp-freebsd-wasm32@0.35.5':
+ resolution: {integrity: sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw==}
+ engines: {node: '>=20.9.0'}
+ os: [freebsd]
- '@jridgewell/trace-mapping@0.3.31':
- resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+ '@img/sharp-libvips-darwin-arm64@1.3.4':
+ resolution: {integrity: sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw==}
+ cpu: [arm64]
+ os: [darwin]
- '@modelcontextprotocol/sdk@1.30.0':
- resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==}
- engines: {node: '>=18'}
- peerDependencies:
- '@cfworker/json-schema': ^4.1.1
- zod: ^3.25 || ^4.0
- peerDependenciesMeta:
- '@cfworker/json-schema':
- optional: true
+ '@img/sharp-libvips-darwin-x64@1.3.4':
+ resolution: {integrity: sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ==}
+ cpu: [x64]
+ os: [darwin]
- '@number-flow/react@0.6.2':
- resolution: {integrity: sha512-WjZuV4aA+vhRCgCF+adGLgFVVAJ8vdvq6EchRT2FiBIgElTXtDOA3YgkcMr9UHpvpS9v4H70AB5wZv0D9jc3QA==}
- peerDependencies:
- react: ^18 || ^19
- react-dom: ^18 || ^19
+ '@img/sharp-libvips-linux-arm64@1.3.4':
+ resolution: {integrity: sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
- '@oxc-project/types@0.150.0':
- resolution: {integrity: sha512-rDS5/31E9HfPl/CIzGrn0DOlvBbXFseQ5URJ9sYMfstbKLD/c6Gm9vmRzRGDdAXyOIL4zmO37lc9RIwYqVruZw==}
+ '@img/sharp-libvips-linux-arm@1.3.4':
+ resolution: {integrity: sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw==}
+ cpu: [arm]
+ os: [linux]
+ libc: [glibc]
- '@playwright/test@1.63.0':
- resolution: {integrity: sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==}
- engines: {node: '>=20'}
- hasBin: true
+ '@img/sharp-libvips-linux-ppc64@1.3.4':
+ resolution: {integrity: sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ==}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [glibc]
- '@pondwader/socks5-server@1.0.10':
- resolution: {integrity: sha512-bQY06wzzR8D2+vVCUoBsr5QS2U6UgPUQRmErNwtsuI6vLcyRKkafjkr3KxbtGFf9aBBIV2mcvlsKD1UYaIV+sg==}
+ '@img/sharp-libvips-linux-riscv64@1.3.4':
+ resolution: {integrity: sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q==}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [glibc]
- '@rolldown/binding-android-arm-eabi@1.2.9':
- resolution: {integrity: sha512-tNISae1QEf/vkb3xkRcjV5SEdzPE97We5IVaa2Z8jSszQPZ8U60B/YCYpw4QI7VidYsBtKavczXf+DyDs9WGxw==}
- engines: {node: ^20.19.0 || >=22.12.0}
- cpu: [arm]
- os: [android]
+ '@img/sharp-libvips-linux-s390x@1.3.4':
+ resolution: {integrity: sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ==}
+ cpu: [s390x]
+ os: [linux]
+ libc: [glibc]
- '@rolldown/binding-android-arm64@1.2.9':
- resolution: {integrity: sha512-YC8YsI30o606GTZi0VyzYlsDKFP8W61i/QzayHDkLbNEz/IShqAmTa+hsJRj13xTHA0H+6fk4b2UmGn+Q/cMlg==}
- engines: {node: ^20.19.0 || >=22.12.0}
- cpu: [arm64]
- os: [android]
+ '@img/sharp-libvips-linux-x64@1.3.4':
+ resolution: {integrity: sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
- '@rolldown/binding-darwin-arm64@1.2.9':
- resolution: {integrity: sha512-IwhlH3qK5urrY8hZiEgGkHKEFN901p/p2bjxCxJlr4GyNnF7wYpUvK+Y43uaRYuC4hpfjzbR3SJC3arX1jGvmw==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-libvips-linuxmusl-arm64@1.3.4':
+ resolution: {integrity: sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA==}
cpu: [arm64]
- os: [darwin]
-
- '@rolldown/binding-darwin-x64@1.2.9':
- resolution: {integrity: sha512-XxpJfVzFh+jilRxIXUqcfYAYcunIc/XEzIizsOL1fcJee5Sf7H3mH8WlLmfHfluz5amqR88QQo9izKtmMlavAw==}
- engines: {node: ^20.19.0 || >=22.12.0}
- cpu: [x64]
- os: [darwin]
+ os: [linux]
+ libc: [musl]
- '@rolldown/binding-freebsd-x64@1.2.9':
- resolution: {integrity: sha512-kSfvhmgeWyfkbT3p/1s5vSgboogoah2zkm9fX2zjg2hHxSV7T4KhMWRUUaRk4OXNqoD3QAUeRqLcs1aZOK4U1g==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-libvips-linuxmusl-x64@1.3.4':
+ resolution: {integrity: sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg==}
cpu: [x64]
- os: [freebsd]
-
- '@rolldown/binding-linux-arm-gnueabihf@1.2.9':
- resolution: {integrity: sha512-1RVzG17pxqbTfYLC352JlLt6kKLG+6Hr30n8DlIJqsnV5luUDd2Qdx9Ayw1Cabfyb1K9k0jXEZ7evxkRoT+uiw==}
- engines: {node: ^20.19.0 || >=22.12.0}
- cpu: [arm]
os: [linux]
+ libc: [musl]
- '@rolldown/binding-linux-arm64-gnu@1.2.9':
- resolution: {integrity: sha512-BXqPvZ2drqVD+/Z8UpKwcs4Mp7grM+eGFku4CAEKrEtcbAsUpzREphK1sogCRZGreVPiMkiiBtw0n3TPteuqvw==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-linux-arm64@0.35.5':
+ resolution: {integrity: sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ==}
+ engines: {node: '>=20.9.0'}
cpu: [arm64]
os: [linux]
libc: [glibc]
- '@rolldown/binding-linux-arm64-musl@1.2.9':
- resolution: {integrity: sha512-11vWvo8YDwLzukt27J3aYDWU+gg2P7J+ZOmiJ0hkF5BXZDW7pVya7r40MXDy6ya0i9KamoENSVKIugvJNgFXIA==}
- engines: {node: ^20.19.0 || >=22.12.0}
- cpu: [arm64]
+ '@img/sharp-linux-arm@0.35.5':
+ resolution: {integrity: sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ==}
+ engines: {node: '>=20.9.0'}
+ cpu: [arm]
os: [linux]
- libc: [musl]
+ libc: [glibc]
- '@rolldown/binding-linux-ppc64-gnu@1.2.9':
- resolution: {integrity: sha512-a1tijMkdwsIARtc0F39ApURROkf3NwqinI6TOiSSWCTR7dT96dffNvMUtDHnq64wKNTIZOIlzKrFvvFUznJiyw==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-linux-ppc64@0.35.5':
+ resolution: {integrity: sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA==}
+ engines: {node: '>=20.9.0'}
cpu: [ppc64]
os: [linux]
libc: [glibc]
- '@rolldown/binding-linux-s390x-gnu@1.2.9':
- resolution: {integrity: sha512-x6SQNdAvv4c3hWqTMaWuawzMX9myaCs/yEmlGsxJzkdClnHW7FbrjQuSiRDhuSYzEYoEMhsaJy9qHG/XNemJPQ==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-linux-riscv64@0.35.5':
+ resolution: {integrity: sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ==}
+ engines: {node: '>=20.9.0'}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linux-s390x@0.35.5':
+ resolution: {integrity: sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA==}
+ engines: {node: '>=20.9.0'}
cpu: [s390x]
os: [linux]
libc: [glibc]
- '@rolldown/binding-linux-x64-gnu@1.2.9':
- resolution: {integrity: sha512-9s0AZ8BFK5/n7B/TBoa2yJE3gI3KURrbXcPBlsAsvjU4VeJKgE90y1YtNxyEUIcHPQkg6/yfF3qihUrcM/Kf0Q==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-linux-x64@0.35.5':
+ resolution: {integrity: sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog==}
+ engines: {node: '>=20.9.0'}
cpu: [x64]
os: [linux]
libc: [glibc]
- '@rolldown/binding-linux-x64-musl@1.2.9':
- resolution: {integrity: sha512-P7VWAmV+WdJluH7ovnRGoiv2i8To7GAZ+kGzfGup635cyL7SyYl3lSUaA3Gp5THf0n/Co5EyEqb2zbqq+nMOHQ==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-linuxmusl-arm64@0.35.5':
+ resolution: {integrity: sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg==}
+ engines: {node: '>=20.9.0'}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@img/sharp-linuxmusl-x64@0.35.5':
+ resolution: {integrity: sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A==}
+ engines: {node: '>=20.9.0'}
cpu: [x64]
os: [linux]
libc: [musl]
- '@rolldown/binding-openharmony-arm64@1.2.9':
- resolution: {integrity: sha512-1qixtsE4BK8h+yS3BfmZ09UhA7O/N4IACva6YBr7EBvCJraByTuRcgOTaiA62Tm0vey3UcKXLOaoGHtYmNGEVg==}
- engines: {node: ^20.19.0 || >=22.12.0}
- cpu: [arm64]
- os: [openharmony]
+ '@img/sharp-wasm32@0.35.5':
+ resolution: {integrity: sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ==}
+ engines: {node: '>=20.9.0'}
- '@rolldown/binding-win32-arm64-msvc@1.2.9':
- resolution: {integrity: sha512-ok8IQjcEPs1AKZfuEUznVBrJw+gK4soq+bx8b1X2XoMqVClarc1q5JDmVtWXY1xfr6ZuHTAsPXHTgTrqKTZeww==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-webcontainers-wasm32@0.35.5':
+ resolution: {integrity: sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA==}
+ engines: {node: '>=20.9.0'}
+ cpu: [wasm32]
+
+ '@img/sharp-win32-arm64@0.35.5':
+ resolution: {integrity: sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q==}
+ engines: {node: '>=20.9.0'}
cpu: [arm64]
os: [win32]
- '@rolldown/binding-win32-x64-msvc@1.2.9':
- resolution: {integrity: sha512-Ip2mXoU0hM0boq3Rf+ekuT653OROSo6aSYcPT1VHE4q52KvyxgFkQgrgb/IEsxOuvQ2fZZbs8khJAyCEPM24/g==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@img/sharp-win32-ia32@0.35.5':
+ resolution: {integrity: sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A==}
+ engines: {node: ^20.9.0}
+ cpu: [ia32]
+ os: [win32]
+
+ '@img/sharp-win32-x64@0.35.5':
+ resolution: {integrity: sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg==}
+ engines: {node: '>=20.9.0'}
cpu: [x64]
os: [win32]
- '@rolldown/pluginutils@1.0.1':
- resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
+ '@jridgewell/gen-mapping@0.3.13':
+ resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
- '@silvia-odwyer/photon-node@0.3.4':
- resolution: {integrity: sha512-bnly4BKB3KDTFxrUIcgCLbaeVVS8lrAkri1pEzskpmxu9MdfGQTy8b8EgcD83ywD3RPMsIulY8xJH5Awa+t9fA==}
+ '@jridgewell/remapping@2.3.5':
+ resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
- '@sinclair/typebox@0.34.52':
- resolution: {integrity: sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==}
+ '@jridgewell/resolve-uri@3.1.2':
+ resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+ engines: {node: '>=6.0.0'}
- '@stablelib/base64@1.0.1':
- resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
+ '@jridgewell/sourcemap-codec@1.6.0':
+ resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
- '@standard-schema/spec@1.1.0':
- resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+ '@jridgewell/trace-mapping@0.3.31':
+ resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
- '@tailwindcss/node@4.3.3':
- resolution: {integrity: sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==}
+ '@jsdevtools/ono@7.1.3':
+ resolution: {integrity: sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==}
- '@tailwindcss/oxide-android-arm64@4.3.3':
- resolution: {integrity: sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==}
- engines: {node: '>= 20'}
- cpu: [arm64]
- os: [android]
+ '@mdx-js/mdx@3.1.1':
+ resolution: {integrity: sha512-f6ZO2ifpwAQIpzGWaBQT2TXxPv6z3RBzQKpVftEWN78Vl/YweF1uwussDx8ECAXVtr3Rs89fKyG9YlzUs9DyGQ==}
- '@tailwindcss/oxide-darwin-arm64@4.3.3':
- resolution: {integrity: sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==}
- engines: {node: '>= 20'}
+ '@modelcontextprotocol/sdk@1.30.0':
+ resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==}
+ engines: {node: '>=18'}
+ peerDependencies:
+ '@cfworker/json-schema': ^4.1.1
+ zod: ^3.25 || ^4.0
+ peerDependenciesMeta:
+ '@cfworker/json-schema':
+ optional: true
+
+ '@next/env@15.5.26':
+ resolution: {integrity: sha512-NJBz9q10LU9h3KjHLEbdgWIV+ow/x+MYzKBRfqhm9/QmML3tPMhYmXF/UIV9SDVCNtOqFNc5oX7kZqeiigMCEA==}
+
+ '@next/swc-darwin-arm64@15.5.26':
+ resolution: {integrity: sha512-So8eoJxIcXw/TexNUvvh3uY72J9nDo5BpJsAwUKx+FK57CrWXg6RqVufV7U9OT3BO+siMzJ2FuAwBhaHoPlLGg==}
+ engines: {node: '>= 10'}
cpu: [arm64]
os: [darwin]
- '@tailwindcss/oxide-darwin-x64@4.3.3':
- resolution: {integrity: sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==}
- engines: {node: '>= 20'}
+ '@next/swc-darwin-x64@15.5.26':
+ resolution: {integrity: sha512-jImzLUTClVWKhP91e5sgDumjxCLhaFSt7DuN5cnRYw99Dppxxhhq5jKRyDa2aTv3JE7dQmTSTsY3EFkSOp9Pog==}
+ engines: {node: '>= 10'}
cpu: [x64]
os: [darwin]
- '@tailwindcss/oxide-freebsd-x64@4.3.3':
- resolution: {integrity: sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==}
- engines: {node: '>= 20'}
- cpu: [x64]
- os: [freebsd]
-
- '@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3':
- resolution: {integrity: sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==}
- engines: {node: '>= 20'}
- cpu: [arm]
- os: [linux]
-
- '@tailwindcss/oxide-linux-arm64-gnu@4.3.3':
- resolution: {integrity: sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==}
- engines: {node: '>= 20'}
+ '@next/swc-linux-arm64-gnu@15.5.26':
+ resolution: {integrity: sha512-CaWd+T/Lud2BmZbrsa1CzCnIOdU3YX9Nuk89virZaSB1O+C+8Yrrevgmnl68u4dvZIfOAzQ77S+Njrq7v1XwSA==}
+ engines: {node: '>= 10'}
cpu: [arm64]
os: [linux]
libc: [glibc]
- '@tailwindcss/oxide-linux-arm64-musl@4.3.3':
- resolution: {integrity: sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==}
- engines: {node: '>= 20'}
+ '@next/swc-linux-arm64-musl@15.5.26':
+ resolution: {integrity: sha512-97AyKI34yjpaudlkWHswAf7c1PjWQAC7lLyrw3R5K+bq834EOA+9IG68rIVy0VqrqGjtPSMjJmMmgeJ3wHR5og==}
+ engines: {node: '>= 10'}
cpu: [arm64]
os: [linux]
libc: [musl]
- '@tailwindcss/oxide-linux-x64-gnu@4.3.3':
- resolution: {integrity: sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==}
- engines: {node: '>= 20'}
+ '@next/swc-linux-x64-gnu@15.5.26':
+ resolution: {integrity: sha512-eVtuOCew1sBPV7BEgxy7qxuVyqoU3tJIS/xDZwa1/NiQ4Q0LM2JMH7rny+/uVIN6hsQ3PTb0hTQWypA0L2QxtA==}
+ engines: {node: '>= 10'}
cpu: [x64]
os: [linux]
libc: [glibc]
- '@tailwindcss/oxide-linux-x64-musl@4.3.3':
- resolution: {integrity: sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==}
- engines: {node: '>= 20'}
+ '@next/swc-linux-x64-musl@15.5.26':
+ resolution: {integrity: sha512-EiUXADp+Z+OdQnSqbX10YgOSUrs0CXVODoTfySfsP2jdhngn9bq5RJd376FJzqMPe/XX25FMr1aXtYUVPA0qDw==}
+ engines: {node: '>= 10'}
cpu: [x64]
os: [linux]
libc: [musl]
- '@tailwindcss/oxide-wasm32-wasi@4.3.3':
- resolution: {integrity: sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==}
- engines: {node: '>=14.0.0'}
- cpu: [wasm32]
- bundledDependencies:
- - '@napi-rs/wasm-runtime'
- - '@emnapi/core'
- - '@emnapi/runtime'
- - '@tybys/wasm-util'
- - '@emnapi/wasi-threads'
- - tslib
-
- '@tailwindcss/oxide-win32-arm64-msvc@4.3.3':
- resolution: {integrity: sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==}
- engines: {node: '>= 20'}
+ '@next/swc-win32-arm64-msvc@15.5.26':
+ resolution: {integrity: sha512-HPl41fgkC4kdM5CCIoqNW6KlKEj1N+xS6bjNFFxDNKooUNUu09frgD948zo95TPw/C3XINZpkdkBGNU2RhjEnw==}
+ engines: {node: '>= 10'}
cpu: [arm64]
os: [win32]
- '@tailwindcss/oxide-win32-x64-msvc@4.3.3':
- resolution: {integrity: sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==}
- engines: {node: '>= 20'}
+ '@next/swc-win32-x64-msvc@15.5.26':
+ resolution: {integrity: sha512-TgmJ5ginKr34RPsz01/swpYtFBxh51d66jM26aytpE6NIypU5KtBVI8C2hJjUNpWr7v6sWj8a6+og2MyntcnpA==}
+ engines: {node: '>= 10'}
cpu: [x64]
os: [win32]
- '@tailwindcss/oxide@4.3.3':
- resolution: {integrity: sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==}
- engines: {node: '>= 20'}
-
- '@tailwindcss/vite@4.3.3':
- resolution: {integrity: sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==}
- peerDependencies:
- vite: ^5.2.0 || ^6 || ^7 || ^8
-
- '@tanstack/query-core@5.103.2':
- resolution: {integrity: sha512-I8DkFXls5jXLqtm8+QpOhEmG07hIblhSZFzafg9wHsMSEvMzULy9hK17wU1T/ahfhMbtITJhbxutwwCoihkR7A==}
+ '@nodable/entities@3.0.0':
+ resolution: {integrity: sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==}
- '@tanstack/react-query@5.103.2':
- resolution: {integrity: sha512-B+fWiYZBc+0uUD5zDZAeLw9dKj7XEsdnuu6zRZ+no6LNKpeE3P3bJ+N6HINjcIlWR6fW3vUoTneEaGa2V6ehqw==}
+ '@number-flow/react@0.6.2':
+ resolution: {integrity: sha512-WjZuV4aA+vhRCgCF+adGLgFVVAJ8vdvq6EchRT2FiBIgElTXtDOA3YgkcMr9UHpvpS9v4H70AB5wZv0D9jc3QA==}
peerDependencies:
react: ^18 || ^19
+ react-dom: ^18 || ^19
- '@tanstack/react-table@8.21.3':
- resolution: {integrity: sha512-5nNMTSETP4ykGegmVkhjcS8tTLW6Vl4axfEGQN3v0zdHYbK4UfoqfPChclTrJ4EoK9QynqAu9oUf8VEmrpZ5Ww==}
- engines: {node: '>=12'}
- peerDependencies:
- react: '>=16.8'
- react-dom: '>=16.8'
+ '@orama/orama@3.1.18':
+ resolution: {integrity: sha512-a61ljmRVVyG5MC/698C8/FfFDw5a8LOIvyOLW5fztgUXqUpc1jOfQzOitSCbge657OgXXThmY3Tk8fpiDb4UcA==}
+ engines: {node: '>= 20.0.0'}
- '@tanstack/table-core@8.21.3':
- resolution: {integrity: sha512-ldZXEhOBb8Is7xLs01fR3YEc3DERiz5silj8tnGkFZytt1abEvl/GhUmCE0PMLaMPTa3Jk4HbKmRlHmu+gCftg==}
- engines: {node: '>=12'}
+ '@oxc-project/types@0.150.0':
+ resolution: {integrity: sha512-rDS5/31E9HfPl/CIzGrn0DOlvBbXFseQ5URJ9sYMfstbKLD/c6Gm9vmRzRGDdAXyOIL4zmO37lc9RIwYqVruZw==}
- '@types/chai@5.2.3':
- resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+ '@playwright/test@1.63.0':
+ resolution: {integrity: sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==}
+ engines: {node: '>=20'}
+ hasBin: true
- '@types/debug@4.1.13':
- resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
+ '@pondwader/socks5-server@1.0.10':
+ resolution: {integrity: sha512-bQY06wzzR8D2+vVCUoBsr5QS2U6UgPUQRmErNwtsuI6vLcyRKkafjkr3KxbtGFf9aBBIV2mcvlsKD1UYaIV+sg==}
- '@types/deep-eql@4.0.2':
- resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+ '@radix-ui/number@1.1.3':
+ resolution: {integrity: sha512-Road2bidD0uu/1BGDOWNdPI06g0lIRy6IF9GZcIrDK2KGItfor8IQwQa+yM2ERgHM1MmHxaxpTzk0/Jp42lNfA==}
- '@types/estree-jsx@1.0.5':
- resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==}
+ '@radix-ui/primitive@1.1.7':
+ resolution: {integrity: sha512-rqWnm76nYT8HoNNqEjpgJ7Pw/DrBj5iBTrmEPo6HTX5+VJyBNOqTdv4g89G63HuR5g0AaENoAcH7Is5fF2kZ8Q==}
- '@types/estree@1.0.9':
- resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+ '@radix-ui/react-accordion@1.2.20':
+ resolution: {integrity: sha512-jDhG9FvAEnlhnjrsINbNXcUa4G+L1KqSkJSunkbKEzFRcAb52jvM0PjPxPRvhe1HNc5F5yc0yzzWeeqlH4yBIg==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@types/hast@3.0.5':
- resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==}
+ '@radix-ui/react-arrow@1.1.15':
+ resolution: {integrity: sha512-v4zggRcjadnI+ClKDuijlQEW4tw3NoaeHc/PwpKnLoLLKNUG4InLegkstooLcRIUWCs+8L22dGURCVuFfOKfnA==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@types/mdast@4.0.4':
- resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
+ '@radix-ui/react-collapsible@1.1.20':
+ resolution: {integrity: sha512-mcGesGplBnzN2sbvJETzpCNfSMyPnb29q1GRLU+Ib7bJrpIG2ywmRoh2V5VbA2uNvKikKUlVbAPks7JDjz4A8Q==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@types/ms@2.1.0':
- resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
+ '@radix-ui/react-collection@1.1.15':
+ resolution: {integrity: sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@types/node@26.1.0':
- resolution: {integrity: sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==}
+ '@radix-ui/react-compose-refs@1.1.5':
+ resolution: {integrity: sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
- '@types/react-dom@19.3.0':
- resolution: {integrity: sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==}
+ '@radix-ui/react-context@1.2.2':
+ resolution: {integrity: sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA==}
peerDependencies:
- '@types/react': ^19.3.0
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
- '@types/react@19.3.0':
- resolution: {integrity: sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==}
+ '@radix-ui/react-dialog@1.1.23':
+ resolution: {integrity: sha512-Ksw4WeROkO4rC9k/onilX/Ao2Cr1ku1unMNH+XSCcP4jSXYu7HDsg9n4ojMjVb22XpYjAQ9qfrFlVbru1vXDUA==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@types/unist@2.0.11':
- resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==}
+ '@radix-ui/react-direction@1.1.4':
+ resolution: {integrity: sha512-5pzg4FGQNpExhnhT2zlrP1wZFaYCd1K0nYWoFAdcYoYK868IEigqMX3B3f8yIoRlAhAeDWciLI6ZdCKHF9P4Vg==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
- '@types/unist@3.0.3':
- resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
+ '@radix-ui/react-dismissable-layer@1.1.19':
+ resolution: {integrity: sha512-8g4pfOL9HoKKLWGiypT+dphVqjFfmcXO5GBnhsG6zI+lxAx/8feQpr+1LSN8Re3hiZ+XkLNS4O9ztK11/LzQ6w==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@ungap/structured-clone@1.4.0':
- resolution: {integrity: sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==}
+ '@radix-ui/react-focus-guards@1.1.6':
+ resolution: {integrity: sha512-RNOJjfZMTyBM6xYmV3IVGXkPjIhcBAuv48POevAXwrGJhkWZ9p1rFoIS1JFooPuT193AZmRsCPhpoVJxx6OPoQ==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
- '@vitejs/plugin-react@6.1.1':
- resolution: {integrity: sha512-yxLaQV9gkhS8ezJqCM6+ndU7mDY6gqAg75NQ+0IjwEI8IYOmQCgkRwHKVSfWXW076DsqMo0Dk+0FK1U+M5RgFw==}
- engines: {node: ^20.19.0 || >=22.12.0}
+ '@radix-ui/react-focus-scope@1.1.16':
+ resolution: {integrity: sha512-wmRZ2WWLvmt6KHy2rNPOdPUjwq5xOHY02+m+udwJTn0aNIox/rkskAvJTyTLGhPK6KgrUjlJUJpgmx/+wFiFIQ==}
peerDependencies:
- '@rolldown/plugin-babel': ^0.1.7 || ^0.2.0
- babel-plugin-react-compiler: ^1.0.0
- oxc-transform-react: ^0.145.0
- vite: ^8.0.0
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
peerDependenciesMeta:
- '@rolldown/plugin-babel':
+ '@types/react':
optional: true
- babel-plugin-react-compiler:
+ '@types/react-dom':
optional: true
- oxc-transform-react:
+
+ '@radix-ui/react-id@1.1.4':
+ resolution: {integrity: sha512-TMQp2llA+RYn7JcjnrMnz7wN4pcVttPZnRZo52PLQsoLVKzNlVwUeHmfePgTgRluXFvlD3GD5g5MOVVTJCO0qA==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
optional: true
- '@vitest/expect@4.1.11':
- resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}
+ '@radix-ui/react-navigation-menu@1.2.22':
+ resolution: {integrity: sha512-ou7iLEJ+yrhQndkkA4U21XIdS/CS45F4iXIkTZcb6/Ne9EMsOuDudVmCwmDnfFZZ+y1FZqXRNSIgBy+YMvZVZg==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@vitest/mocker@4.1.11':
- resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
+ '@radix-ui/react-popover@1.1.23':
+ resolution: {integrity: sha512-mw58MrBlyHWFisTOYignD0vf/3gdcgAR+9of1s9G/38CbFiUwH1nCDkc0AUM9IrXFgN5Ue8n45j9WCgyM1sbiQ==}
peerDependencies:
- msw: ^2.4.9
- vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
peerDependenciesMeta:
- msw:
+ '@types/react':
optional: true
- vite:
+ '@types/react-dom':
optional: true
- '@vitest/pretty-format@4.1.11':
- resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
+ '@radix-ui/react-popper@1.3.7':
+ resolution: {integrity: sha512-UsJrrd7w4wuKKTdvd/DNERVlwSlUcyXzjhyDwBk+3aPOsCjOY6ZSbxuw8E6lZTjjfP8Cpd0J8VVkrYUWyGYXyg==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
- '@vitest/runner@4.1.11':
+ '@radix-ui/react-portal@1.1.17':
+ resolution: {integrity: sha512-vKQLcWypUnwZVvfV7UkGahH2g6ySe8M8R+zYBwPrv5byZ9QAW6cQVvNKo7GgmD+p8aYb6D9JBuvy8/WhOno2wQ==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-presence@1.1.10':
+ resolution: {integrity: sha512-3wyzCQ6+ubRA+D4uv9m95JYLXxmOHp05qjrkjeA7uKHHtjpPggQzc6DAb0URl7j67oR0K2foO4ip27TiX037Bw==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-primitive@2.1.10':
+ resolution: {integrity: sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-roving-focus@1.1.19':
+ resolution: {integrity: sha512-V9jI6hDjT7l3jsCQD9bLNvDLM3tH/gdbOTp7Tefp3hbbgCGQoK7tUvrWiRlcoBHIZ809ElXwNQwVo0B98LuTXQ==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-scroll-area@1.2.18':
+ resolution: {integrity: sha512-Zn5Cd171wxsO3Dfg8HaW6RifTb9CYTKQJHs/G4+LN1GfmJpaQMZQyQxMprVPHpaz7QY4l9BxK2JwQuzHsXC8nA==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-select@2.3.7':
+ resolution: {integrity: sha512-WFGImkmbzcfxeIwq/+4HvRN0pizBwbwQUED4I13ezQsDdfl38ZntN6TmR8XaSzPBqoCToe8rF75j6NPNDSzhbg==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-slot@1.3.3':
+ resolution: {integrity: sha512-qx7oqnYbxnK9kYI9m317qmFmEgo6ywqWvbTogdj7cL9p3/yx4M48p7Rnw5z3H890cL/ow/EeWJsuTykeZVXP5Q==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-tabs@1.1.21':
+ resolution: {integrity: sha512-UKxJlZid7FVtsk/WTxj4i4uSEgj2Au+KBbS7SQyTlzMhhn+86Cz3tISZdTa87bfEfcuvZezf2ZsxD4xuEKtkog==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/react-use-callback-ref@1.1.4':
+ resolution: {integrity: sha512-R6OUY2e2fA6Yn6s+VSx5KBV6Nx8LQEhu+cz7LCej18rQ1HLyg9PSC9jP/ZNx0o6FAIK9c0F1kHylzSxKsdlkrQ==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-controllable-state@1.2.6':
+ resolution: {integrity: sha512-uEQJGT97ZA/TgP/Hydw47lHu+/vQj6z/0jA+WeTbK1o9Rx45GImjpD0tc3W5ad3D6XTSR6e1yEO0FvGq6WQfVQ==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-effect-event@0.0.5':
+ resolution: {integrity: sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-is-hydrated@0.1.3':
+ resolution: {integrity: sha512-umO/aJ+82CpOnhDZUTbILCQf7kU/g0iv+oGs/Q8jw7IkhWBzaEP4sA268PhFAJTFetbwp3ICc6ktpI4TqtxcIw==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-layout-effect@1.1.4':
+ resolution: {integrity: sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-previous@1.1.4':
+ resolution: {integrity: sha512-XoSLhbRbqxFtgJoi2fNHA3C6pDlY34x508vUpUGoFZfvePfHXHbE1lC4FYFMnJWgiCRroSTw6fOsXQoVS9RwZg==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-rect@1.1.4':
+ resolution: {integrity: sha512-cSOCh6JlkmfjLyNcLiu2nB4v+nm+dkZ+Q5KHWk/soo4U7ZLiEQFKHK9/YmtBHjfCEaU43IBKQOc4/uJmCaiCTQ==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-use-size@1.1.4':
+ resolution: {integrity: sha512-D3anSY15EJoxrihpsXI6SMrmmonnQtR2ni7arO+Lfdg3O95b9hNXxONk8jA5C8ANdF/h5HMAxejgs8PWJ6rlhw==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-visually-hidden@1.2.11':
+ resolution: {integrity: sha512-NFS86RYYZb4/exihaESBGOpMJFz8MGLAfu3mOBSGByVnVPC9JPASfYubxd/8KbkQK0sYAv8lVQDEQukDX/qXvQ==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
+ '@radix-ui/rect@1.1.3':
+ resolution: {integrity: sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==}
+
+ '@rolldown/binding-android-arm-eabi@1.2.9':
+ resolution: {integrity: sha512-tNISae1QEf/vkb3xkRcjV5SEdzPE97We5IVaa2Z8jSszQPZ8U60B/YCYpw4QI7VidYsBtKavczXf+DyDs9WGxw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm]
+ os: [android]
+
+ '@rolldown/binding-android-arm64@1.2.9':
+ resolution: {integrity: sha512-YC8YsI30o606GTZi0VyzYlsDKFP8W61i/QzayHDkLbNEz/IShqAmTa+hsJRj13xTHA0H+6fk4b2UmGn+Q/cMlg==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm64]
+ os: [android]
+
+ '@rolldown/binding-darwin-arm64@1.2.9':
+ resolution: {integrity: sha512-IwhlH3qK5urrY8hZiEgGkHKEFN901p/p2bjxCxJlr4GyNnF7wYpUvK+Y43uaRYuC4hpfjzbR3SJC3arX1jGvmw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@rolldown/binding-darwin-x64@1.2.9':
+ resolution: {integrity: sha512-XxpJfVzFh+jilRxIXUqcfYAYcunIc/XEzIizsOL1fcJee5Sf7H3mH8WlLmfHfluz5amqR88QQo9izKtmMlavAw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [x64]
+ os: [darwin]
+
+ '@rolldown/binding-freebsd-x64@1.2.9':
+ resolution: {integrity: sha512-kSfvhmgeWyfkbT3p/1s5vSgboogoah2zkm9fX2zjg2hHxSV7T4KhMWRUUaRk4OXNqoD3QAUeRqLcs1aZOK4U1g==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@rolldown/binding-linux-arm-gnueabihf@1.2.9':
+ resolution: {integrity: sha512-1RVzG17pxqbTfYLC352JlLt6kKLG+6Hr30n8DlIJqsnV5luUDd2Qdx9Ayw1Cabfyb1K9k0jXEZ7evxkRoT+uiw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm]
+ os: [linux]
+
+ '@rolldown/binding-linux-arm64-gnu@1.2.9':
+ resolution: {integrity: sha512-BXqPvZ2drqVD+/Z8UpKwcs4Mp7grM+eGFku4CAEKrEtcbAsUpzREphK1sogCRZGreVPiMkiiBtw0n3TPteuqvw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rolldown/binding-linux-arm64-musl@1.2.9':
+ resolution: {integrity: sha512-11vWvo8YDwLzukt27J3aYDWU+gg2P7J+ZOmiJ0hkF5BXZDW7pVya7r40MXDy6ya0i9KamoENSVKIugvJNgFXIA==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@rolldown/binding-linux-ppc64-gnu@1.2.9':
+ resolution: {integrity: sha512-a1tijMkdwsIARtc0F39ApURROkf3NwqinI6TOiSSWCTR7dT96dffNvMUtDHnq64wKNTIZOIlzKrFvvFUznJiyw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rolldown/binding-linux-s390x-gnu@1.2.9':
+ resolution: {integrity: sha512-x6SQNdAvv4c3hWqTMaWuawzMX9myaCs/yEmlGsxJzkdClnHW7FbrjQuSiRDhuSYzEYoEMhsaJy9qHG/XNemJPQ==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [s390x]
+ os: [linux]
+ libc: [glibc]
+
+ '@rolldown/binding-linux-x64-gnu@1.2.9':
+ resolution: {integrity: sha512-9s0AZ8BFK5/n7B/TBoa2yJE3gI3KURrbXcPBlsAsvjU4VeJKgE90y1YtNxyEUIcHPQkg6/yfF3qihUrcM/Kf0Q==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rolldown/binding-linux-x64-musl@1.2.9':
+ resolution: {integrity: sha512-P7VWAmV+WdJluH7ovnRGoiv2i8To7GAZ+kGzfGup635cyL7SyYl3lSUaA3Gp5THf0n/Co5EyEqb2zbqq+nMOHQ==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [x64]
+ os: [linux]
+ libc: [musl]
+
+ '@rolldown/binding-openharmony-arm64@1.2.9':
+ resolution: {integrity: sha512-1qixtsE4BK8h+yS3BfmZ09UhA7O/N4IACva6YBr7EBvCJraByTuRcgOTaiA62Tm0vey3UcKXLOaoGHtYmNGEVg==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm64]
+ os: [openharmony]
+
+ '@rolldown/binding-win32-arm64-msvc@1.2.9':
+ resolution: {integrity: sha512-ok8IQjcEPs1AKZfuEUznVBrJw+gK4soq+bx8b1X2XoMqVClarc1q5JDmVtWXY1xfr6ZuHTAsPXHTgTrqKTZeww==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [arm64]
+ os: [win32]
+
+ '@rolldown/binding-win32-x64-msvc@1.2.9':
+ resolution: {integrity: sha512-Ip2mXoU0hM0boq3Rf+ekuT653OROSo6aSYcPT1VHE4q52KvyxgFkQgrgb/IEsxOuvQ2fZZbs8khJAyCEPM24/g==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ cpu: [x64]
+ os: [win32]
+
+ '@rolldown/pluginutils@1.0.1':
+ resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
+
+ '@scalar/helpers@0.0.11':
+ resolution: {integrity: sha512-EoAufzG0crQloYJxbCV8F+Y5vPyeeh1HMngGlXPT6oGSJPi6DiNA9wztqK3lvaBmSkJMh4VKIbejVqAXx1a0tg==}
+ engines: {node: '>=20'}
+
+ '@scalar/helpers@0.0.12':
+ resolution: {integrity: sha512-4NDmHShyi1hrVRsJCdRZT/FIpy+/5PFbVbQLRYX/pjpu5cYqHBj9s6n5RI6gGDXEBHAIFi63g9FC6Isgr66l1Q==}
+ engines: {node: '>=20'}
+
+ '@scalar/json-magic@0.6.0':
+ resolution: {integrity: sha512-sy2yL7V8ZF7oUoMl46TjFbBfqZESDmKPfPXeyWeIcwKgjFwjM/FvLdGOOPNsYQ2tPZUCzg8QCNJk9QM+BKVyRg==}
+ engines: {node: '>=20'}
+
+ '@scalar/json-magic@0.6.1':
+ resolution: {integrity: sha512-HJMPY5dUU3EXVS4EkjAFXo+uCrby/YFu/gljKDQnhYWRy5zQ0sJWrOEDcHS8nLoJRCIRD5tiVpCxnUnSb6OoAQ==}
+ engines: {node: '>=20'}
+
+ '@scalar/openapi-parser@0.22.1':
+ resolution: {integrity: sha512-GJV7f9VLoyKbArMcWETbJ+xPqkopNBlb+oxEBSlSYYsoWc+p+sLAtuwObfJT8Ia+CStl5Y2ZRk/2DgCuy1vsaQ==}
+ engines: {node: '>=20'}
+
+ '@scalar/openapi-types@0.4.0':
+ resolution: {integrity: sha512-vdFLzz7vETw6kS3bxWUHCBeFtJOnr1bk/+FXKyxKkd6TbcyT6USXkoelI704IaBdoXyOgGX10FD1IVrs4FwUow==}
+ engines: {node: '>=20'}
+
+ '@scalar/openapi-upgrader@0.1.1':
+ resolution: {integrity: sha512-NlrQezuNGtejqS/SQshY9SjD4D66jiJcWgC2zfCS4muyfE2K85e0i6gegnKLZPSNrqoAvJyR78NPapme9z2/wg==}
+ engines: {node: '>=20'}
+
+ '@shikijs/core@3.23.0':
+ resolution: {integrity: sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA==}
+
+ '@shikijs/engine-javascript@3.23.0':
+ resolution: {integrity: sha512-aHt9eiGFobmWR5uqJUViySI1bHMqrAgamWE1TYSUoftkAeCCAiGawPMwM+VCadylQtF4V3VNOZ5LmfItH5f3yA==}
+
+ '@shikijs/engine-oniguruma@3.23.0':
+ resolution: {integrity: sha512-1nWINwKXxKKLqPibT5f4pAFLej9oZzQTsby8942OTlsJzOBZ0MWKiwzMsd+jhzu8YPCHAswGnnN1YtQfirL35g==}
+
+ '@shikijs/langs@3.23.0':
+ resolution: {integrity: sha512-2Ep4W3Re5aB1/62RSYQInK9mM3HsLeB91cHqznAJMuylqjzNVAVCMnNWRHFtcNHXsoNRayP9z1qj4Sq3nMqYXg==}
+
+ '@shikijs/rehype@3.23.0':
+ resolution: {integrity: sha512-GepKJxXHbXFfAkiZZZ+4V7x71Lw3s0ALYmydUxJRdvpKjSx9FOMSaunv6WRLFBXR6qjYerUq1YZQno+2gLEPwA==}
+
+ '@shikijs/themes@3.23.0':
+ resolution: {integrity: sha512-5qySYa1ZgAT18HR/ypENL9cUSGOeI2x+4IvYJu4JgVJdizn6kG4ia5Q1jDEOi7gTbN4RbuYtmHh0W3eccOrjMA==}
+
+ '@shikijs/transformers@3.23.0':
+ resolution: {integrity: sha512-F9msZVxdF+krQNSdQ4V+Ja5QemeAoTQ2jxt7nJCwhDsdF1JWS3KxIQXA3lQbyKwS3J61oHRUSv4jYWv3CkaKTQ==}
+
+ '@shikijs/types@3.23.0':
+ resolution: {integrity: sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ==}
+
+ '@shikijs/vscode-textmate@10.0.2':
+ resolution: {integrity: sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==}
+
+ '@silvia-odwyer/photon-node@0.3.4':
+ resolution: {integrity: sha512-bnly4BKB3KDTFxrUIcgCLbaeVVS8lrAkri1pEzskpmxu9MdfGQTy8b8EgcD83ywD3RPMsIulY8xJH5Awa+t9fA==}
+
+ '@sinclair/typebox@0.34.52':
+ resolution: {integrity: sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==}
+
+ '@stablelib/base64@1.0.1':
+ resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
+
+ '@standard-schema/spec@1.1.0':
+ resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
+ '@swc/helpers@0.5.15':
+ resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==}
+
+ '@tailwindcss/node@4.3.3':
+ resolution: {integrity: sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==}
+
+ '@tailwindcss/oxide-android-arm64@4.3.3':
+ resolution: {integrity: sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==}
+ engines: {node: '>= 20'}
+ cpu: [arm64]
+ os: [android]
+
+ '@tailwindcss/oxide-darwin-arm64@4.3.3':
+ resolution: {integrity: sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==}
+ engines: {node: '>= 20'}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@tailwindcss/oxide-darwin-x64@4.3.3':
+ resolution: {integrity: sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==}
+ engines: {node: '>= 20'}
+ cpu: [x64]
+ os: [darwin]
+
+ '@tailwindcss/oxide-freebsd-x64@4.3.3':
+ resolution: {integrity: sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==}
+ engines: {node: '>= 20'}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3':
+ resolution: {integrity: sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==}
+ engines: {node: '>= 20'}
+ cpu: [arm]
+ os: [linux]
+
+ '@tailwindcss/oxide-linux-arm64-gnu@4.3.3':
+ resolution: {integrity: sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==}
+ engines: {node: '>= 20'}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
+
+ '@tailwindcss/oxide-linux-arm64-musl@4.3.3':
+ resolution: {integrity: sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==}
+ engines: {node: '>= 20'}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@tailwindcss/oxide-linux-x64-gnu@4.3.3':
+ resolution: {integrity: sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==}
+ engines: {node: '>= 20'}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
+
+ '@tailwindcss/oxide-linux-x64-musl@4.3.3':
+ resolution: {integrity: sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==}
+ engines: {node: '>= 20'}
+ cpu: [x64]
+ os: [linux]
+ libc: [musl]
+
+ '@tailwindcss/oxide-wasm32-wasi@4.3.3':
+ resolution: {integrity: sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==}
+ engines: {node: '>=14.0.0'}
+ cpu: [wasm32]
+ bundledDependencies:
+ - '@napi-rs/wasm-runtime'
+ - '@emnapi/core'
+ - '@emnapi/runtime'
+ - '@tybys/wasm-util'
+ - '@emnapi/wasi-threads'
+ - tslib
+
+ '@tailwindcss/oxide-win32-arm64-msvc@4.3.3':
+ resolution: {integrity: sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==}
+ engines: {node: '>= 20'}
+ cpu: [arm64]
+ os: [win32]
+
+ '@tailwindcss/oxide-win32-x64-msvc@4.3.3':
+ resolution: {integrity: sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==}
+ engines: {node: '>= 20'}
+ cpu: [x64]
+ os: [win32]
+
+ '@tailwindcss/oxide@4.3.3':
+ resolution: {integrity: sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==}
+ engines: {node: '>= 20'}
+
+ '@tailwindcss/postcss@4.3.3':
+ resolution: {integrity: sha512-JTSZZGQi1AyKirbLN3azmjVzef92tcX7h+iSqPdaeStyFpGpDlKvvpxeOE8njhbUanbRwr3z8DyzhICWnMtQeg==}
+
+ '@tailwindcss/vite@4.3.3':
+ resolution: {integrity: sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==}
+ peerDependencies:
+ vite: ^5.2.0 || ^6 || ^7 || ^8
+
+ '@tanstack/query-core@5.103.2':
+ resolution: {integrity: sha512-I8DkFXls5jXLqtm8+QpOhEmG07hIblhSZFzafg9wHsMSEvMzULy9hK17wU1T/ahfhMbtITJhbxutwwCoihkR7A==}
+
+ '@tanstack/react-query@5.103.2':
+ resolution: {integrity: sha512-B+fWiYZBc+0uUD5zDZAeLw9dKj7XEsdnuu6zRZ+no6LNKpeE3P3bJ+N6HINjcIlWR6fW3vUoTneEaGa2V6ehqw==}
+ peerDependencies:
+ react: ^18 || ^19
+
+ '@tanstack/react-table@8.21.3':
+ resolution: {integrity: sha512-5nNMTSETP4ykGegmVkhjcS8tTLW6Vl4axfEGQN3v0zdHYbK4UfoqfPChclTrJ4EoK9QynqAu9oUf8VEmrpZ5Ww==}
+ engines: {node: '>=12'}
+ peerDependencies:
+ react: '>=16.8'
+ react-dom: '>=16.8'
+
+ '@tanstack/table-core@8.21.3':
+ resolution: {integrity: sha512-ldZXEhOBb8Is7xLs01fR3YEc3DERiz5silj8tnGkFZytt1abEvl/GhUmCE0PMLaMPTa3Jk4HbKmRlHmu+gCftg==}
+ engines: {node: '>=12'}
+
+ '@types/chai@5.2.3':
+ resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+ '@types/debug@4.1.13':
+ resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
+
+ '@types/deep-eql@4.0.2':
+ resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
+ '@types/estree-jsx@1.0.5':
+ resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==}
+
+ '@types/estree@1.0.9':
+ resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+ '@types/hast@3.0.5':
+ resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==}
+
+ '@types/json-schema@7.0.15':
+ resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+ '@types/mdast@4.0.4':
+ resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
+
+ '@types/mdx@2.0.14':
+ resolution: {integrity: sha512-T48PeuJtvLosNTPVhfnIp3i/n3a4g4Bad7YCq5k64D4u7NwDrAotikQ+5+sjtUvBmxCMlbo3dVL+C2dP0rWHzg==}
+
+ '@types/ms@2.1.0':
+ resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
+
+ '@types/node@22.20.4':
+ resolution: {integrity: sha512-zJRE40jpHtKqE/C4fgHrAKQLJuSpzEnP9ff9Y7YtoR3Wd2pwqzlekDeEuUQXjRd+QCYnVnNwuJYmhdk9XV8gvA==}
+
+ '@types/node@26.1.0':
+ resolution: {integrity: sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==}
+
+ '@types/react-dom@19.3.0':
+ resolution: {integrity: sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==}
+ peerDependencies:
+ '@types/react': ^19.3.0
+
+ '@types/react@19.3.0':
+ resolution: {integrity: sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==}
+
+ '@types/unist@2.0.11':
+ resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==}
+
+ '@types/unist@3.0.3':
+ resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
+
+ '@ungap/structured-clone@1.4.0':
+ resolution: {integrity: sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==}
+
+ '@vitejs/plugin-react@6.1.1':
+ resolution: {integrity: sha512-yxLaQV9gkhS8ezJqCM6+ndU7mDY6gqAg75NQ+0IjwEI8IYOmQCgkRwHKVSfWXW076DsqMo0Dk+0FK1U+M5RgFw==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ peerDependencies:
+ '@rolldown/plugin-babel': ^0.1.7 || ^0.2.0
+ babel-plugin-react-compiler: ^1.0.0
+ oxc-transform-react: ^0.145.0
+ vite: ^8.0.0
+ peerDependenciesMeta:
+ '@rolldown/plugin-babel':
+ optional: true
+ babel-plugin-react-compiler:
+ optional: true
+ oxc-transform-react:
+ optional: true
+
+ '@vitest/expect@4.1.11':
+ resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}
+
+ '@vitest/mocker@4.1.11':
+ resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
+ peerDependencies:
+ msw: ^2.4.9
+ vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+ peerDependenciesMeta:
+ msw:
+ optional: true
+ vite:
+ optional: true
+
+ '@vitest/pretty-format@4.1.11':
+ resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
+
+ '@vitest/runner@4.1.11':
resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}
'@vitest/snapshot@4.1.11':
@@ -814,6 +1709,24 @@ packages:
resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
engines: {node: '>= 0.6'}
+ acorn-jsx@5.3.2:
+ resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+ peerDependencies:
+ acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+ acorn@8.18.0:
+ resolution: {integrity: sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==}
+ engines: {node: '>=0.4.0'}
+ hasBin: true
+
+ ajv-draft-04@1.0.0:
+ resolution: {integrity: sha512-mv00Te6nmYbRp5DCwclxtt7yV/joXJPGS7nM+97GdxvuttCOfgI3K4U25zboyeX0O+myI8ERluxQe5wljMmVIw==}
+ peerDependencies:
+ ajv: ^8.5.0
+ peerDependenciesMeta:
+ ajv:
+ optional: true
+
ajv-formats@3.0.1:
resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
peerDependencies:
@@ -825,10 +1738,27 @@ packages:
ajv@8.20.0:
resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+ anynum@1.0.1:
+ resolution: {integrity: sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==}
+
+ argparse@1.0.10:
+ resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
+
+ argparse@2.0.1:
+ resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+ aria-hidden@1.2.6:
+ resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
+ engines: {node: '>=10'}
+
assertion-error@2.0.1:
resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
engines: {node: '>=12'}
+ astring@1.9.0:
+ resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==}
+ hasBin: true
+
bail@2.0.2:
resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
@@ -856,6 +1786,9 @@ packages:
resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
engines: {node: '>= 0.4'}
+ caniuse-lite@1.0.30001812:
+ resolution: {integrity: sha512-qN+QNNBr93TCmFrmte0bBCjSDMuRvt78VlHT99qIGPszm4QsqCX8lnyWUFkHi8B7ZBAPq8SH+UqyXNy/odMdng==}
+
ccount@2.0.1:
resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
@@ -879,16 +1812,29 @@ packages:
character-reference-invalid@2.0.1:
resolution: {integrity: sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==}
+ chokidar@4.0.3:
+ resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+ engines: {node: '>= 14.16.0'}
+
class-variance-authority@0.7.1:
resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
+ client-only@0.0.1:
+ resolution: {integrity: sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==}
+
clsx@2.1.1:
resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
engines: {node: '>=6'}
+ collapse-white-space@2.1.0:
+ resolution: {integrity: sha512-loKTxY1zCOuG4j9f6EPnuyyYkf58RnhhWTvRoZEokgB+WbdXehfjFviyOVYkqzEWz1Q5kRiZdBYS5SwxbQYwzw==}
+
comma-separated-tokens@2.0.3:
resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
+ compute-scroll-into-view@3.1.1:
+ resolution: {integrity: sha512-VRhuHOLoKYOy4UbilLbUzbYg93XLjv2PncJC50EuTWPA3gaja1UjBsUP/D/9/juV3vQFr6XBEzn9KCAHdUvOHw==}
+
content-disposition@1.1.0:
resolution: {integrity: sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==}
engines: {node: '>=18'}
@@ -920,6 +1866,11 @@ packages:
resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
engines: {node: '>= 8'}
+ cssesc@3.0.0:
+ resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+ engines: {node: '>=4'}
+ hasBin: true
+
csstype@3.2.3:
resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
@@ -947,6 +1898,9 @@ packages:
resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
engines: {node: '>=8'}
+ detect-node-es@1.1.0:
+ resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
+
devlop@1.1.0:
resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
@@ -984,6 +1938,17 @@ packages:
resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
engines: {node: '>= 0.4'}
+ esast-util-from-estree@2.0.0:
+ resolution: {integrity: sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ==}
+
+ esast-util-from-js@2.0.1:
+ resolution: {integrity: sha512-8Ja+rNJ0Lt56Pcf3TAmpBZjmx8ZcK5Ts4cAzIOjsjevg9oSXJnl6SUQ2EevU8tv3h6ZLWmoKL5H4fgWvdvfETw==}
+
+ esbuild@0.25.12:
+ resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+ engines: {node: '>=18'}
+ hasBin: true
+
esbuild@0.28.2:
resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
engines: {node: '>=18'}
@@ -999,9 +1964,32 @@ packages:
esm-env@1.2.2:
resolution: {integrity: sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==}
+ esprima@4.0.1:
+ resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
+ engines: {node: '>=4'}
+ hasBin: true
+
+ estree-util-attach-comments@3.0.0:
+ resolution: {integrity: sha512-cKUwm/HUcTDsYh/9FgnuFqpfquUbwIqwKM26BVCGDPVgvaCl/nDCCjUfiLlx6lsEZ3Z4RFxNbOQ60pkaEwFxGw==}
+
+ estree-util-build-jsx@3.0.1:
+ resolution: {integrity: sha512-8U5eiL6BTrPxp/CHbs2yMgP8ftMhR5ww1eIKoWRMlqvltHF8fZn5LRDvTKuxD3DUn+shRbLGqXemcP51oFCsGQ==}
+
estree-util-is-identifier-name@3.0.0:
resolution: {integrity: sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==}
+ estree-util-scope@1.0.1:
+ resolution: {integrity: sha512-B0np3dcdxqILX5e9nEi5/Fr4K7gL4oYFVPV1zRa2e9wRCbQoZZNWOZFYyoInvXUPJXBXjss+QXlWLJChDEHDkA==}
+
+ estree-util-to-js@2.0.0:
+ resolution: {integrity: sha512-WDF+xj5rRWmD5tj6bIqRi6CkLIXbbNQUcxQHzGysQzvHmdYG2G7p/Tf0J0gpxGgkeMZNTIjT/AoSvC9Xehcgdg==}
+
+ estree-util-value-to-estree@3.5.0:
+ resolution: {integrity: sha512-aMV56R27Gv3QmfmF1MY12GWkGzzeAezAX+UplqHVASfjc9wNzI/X6hC0S9oxq61WT4aQesLGslWP9tKk6ghRZQ==}
+
+ estree-util-visit@2.0.0:
+ resolution: {integrity: sha512-m5KgiH85xAhhW8Wta0vShLcUvOsh3LLPI2YVwcbio1l7E09NTLL1EyMZFM1OyWowoH0skScNbhOPl4kcBgzTww==}
+
estree-walker@3.0.3:
resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
@@ -1031,6 +2019,10 @@ packages:
resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
engines: {node: '>= 18'}
+ extend-shallow@2.0.1:
+ resolution: {integrity: sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==}
+ engines: {node: '>=0.10.0'}
+
extend@3.0.2:
resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
@@ -1043,6 +2035,13 @@ packages:
fast-uri@3.1.7:
resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==}
+ fast-xml-builder@1.3.1:
+ resolution: {integrity: sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==}
+
+ fast-xml-parser@5.11.1:
+ resolution: {integrity: sha512-TBw6K/fxoQGGjCmZDw9w/ZwP3uDcnTM4YH/g+PFRWr8sbe5idXtxNN6vITh4+1ruCZaho6uBFurElsA7F0zzgw==}
+ hasBin: true
+
fdir@6.5.0:
resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
engines: {node: '>=12.0.0'}
@@ -1056,6 +2055,9 @@ packages:
resolution: {integrity: sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==}
engines: {node: '>= 18.0.0'}
+ foreach@2.0.6:
+ resolution: {integrity: sha512-k6GAGDyqLe9JaebCsFCoudPPWfihKu8pylYXRlqP1J7ms39iPoTtk2fviNglIeQEwdh0bQeKJ01ZPyuyQvKzwg==}
+
forwarded@0.2.0:
resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
engines: {node: '>= 0.6'}
@@ -1080,6 +2082,92 @@ packages:
engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
os: [darwin]
+ fumadocs-core@15.8.5:
+ resolution: {integrity: sha512-hyJtKGuB2J/5y7tDfI1EnGMKlNbSXM5N5cpwvgCY0DcBJwFMDG/GpSpaVRzh3aWy67pAYDZFIwdtbKXBa/q5bg==}
+ peerDependencies:
+ '@mixedbread/sdk': ^0.19.0
+ '@oramacloud/client': 1.x.x || 2.x.x
+ '@tanstack/react-router': 1.x.x
+ '@types/react': '*'
+ algoliasearch: 5.x.x
+ lucide-react: '*'
+ next: 14.x.x || 15.x.x
+ react: 18.x.x || 19.x.x
+ react-dom: 18.x.x || 19.x.x
+ react-router: 7.x.x
+ waku: ^0.26.0
+ peerDependenciesMeta:
+ '@mixedbread/sdk':
+ optional: true
+ '@oramacloud/client':
+ optional: true
+ '@tanstack/react-router':
+ optional: true
+ '@types/react':
+ optional: true
+ algoliasearch:
+ optional: true
+ lucide-react:
+ optional: true
+ next:
+ optional: true
+ react:
+ optional: true
+ react-dom:
+ optional: true
+ react-router:
+ optional: true
+ waku:
+ optional: true
+
+ fumadocs-mdx@12.0.3:
+ resolution: {integrity: sha512-OYqbHSmzkejG+iUMlZJJOitaVbCgBdo/REc/9Sq1WaZ1vq6bH9PCFU0cKJlRdHbQSGRfVg5EJJy5uKy5+iNFGQ==}
+ hasBin: true
+ peerDependencies:
+ '@fumadocs/mdx-remote': ^1.4.0
+ fumadocs-core: ^14.0.0 || ^15.0.0
+ next: ^15.3.0
+ react: '*'
+ vite: 6.x.x || 7.x.x
+ peerDependenciesMeta:
+ '@fumadocs/mdx-remote':
+ optional: true
+ next:
+ optional: true
+ react:
+ optional: true
+ vite:
+ optional: true
+
+ fumadocs-openapi@9.5.1:
+ resolution: {integrity: sha512-MvoOKtKHh3i/gq4fmasVPXPw+KfTlIEdnEj82xc/JExTd77+aW2f4AanE/bSm47JMzY26IXyS3Xro7wFui45sQ==}
+ peerDependencies:
+ '@scalar/api-client-react': '*'
+ '@types/react': '*'
+ react: 18.x.x || 19.x.x
+ react-dom: 18.x.x || 19.x.x
+ peerDependenciesMeta:
+ '@scalar/api-client-react':
+ optional: true
+ '@types/react':
+ optional: true
+
+ fumadocs-ui@15.8.5:
+ resolution: {integrity: sha512-9pyB+9rOOsrFnmmZ9xREp/OgVhyaSq2ocEpqTNbeQ7tlJ6JWbdFWfW0C9lRXprQEB6DJWUDtDxqKS5QXLH0EGA==}
+ peerDependencies:
+ '@types/react': '*'
+ next: 14.x.x || 15.x.x
+ react: 18.x.x || 19.x.x
+ react-dom: 18.x.x || 19.x.x
+ tailwindcss: ^3.4.14 || ^4.0.0
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ next:
+ optional: true
+ tailwindcss:
+ optional: true
+
function-bind@1.1.2:
resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
@@ -1091,10 +2179,17 @@ packages:
resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
engines: {node: '>= 0.4'}
+ get-nonce@1.0.1:
+ resolution: {integrity: sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==}
+ engines: {node: '>=6'}
+
get-proto@1.0.1:
resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
engines: {node: '>= 0.4'}
+ github-slugger@2.0.0:
+ resolution: {integrity: sha512-IaOQ9puYtjrkq7Y0Ygl9KDZnrf/aiUJYUpVf89y8kyaxbRG7Y1SrX/jaumrv81vc61+kiMempujsM3Yw7w5qcw==}
+
gopd@1.2.0:
resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
engines: {node: '>= 0.4'}
@@ -1102,6 +2197,10 @@ packages:
graceful-fs@4.2.11:
resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+ gray-matter@4.0.3:
+ resolution: {integrity: sha512-5v6yZd4JK3eMI3FqqCouswVqwugaA9r4dNZB1wwcmrD02QkV5H0y7XBQW8QwQqEaZY1pM9aqORSORhJRdNK44Q==}
+ engines: {node: '>=6.0'}
+
has-symbols@1.1.0:
resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
engines: {node: '>= 0.4'}
@@ -1110,9 +2209,18 @@ packages:
resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
engines: {node: '>= 0.4'}
+ hast-util-to-estree@3.1.3:
+ resolution: {integrity: sha512-48+B/rJWAp0jamNbAAf9M7Uf//UVqAoMmgXhBdxTDJLGKY+LRnZ99qcG+Qjl5HfMpYNzS5v4EAwVEF34LeAj7w==}
+
+ hast-util-to-html@9.0.5:
+ resolution: {integrity: sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==}
+
hast-util-to-jsx-runtime@2.3.6:
resolution: {integrity: sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==}
+ hast-util-to-string@3.0.1:
+ resolution: {integrity: sha512-XelQVTDWvqcl3axRfI0xSeoVKzyIFPwsAGSLIsKdJKQMXDYJS4WYrBNF/8J7RdhIcFI2BOHgAifggsvsxp/3+A==}
+
hast-util-whitespace@3.0.0:
resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==}
@@ -1129,6 +2237,9 @@ packages:
html-url-attributes@3.0.1:
resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
+ html-void-elements@3.0.0:
+ resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
+
http-errors@2.0.1:
resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
engines: {node: '>= 0.8'}
@@ -1145,6 +2256,11 @@ packages:
resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==}
engines: {node: '>=0.10.0'}
+ image-size@2.0.4:
+ resolution: {integrity: sha512-QRUkFFsRV/6fuESxb9Vkq+a0LkSrgKXuc2NEqfikiXxxN/G3tjWt5EVUlMaImRBZRZK/jRBEbYvpPYZL8t08Zw==}
+ engines: {node: '>=18'}
+ hasBin: true
+
inherits@2.0.4:
resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
@@ -1168,6 +2284,10 @@ packages:
is-decimal@2.0.1:
resolution: {integrity: sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==}
+ is-extendable@0.1.1:
+ resolution: {integrity: sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==}
+ engines: {node: '>=0.10.0'}
+
is-hexadecimal@2.0.1:
resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
@@ -1178,6 +2298,9 @@ packages:
is-promise@4.0.0:
resolution: {integrity: sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==}
+ is-unsafe@2.0.2:
+ resolution: {integrity: sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==}
+
isexe@2.0.0:
resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
@@ -1188,6 +2311,17 @@ packages:
jose@6.2.12:
resolution: {integrity: sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==}
+ js-yaml@3.15.2:
+ resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==}
+ hasBin: true
+
+ js-yaml@4.3.2:
+ resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
+ hasBin: true
+
+ json-pointer@0.6.2:
+ resolution: {integrity: sha512-vLWcKbOaXlO+jvRy4qNd+TI1QUPZzfJj1tpJ3vAXDych5XJf93ftpUKe5pKCrzyIIwgBJcOcCVRUfqQP25afBw==}
+
json-schema-to-ts@3.1.1:
resolution: {integrity: sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==}
engines: {node: '>=16'}
@@ -1198,6 +2332,18 @@ packages:
json-schema-typed@8.0.2:
resolution: {integrity: sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==}
+ jsonpointer@5.0.1:
+ resolution: {integrity: sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==}
+ engines: {node: '>=0.10.0'}
+
+ kind-of@6.0.3:
+ resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
+ engines: {node: '>=0.10.0'}
+
+ leven@4.1.0:
+ resolution: {integrity: sha512-KZ9W9nWDT7rF7Dazg8xyLHGLrmpgq2nVNFUckhqdW3szVP6YhCpp/RAnpmVExA9JvrMynjwSLVrEj3AepHR6ew==}
+ engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
lightningcss-android-arm64@1.32.0:
resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==}
engines: {node: '>= 12.0.0'}
@@ -1346,9 +2492,16 @@ packages:
resolution: {integrity: sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==}
engines: {node: '>= 12.0.0'}
+ lodash.merge@4.6.2:
+ resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
longest-streak@3.1.0:
resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==}
+ lru-cache@11.5.3:
+ resolution: {integrity: sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==}
+ engines: {node: 20 || >=22}
+
lucide-react@1.47.0:
resolution: {integrity: sha512-o8C23aXpNQypRY73W7fW02EyvWJinEMXgKeGjFoKym0zj3Q73hD97A1IQps1g8C14HTGsOpZL0Am+xjfgFZAbg==}
peerDependencies:
@@ -1357,6 +2510,10 @@ packages:
magic-string@0.30.21:
resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+ markdown-extensions@2.0.0:
+ resolution: {integrity: sha512-o5vL7aDWatOTX8LzaS1WMoaoxIiLRQJuIKKe2wAw6IeULDHaqbiqiggmx+pKvZDb1Sj+pE46Sn1T7lCqfFtg1Q==}
+ engines: {node: '>=16'}
+
markdown-table@3.0.4:
resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
@@ -1399,6 +2556,9 @@ packages:
mdast-util-mdx-jsx@3.2.0:
resolution: {integrity: sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==}
+ mdast-util-mdx@3.0.0:
+ resolution: {integrity: sha512-JfbYLAW7XnYTTbUsmpu0kdBUVe+yKVJZBItEjwyYJiDJuZ9w4eeaqks4HQO+R7objWgS2ymV60GYpI14Ug554w==}
+
mdast-util-mdxjs-esm@2.0.1:
resolution: {integrity: sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==}
@@ -1446,12 +2606,30 @@ packages:
micromark-extension-gfm@3.0.0:
resolution: {integrity: sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==}
+ micromark-extension-mdx-expression@3.0.1:
+ resolution: {integrity: sha512-dD/ADLJ1AeMvSAKBwO22zG22N4ybhe7kFIZ3LsDI0GlsNr2A3KYxb0LdC1u5rj4Nw+CHKY0RVdnHX8vj8ejm4Q==}
+
+ micromark-extension-mdx-jsx@3.0.2:
+ resolution: {integrity: sha512-e5+q1DjMh62LZAJOnDraSSbDMvGJ8x3cbjygy2qFEi7HCeUT4BDKCvMozPozcD6WmOt6sVvYDNBKhFSz3kjOVQ==}
+
+ micromark-extension-mdx-md@2.0.0:
+ resolution: {integrity: sha512-EpAiszsB3blw4Rpba7xTOUptcFeBFi+6PY8VnJ2hhimH+vCQDirWgsMpz7w1XcZE7LVrSAUGb9VJpG9ghlYvYQ==}
+
+ micromark-extension-mdxjs-esm@3.0.0:
+ resolution: {integrity: sha512-DJFl4ZqkErRpq/dAPyeWp15tGrcrrJho1hKK5uBS70BCtfrIFg81sqcTVu3Ta+KD1Tk5vAtBNElWxtAa+m8K9A==}
+
+ micromark-extension-mdxjs@3.0.0:
+ resolution: {integrity: sha512-A873fJfhnJ2siZyUrJ31l34Uqwy4xIFmvPY1oj+Ean5PHcPBYzEsvqvWGaWcfEIr11O5Dlw3p2y0tZWpKHDejQ==}
+
micromark-factory-destination@2.0.1:
resolution: {integrity: sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==}
micromark-factory-label@2.0.1:
resolution: {integrity: sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==}
+ micromark-factory-mdx-expression@2.0.3:
+ resolution: {integrity: sha512-kQnEtA3vzucU2BkrIa8/VaSAsP+EJ3CKOvhMuJgOEGg9KDC6OAY6nSnNDVRiVNRqj7Y4SlSzcStaH/5jge8JdQ==}
+
micromark-factory-space@2.0.1:
resolution: {integrity: sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==}
@@ -1482,6 +2660,9 @@ packages:
micromark-util-encode@2.0.1:
resolution: {integrity: sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==}
+ micromark-util-events-to-acorn@2.0.3:
+ resolution: {integrity: sha512-jmsiEIiZ1n7X1Rr5k8wVExBQCg5jy4UXVADItHmNk1zkwEVhBuIUKRu3fqv+hs4nxLISi2DQGlqIOGiFxgbfHg==}
+
micromark-util-html-tag-name@2.0.1:
resolution: {integrity: sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==}
@@ -1547,10 +2728,41 @@ packages:
resolution: {integrity: sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==}
engines: {node: '>=18'}
+ next-themes@0.4.6:
+ resolution: {integrity: sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==}
+ peerDependencies:
+ react: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc
+
+ next@15.5.26:
+ resolution: {integrity: sha512-EVCqhvq8Hs+nX9udH2VzE/iXAg9QodZBZnwVJTuAMl386GIYvlJtYhFytV9nSlDYxKw3kEyv8I2dCQs0+on0sQ==}
+ engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
+ hasBin: true
+ peerDependencies:
+ '@opentelemetry/api': ^1.1.0
+ '@playwright/test': ^1.51.1
+ babel-plugin-react-compiler: '*'
+ react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+ react-dom: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+ sass: ^1.3.0
+ peerDependenciesMeta:
+ '@opentelemetry/api':
+ optional: true
+ '@playwright/test':
+ optional: true
+ babel-plugin-react-compiler:
+ optional: true
+ sass:
+ optional: true
+
node-forge@1.4.0:
resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==}
engines: {node: '>= 6.13.0'}
+ npm-to-yarn@3.2.0:
+ resolution: {integrity: sha512-K1HmQeZT2HrjpsR6KgqbN2FAXL2NrJJmNUSD9ck7HGTVu1JKXox8n9SB+tjbU8m8JGLF4OscrroPepew/L7/Xw==}
+ engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
number-flow@0.6.2:
resolution: {integrity: sha512-MCnImG4Q5vPwhSXnov56nOuyyKn6LC+Qd7II1UiKc+ACRtug5iAtn0+CwXNxM38AC5lSowEY+oYEtZX2qMnUyw==}
@@ -1573,6 +2785,15 @@ packages:
once@1.4.0:
resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+ oniguruma-parser@0.12.2:
+ resolution: {integrity: sha512-6HVa5oIrgMC6aA6WF6XyyqbhRPJrKR02L20+2+zpDtO5QAzGHAUGw5TKQvwi5vctNnRHkJYmjAhRVQF2EKdTQw==}
+
+ oniguruma-to-es@4.3.6:
+ resolution: {integrity: sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA==}
+
+ openapi-sampler@1.7.6:
+ resolution: {integrity: sha512-MvWOm3vdgX7CZ6CNfu2wOFMGhC/pq03BxYTL/DKCkyPWfR6XIwUJnOV32mQGgCcUm1tY/y1jj7F2yqx1DieIWw==}
+
parse-entities@4.0.2:
resolution: {integrity: sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==}
@@ -1580,6 +2801,10 @@ packages:
resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
engines: {node: '>= 0.8'}
+ path-expression-matcher@1.6.2:
+ resolution: {integrity: sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ==}
+ engines: {node: '>=14.0.0'}
+
path-key@3.1.1:
resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
engines: {node: '>=8'}
@@ -1611,10 +2836,23 @@ packages:
engines: {node: '>=20'}
hasBin: true
+ postcss-selector-parser@7.1.6:
+ resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==}
+ engines: {node: '>=4'}
+
+ postcss@8.4.31:
+ resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
+ engines: {node: ^10 || ^12 || >=14}
+
postcss@8.5.28:
resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==}
engines: {node: ^10 || ^12 || >=14}
+ prettier@3.9.9:
+ resolution: {integrity: sha512-Z/CJHIkdujO/OtN7nXUii0Rf3VT5SRuhjBA82Xvu2XhBUgX3nhP67T0LHceBdQLex7OOFGTox+Q5Yg8Jk2Qivg==}
+ engines: {node: '>=14'}
+ hasBin: true
+
property-information@7.2.0:
resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==}
@@ -1639,6 +2877,16 @@ packages:
peerDependencies:
react: ^19.3.0
+ react-hook-form@7.89.0:
+ resolution: {integrity: sha512-vKcoCfy8RKZDrhSdqsRFp0uEOdS1AhLjOL6hR7Wmfzg1akNxEhaPf5WORx8SgEQPVXakdDyDkqQp+KNxVnnPHg==}
+ engines: {node: '>=18.0.0'}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8.0 || ^17 || ^18 || ^19
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
react-i18next@17.0.15:
resolution: {integrity: sha512-7uYpx/oBkesLto7cOzOmfITlUBaXHCAcFahmgETMfWr8nbbWRRnVGvz8wsH/xpbNcyoH+NpCcnOQEqWPMO6/hw==}
peerDependencies:
@@ -1648,26 +2896,95 @@ packages:
react-native: '*'
typescript: ^5 || ^6 || ^7
peerDependenciesMeta:
- react-dom:
- optional: true
- react-native:
+ react-dom:
+ optional: true
+ react-native:
+ optional: true
+ typescript:
+ optional: true
+
+ react-markdown@10.1.0:
+ resolution: {integrity: sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==}
+ peerDependencies:
+ '@types/react': '>=18'
+ react: '>=18'
+
+ react-medium-image-zoom@5.4.9:
+ resolution: {integrity: sha512-czBdTbJI6JEbqeRIT5M8D3j7TrffBfo00U0P0lzzd19usj8PiR1yPH7PK/vQlwBE/Sv9YFdJGN6XauJPi4jRyg==}
+ peerDependencies:
+ react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+ react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+ react-remove-scroll-bar@2.3.8:
+ resolution: {integrity: sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==}
+ engines: {node: '>=10'}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+ peerDependenciesMeta:
+ '@types/react':
optional: true
- typescript:
+
+ react-remove-scroll@2.7.2:
+ resolution: {integrity: sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==}
+ engines: {node: '>=10'}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
optional: true
- react-markdown@10.1.0:
- resolution: {integrity: sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==}
+ react-style-singleton@2.2.3:
+ resolution: {integrity: sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==}
+ engines: {node: '>=10'}
peerDependencies:
- '@types/react': '>=18'
- react: '>=18'
+ '@types/react': '*'
+ react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
react@19.3.0:
resolution: {integrity: sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==}
engines: {node: '>=0.10.0'}
+ readdirp@4.1.2:
+ resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+ engines: {node: '>= 14.18.0'}
+
+ recma-build-jsx@1.0.0:
+ resolution: {integrity: sha512-8GtdyqaBcDfva+GUKDr3nev3VpKAhup1+RvkMvUxURHpW7QyIvk9F5wz7Vzo06CEMSilw6uArgRqhpiUcWp8ew==}
+
+ recma-jsx@1.0.1:
+ resolution: {integrity: sha512-huSIy7VU2Z5OLv6oFLosQGGDqPqdO1iq6bWNAdhzMxSJP7RAso4fCZ1cKu8j9YHCZf3TPrq4dw3okhrylgcd7w==}
+ peerDependencies:
+ acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+ recma-parse@1.0.0:
+ resolution: {integrity: sha512-OYLsIGBB5Y5wjnSnQW6t3Xg7q3fQ7FWbw/vcXtORTnyaSFscOtABg+7Pnz6YZ6c27fG1/aN8CjfwoUEUIdwqWQ==}
+
+ recma-stringify@1.0.0:
+ resolution: {integrity: sha512-cjwII1MdIIVloKvC9ErQ+OgAtwHBmcZ0Bg4ciz78FtbT8In39aAYbaA7zvxQ61xVMSPE8WxhLwLbhif4Js2C+g==}
+
+ regex-recursion@6.0.2:
+ resolution: {integrity: sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg==}
+
+ regex-utilities@2.3.0:
+ resolution: {integrity: sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng==}
+
+ regex@6.1.0:
+ resolution: {integrity: sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg==}
+
+ rehype-recma@1.0.0:
+ resolution: {integrity: sha512-lqA4rGUf1JmacCNWWZx0Wv1dHqMwxzsDWYMTowuplHF3xH0N/MmrZ/G3BDZnzAkRmxDadujCjaKM2hqYdCBOGw==}
+
remark-gfm@4.0.1:
resolution: {integrity: sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==}
+ remark-mdx@3.1.1:
+ resolution: {integrity: sha512-Pjj2IYlUY3+D8x00UJsIOg5BEvfMyeI+2uLPn9VO9Wg4MEtN/VTIq2NEJQfde9PnX15KgtHyl9S0BcTnWrIuWg==}
+
remark-parse@11.0.0:
resolution: {integrity: sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==}
@@ -1677,6 +2994,9 @@ packages:
remark-stringify@11.0.0:
resolution: {integrity: sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==}
+ remark@15.0.1:
+ resolution: {integrity: sha512-Eht5w30ruCXgFmxVUSlNWQ9iiimq07URKeFS3hNc8cUWy1llX4KDWfyEDZRycMc+znsN9Ux5/tJ/BFdgdOwA3A==}
+
require-from-string@2.0.2:
resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
engines: {node: '>=0.10.0'}
@@ -1696,9 +3016,25 @@ packages:
safer-buffer@2.1.2:
resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+ sax@1.6.1:
+ resolution: {integrity: sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==}
+ engines: {node: '>=11.0.0'}
+
scheduler@0.28.0:
resolution: {integrity: sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw==}
+ scroll-into-view-if-needed@3.1.0:
+ resolution: {integrity: sha512-49oNpRjWRvnU8NyGVmUaYG4jtTkNonFZI86MmGRDqBphEK2EXT9gdEUoQPZhuBM8yWHxCWbobltqYO5M4XrUvQ==}
+
+ section-matter@1.0.0:
+ resolution: {integrity: sha512-vfD3pmTzGpufjScBh50YHKzEu2lxBWhVEHsNGoEXmCmn2hKGfeNLYMzCJpe8cD7gqX7TJluOVpBkAequ6dgMmA==}
+ engines: {node: '>=4'}
+
+ semver@7.8.5:
+ resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+ engines: {node: '>=10'}
+ hasBin: true
+
send@1.2.1:
resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==}
engines: {node: '>= 18'}
@@ -1713,6 +3049,15 @@ packages:
shadow-plugin@2.1.1:
resolution: {integrity: sha512-V4MwWPNzna/Zq6lIjT7vWAHf5uSCVDPkFG5m1cXs9WTtLGeLA3/NAtjJxxY3lYwBiA9O8+g/yLfC+c+P4qk4yw==}
+ sharp@0.35.5:
+ resolution: {integrity: sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==}
+ engines: {node: '>=20.9.0'}
+ peerDependencies:
+ '@types/node': '*'
+ peerDependenciesMeta:
+ '@types/node':
+ optional: true
+
shebang-command@2.0.0:
resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
engines: {node: '>=8'}
@@ -1721,6 +3066,9 @@ packages:
resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
engines: {node: '>=8'}
+ shiki@3.23.0:
+ resolution: {integrity: sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA==}
+
side-channel-list@1.0.1:
resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
engines: {node: '>= 0.4'}
@@ -1744,9 +3092,16 @@ packages:
resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
engines: {node: '>=0.10.0'}
+ source-map@0.7.6:
+ resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==}
+ engines: {node: '>= 12'}
+
space-separated-tokens@2.0.2:
resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==}
+ sprintf-js@1.0.3:
+ resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
+
stackback@0.0.2:
resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
@@ -1763,12 +3118,32 @@ packages:
stringify-entities@4.0.4:
resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==}
+ strip-bom-string@1.0.0:
+ resolution: {integrity: sha512-uCC2VHvQRYu+lMh4My/sFNmF2klFymLX1wHJeXnbEJERpV/ZsVuonzerjfrGpIGF7LBVa1O7i9kjiWvJiFck8g==}
+ engines: {node: '>=0.10.0'}
+
+ strnum@2.4.2:
+ resolution: {integrity: sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==}
+
style-to-js@1.1.21:
resolution: {integrity: sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==}
style-to-object@1.0.14:
resolution: {integrity: sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==}
+ styled-jsx@5.1.6:
+ resolution: {integrity: sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==}
+ engines: {node: '>= 12.0.0'}
+ peerDependencies:
+ '@babel/core': '*'
+ babel-plugin-macros: '*'
+ react: '>= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0'
+ peerDependenciesMeta:
+ '@babel/core':
+ optional: true
+ babel-plugin-macros:
+ optional: true
+
tailwind-merge@3.7.0:
resolution: {integrity: sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA==}
@@ -1822,6 +3197,9 @@ packages:
engines: {node: '>=14.17'}
hasBin: true
+ undici-types@6.21.0:
+ resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
+
undici-types@8.3.0:
resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
@@ -1831,6 +3209,9 @@ packages:
unist-util-is@6.0.1:
resolution: {integrity: sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==}
+ unist-util-position-from-estree@2.0.0:
+ resolution: {integrity: sha512-KaFVRjoqLyF6YXCbVLNad/eS4+OfPQQn2yOd7zF/h5T/CSL2v8NpN6a5TPvtbXthAGw5nG+PuTtq+DdIZr+cRQ==}
+
unist-util-position@5.0.0:
resolution: {integrity: sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==}
@@ -1856,11 +3237,34 @@ packages:
resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
engines: {node: '>= 0.8'}
+ use-callback-ref@1.3.3:
+ resolution: {integrity: sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==}
+ engines: {node: '>=10'}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ use-sidecar@1.1.3:
+ resolution: {integrity: sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==}
+ engines: {node: '>=10'}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
use-sync-external-store@1.7.0:
resolution: {integrity: sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A==}
peerDependencies:
react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+ util-deprecate@1.0.2:
+ resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
vary@1.1.2:
resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
engines: {node: '>= 0.8'}
@@ -1968,6 +3372,19 @@ packages:
wrappy@1.0.2:
resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+ xml-js@1.6.11:
+ resolution: {integrity: sha512-7rVi2KMfwfWFl+GpPg6m80IVMWXLRjO+PxTq7V2CDhoGak0wzYzFgUY2m4XJ47OGdXd8eLE8EmwfAmdjw7lC1g==}
+ hasBin: true
+
+ xml-naming@0.3.0:
+ resolution: {integrity: sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==}
+ engines: {node: '>=16.0.0'}
+
+ yaml@2.8.0:
+ resolution: {integrity: sha512-4lLa/EcQCB0cJkyts+FpIRx5G/llPxfP6VQU5KByHEhLxY3IJCH0f0Hy1MHI8sClTvsIb8qwRJ6R/ZdlDJ/leQ==}
+ engines: {node: '>= 14.6'}
+ hasBin: true
+
zod-to-json-schema@3.25.2:
resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==}
peerDependencies:
@@ -1976,6 +3393,9 @@ packages:
zod@3.25.76:
resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+ zod@4.1.11:
+ resolution: {integrity: sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg==}
+
zod@4.4.3:
resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
@@ -1984,6 +3404,8 @@ packages:
snapshots:
+ '@alloc/quick-lru@5.3.0': {}
+
'@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.269':
optional: true
@@ -2030,6 +3452,12 @@ snapshots:
optionalDependencies:
zod: 4.4.3
+ '@apidevtools/json-schema-ref-parser@11.9.3':
+ dependencies:
+ '@jsdevtools/ono': 7.1.3
+ '@types/json-schema': 7.0.15
+ js-yaml: 4.3.2
+
'@babel/runtime@7.29.7': {}
'@base-ui/react@1.8.0(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
@@ -2055,186 +3483,829 @@ snapshots:
optionalDependencies:
'@types/react': 19.3.0
- '@esbuild/aix-ppc64@0.28.2':
+ '@emnapi/runtime@1.11.3':
+ dependencies:
+ tslib: 2.8.1
+ optional: true
+
+ '@esbuild/aix-ppc64@0.25.12':
+ optional: true
+
+ '@esbuild/aix-ppc64@0.28.2':
+ optional: true
+
+ '@esbuild/android-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/android-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/android-arm@0.25.12':
+ optional: true
+
+ '@esbuild/android-arm@0.28.2':
+ optional: true
+
+ '@esbuild/android-x64@0.25.12':
+ optional: true
+
+ '@esbuild/android-x64@0.28.2':
+ optional: true
+
+ '@esbuild/darwin-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/darwin-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/darwin-x64@0.25.12':
+ optional: true
+
+ '@esbuild/darwin-x64@0.28.2':
+ optional: true
+
+ '@esbuild/freebsd-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/freebsd-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/freebsd-x64@0.25.12':
+ optional: true
+
+ '@esbuild/freebsd-x64@0.28.2':
+ optional: true
+
+ '@esbuild/linux-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/linux-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/linux-arm@0.25.12':
+ optional: true
+
+ '@esbuild/linux-arm@0.28.2':
+ optional: true
+
+ '@esbuild/linux-ia32@0.25.12':
+ optional: true
+
+ '@esbuild/linux-ia32@0.28.2':
+ optional: true
+
+ '@esbuild/linux-loong64@0.25.12':
+ optional: true
+
+ '@esbuild/linux-loong64@0.28.2':
+ optional: true
+
+ '@esbuild/linux-mips64el@0.25.12':
+ optional: true
+
+ '@esbuild/linux-mips64el@0.28.2':
+ optional: true
+
+ '@esbuild/linux-ppc64@0.25.12':
+ optional: true
+
+ '@esbuild/linux-ppc64@0.28.2':
+ optional: true
+
+ '@esbuild/linux-riscv64@0.25.12':
+ optional: true
+
+ '@esbuild/linux-riscv64@0.28.2':
+ optional: true
+
+ '@esbuild/linux-s390x@0.25.12':
+ optional: true
+
+ '@esbuild/linux-s390x@0.28.2':
+ optional: true
+
+ '@esbuild/linux-x64@0.25.12':
+ optional: true
+
+ '@esbuild/linux-x64@0.28.2':
+ optional: true
+
+ '@esbuild/netbsd-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/netbsd-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/netbsd-x64@0.25.12':
+ optional: true
+
+ '@esbuild/netbsd-x64@0.28.2':
+ optional: true
+
+ '@esbuild/openbsd-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/openbsd-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/openbsd-x64@0.25.12':
+ optional: true
+
+ '@esbuild/openbsd-x64@0.28.2':
+ optional: true
+
+ '@esbuild/openharmony-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/openharmony-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/sunos-x64@0.25.12':
+ optional: true
+
+ '@esbuild/sunos-x64@0.28.2':
+ optional: true
+
+ '@esbuild/win32-arm64@0.25.12':
+ optional: true
+
+ '@esbuild/win32-arm64@0.28.2':
+ optional: true
+
+ '@esbuild/win32-ia32@0.25.12':
+ optional: true
+
+ '@esbuild/win32-ia32@0.28.2':
+ optional: true
+
+ '@esbuild/win32-x64@0.25.12':
+ optional: true
+
+ '@esbuild/win32-x64@0.28.2':
+ optional: true
+
+ '@floating-ui/core@1.8.0':
+ dependencies:
+ '@floating-ui/utils': 0.2.12
+
+ '@floating-ui/dom@1.8.0':
+ dependencies:
+ '@floating-ui/core': 1.8.0
+ '@floating-ui/utils': 0.2.12
+
+ '@floating-ui/react-dom@2.1.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@floating-ui/dom': 1.8.0
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+
+ '@floating-ui/utils@0.2.12': {}
+
+ '@fontsource-variable/geist-mono@5.3.0': {}
+
+ '@fontsource-variable/inter@5.3.0': {}
+
+ '@formatjs/intl-localematcher@0.6.2':
+ dependencies:
+ tslib: 2.8.1
+
+ '@fumari/json-schema-to-typescript@1.1.3':
+ dependencies:
+ '@apidevtools/json-schema-ref-parser': 11.9.3
+ js-yaml: 4.3.2
+ prettier: 3.9.9
+
+ '@hono/node-server@2.1.1(hono@4.13.7)':
+ dependencies:
+ hono: 4.13.7
+
+ '@img/colour@1.1.0':
+ optional: true
+
+ '@img/sharp-darwin-arm64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-darwin-arm64': 1.3.4
+ optional: true
+
+ '@img/sharp-darwin-x64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-darwin-x64': 1.3.4
+ optional: true
+
+ '@img/sharp-freebsd-wasm32@0.35.5':
+ dependencies:
+ '@img/sharp-wasm32': 0.35.5
+ optional: true
+
+ '@img/sharp-libvips-darwin-arm64@1.3.4':
+ optional: true
+
+ '@img/sharp-libvips-darwin-x64@1.3.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-arm64@1.3.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-arm@1.3.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-ppc64@1.3.4':
optional: true
- '@esbuild/android-arm64@0.28.2':
+ '@img/sharp-libvips-linux-riscv64@1.3.4':
optional: true
- '@esbuild/android-arm@0.28.2':
+ '@img/sharp-libvips-linux-s390x@1.3.4':
optional: true
- '@esbuild/android-x64@0.28.2':
+ '@img/sharp-libvips-linux-x64@1.3.4':
optional: true
- '@esbuild/darwin-arm64@0.28.2':
+ '@img/sharp-libvips-linuxmusl-arm64@1.3.4':
optional: true
- '@esbuild/darwin-x64@0.28.2':
+ '@img/sharp-libvips-linuxmusl-x64@1.3.4':
optional: true
- '@esbuild/freebsd-arm64@0.28.2':
+ '@img/sharp-linux-arm64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-arm64': 1.3.4
optional: true
- '@esbuild/freebsd-x64@0.28.2':
+ '@img/sharp-linux-arm@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-arm': 1.3.4
optional: true
- '@esbuild/linux-arm64@0.28.2':
+ '@img/sharp-linux-ppc64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-ppc64': 1.3.4
optional: true
- '@esbuild/linux-arm@0.28.2':
+ '@img/sharp-linux-riscv64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-riscv64': 1.3.4
optional: true
- '@esbuild/linux-ia32@0.28.2':
+ '@img/sharp-linux-s390x@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-s390x': 1.3.4
optional: true
- '@esbuild/linux-loong64@0.28.2':
+ '@img/sharp-linux-x64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-x64': 1.3.4
optional: true
- '@esbuild/linux-mips64el@0.28.2':
+ '@img/sharp-linuxmusl-arm64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linuxmusl-arm64': 1.3.4
optional: true
- '@esbuild/linux-ppc64@0.28.2':
+ '@img/sharp-linuxmusl-x64@0.35.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linuxmusl-x64': 1.3.4
optional: true
- '@esbuild/linux-riscv64@0.28.2':
+ '@img/sharp-wasm32@0.35.5':
+ dependencies:
+ '@emnapi/runtime': 1.11.3
optional: true
- '@esbuild/linux-s390x@0.28.2':
+ '@img/sharp-webcontainers-wasm32@0.35.5':
+ dependencies:
+ '@img/sharp-wasm32': 0.35.5
optional: true
- '@esbuild/linux-x64@0.28.2':
+ '@img/sharp-win32-arm64@0.35.5':
optional: true
- '@esbuild/netbsd-arm64@0.28.2':
+ '@img/sharp-win32-ia32@0.35.5':
optional: true
- '@esbuild/netbsd-x64@0.28.2':
+ '@img/sharp-win32-x64@0.35.5':
optional: true
- '@esbuild/openbsd-arm64@0.28.2':
+ '@jridgewell/gen-mapping@0.3.13':
+ dependencies:
+ '@jridgewell/sourcemap-codec': 1.6.0
+ '@jridgewell/trace-mapping': 0.3.31
+
+ '@jridgewell/remapping@2.3.5':
+ dependencies:
+ '@jridgewell/gen-mapping': 0.3.13
+ '@jridgewell/trace-mapping': 0.3.31
+
+ '@jridgewell/resolve-uri@3.1.2': {}
+
+ '@jridgewell/sourcemap-codec@1.6.0': {}
+
+ '@jridgewell/trace-mapping@0.3.31':
+ dependencies:
+ '@jridgewell/resolve-uri': 3.1.2
+ '@jridgewell/sourcemap-codec': 1.6.0
+
+ '@jsdevtools/ono@7.1.3': {}
+
+ '@mdx-js/mdx@3.1.1':
+ dependencies:
+ '@types/estree': 1.0.9
+ '@types/estree-jsx': 1.0.5
+ '@types/hast': 3.0.5
+ '@types/mdx': 2.0.14
+ acorn: 8.18.0
+ collapse-white-space: 2.1.0
+ devlop: 1.1.0
+ estree-util-is-identifier-name: 3.0.0
+ estree-util-scope: 1.0.1
+ estree-walker: 3.0.3
+ hast-util-to-jsx-runtime: 2.3.6
+ markdown-extensions: 2.0.0
+ recma-build-jsx: 1.0.0
+ recma-jsx: 1.0.1(acorn@8.18.0)
+ recma-stringify: 1.0.0
+ rehype-recma: 1.0.0
+ remark-mdx: 3.1.1
+ remark-parse: 11.0.0
+ remark-rehype: 11.1.2
+ source-map: 0.7.6
+ unified: 11.0.5
+ unist-util-position-from-estree: 2.0.0
+ unist-util-stringify-position: 4.0.0
+ unist-util-visit: 5.1.0
+ vfile: 6.0.3
+ transitivePeerDependencies:
+ - supports-color
+
+ '@modelcontextprotocol/sdk@1.30.0(zod@3.25.76)':
+ dependencies:
+ '@hono/node-server': 2.1.1(hono@4.13.7)
+ ajv: 8.20.0
+ ajv-formats: 3.0.1(ajv@8.20.0)
+ content-type: 1.0.5
+ cors: 2.8.6
+ cross-spawn: 7.0.6
+ eventsource: 3.0.7
+ eventsource-parser: 3.1.1
+ express: 5.2.1
+ express-rate-limit: 8.7.0(express@5.2.1)
+ hono: 4.13.7
+ jose: 6.2.12
+ json-schema-typed: 8.0.2
+ pkce-challenge: 5.0.1
+ raw-body: 3.0.2
+ zod: 3.25.76
+ zod-to-json-schema: 3.25.2(zod@3.25.76)
+ transitivePeerDependencies:
+ - supports-color
+
+ '@modelcontextprotocol/sdk@1.30.0(zod@4.4.3)':
+ dependencies:
+ '@hono/node-server': 2.1.1(hono@4.13.7)
+ ajv: 8.20.0
+ ajv-formats: 3.0.1(ajv@8.20.0)
+ content-type: 1.0.5
+ cors: 2.8.6
+ cross-spawn: 7.0.6
+ eventsource: 3.0.7
+ eventsource-parser: 3.1.1
+ express: 5.2.1
+ express-rate-limit: 8.7.0(express@5.2.1)
+ hono: 4.13.7
+ jose: 6.2.12
+ json-schema-typed: 8.0.2
+ pkce-challenge: 5.0.1
+ raw-body: 3.0.2
+ zod: 4.4.3
+ zod-to-json-schema: 3.25.2(zod@4.4.3)
+ transitivePeerDependencies:
+ - supports-color
+
+ '@next/env@15.5.26': {}
+
+ '@next/swc-darwin-arm64@15.5.26':
optional: true
- '@esbuild/openbsd-x64@0.28.2':
+ '@next/swc-darwin-x64@15.5.26':
optional: true
- '@esbuild/openharmony-arm64@0.28.2':
+ '@next/swc-linux-arm64-gnu@15.5.26':
optional: true
- '@esbuild/sunos-x64@0.28.2':
+ '@next/swc-linux-arm64-musl@15.5.26':
optional: true
- '@esbuild/win32-arm64@0.28.2':
+ '@next/swc-linux-x64-gnu@15.5.26':
optional: true
- '@esbuild/win32-ia32@0.28.2':
+ '@next/swc-linux-x64-musl@15.5.26':
optional: true
- '@esbuild/win32-x64@0.28.2':
+ '@next/swc-win32-arm64-msvc@15.5.26':
optional: true
- '@floating-ui/core@1.8.0':
+ '@next/swc-win32-x64-msvc@15.5.26':
+ optional: true
+
+ '@nodable/entities@3.0.0': {}
+
+ '@number-flow/react@0.6.2(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
dependencies:
- '@floating-ui/utils': 0.2.12
+ esm-env: 1.2.2
+ number-flow: 0.6.2
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
- '@floating-ui/dom@1.8.0':
+ '@orama/orama@3.1.18': {}
+
+ '@oxc-project/types@0.150.0': {}
+
+ '@playwright/test@1.63.0':
dependencies:
- '@floating-ui/core': 1.8.0
- '@floating-ui/utils': 0.2.12
+ playwright: 1.63.0
+
+ '@pondwader/socks5-server@1.0.10': {}
+
+ '@radix-ui/number@1.1.3': {}
+
+ '@radix-ui/primitive@1.1.7': {}
+
+ '@radix-ui/react-accordion@1.2.20(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-collapsible': 1.1.20(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-arrow@1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-collapsible@1.1.20(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-collection@1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-compose-refs@1.1.5(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ '@radix-ui/react-context@1.2.2(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ '@radix-ui/react-dialog@1.1.23(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ aria-hidden: 1.2.6
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-direction@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ '@radix-ui/react-dismissable-layer@1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-focus-guards@1.1.6(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ '@radix-ui/react-focus-scope@1.1.16(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-id@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ '@radix-ui/react-navigation-menu@1.2.22(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-previous': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-popover@1.1.23(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ aria-hidden: 1.2.6
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-popper@1.3.7(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@floating-ui/react-dom': 2.1.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-arrow': 1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-rect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-size': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/rect': 1.1.3
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-portal@1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-presence@1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-primitive@2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-roving-focus@1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-scroll-area@1.2.18(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/number': 1.1.3
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-select@2.3.7(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ dependencies:
+ '@radix-ui/number': 1.1.3
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-previous': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ aria-hidden: 1.2.6
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
+
+ '@radix-ui/react-slot@1.3.3(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@floating-ui/react-dom@2.1.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ '@radix-ui/react-tabs@1.1.21(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
dependencies:
- '@floating-ui/dom': 1.8.0
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-context': 1.2.2(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.3.0)(react@19.3.0)
react: 19.3.0
react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
- '@floating-ui/utils@0.2.12': {}
-
- '@fontsource-variable/geist-mono@5.3.0': {}
-
- '@fontsource-variable/inter@5.3.0': {}
-
- '@hono/node-server@2.1.1(hono@4.13.7)':
+ '@radix-ui/react-use-callback-ref@1.1.4(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- hono: 4.13.7
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@jridgewell/gen-mapping@0.3.13':
+ '@radix-ui/react-use-controllable-state@1.2.6(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- '@jridgewell/sourcemap-codec': 1.6.0
- '@jridgewell/trace-mapping': 0.3.31
+ '@radix-ui/primitive': 1.1.7
+ '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@jridgewell/remapping@2.3.5':
+ '@radix-ui/react-use-effect-event@0.0.5(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- '@jridgewell/gen-mapping': 0.3.13
- '@jridgewell/trace-mapping': 0.3.31
-
- '@jridgewell/resolve-uri@3.1.2': {}
-
- '@jridgewell/sourcemap-codec@1.6.0': {}
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@jridgewell/trace-mapping@0.3.31':
+ '@radix-ui/react-use-is-hydrated@0.1.3(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- '@jridgewell/resolve-uri': 3.1.2
- '@jridgewell/sourcemap-codec': 1.6.0
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@modelcontextprotocol/sdk@1.30.0(zod@3.25.76)':
+ '@radix-ui/react-use-layout-effect@1.1.4(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- '@hono/node-server': 2.1.1(hono@4.13.7)
- ajv: 8.20.0
- ajv-formats: 3.0.1(ajv@8.20.0)
- content-type: 1.0.5
- cors: 2.8.6
- cross-spawn: 7.0.6
- eventsource: 3.0.7
- eventsource-parser: 3.1.1
- express: 5.2.1
- express-rate-limit: 8.7.0(express@5.2.1)
- hono: 4.13.7
- jose: 6.2.12
- json-schema-typed: 8.0.2
- pkce-challenge: 5.0.1
- raw-body: 3.0.2
- zod: 3.25.76
- zod-to-json-schema: 3.25.2(zod@3.25.76)
- transitivePeerDependencies:
- - supports-color
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@modelcontextprotocol/sdk@1.30.0(zod@4.4.3)':
+ '@radix-ui/react-use-previous@1.1.4(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- '@hono/node-server': 2.1.1(hono@4.13.7)
- ajv: 8.20.0
- ajv-formats: 3.0.1(ajv@8.20.0)
- content-type: 1.0.5
- cors: 2.8.6
- cross-spawn: 7.0.6
- eventsource: 3.0.7
- eventsource-parser: 3.1.1
- express: 5.2.1
- express-rate-limit: 8.7.0(express@5.2.1)
- hono: 4.13.7
- jose: 6.2.12
- json-schema-typed: 8.0.2
- pkce-challenge: 5.0.1
- raw-body: 3.0.2
- zod: 4.4.3
- zod-to-json-schema: 3.25.2(zod@4.4.3)
- transitivePeerDependencies:
- - supports-color
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@number-flow/react@0.6.2(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+ '@radix-ui/react-use-rect@1.1.4(@types/react@19.3.0)(react@19.3.0)':
dependencies:
- esm-env: 1.2.2
- number-flow: 0.6.2
+ '@radix-ui/rect': 1.1.3
react: 19.3.0
- react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@oxc-project/types@0.150.0': {}
+ '@radix-ui/react-use-size@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+ dependencies:
+ '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
- '@playwright/test@1.63.0':
+ '@radix-ui/react-visually-hidden@1.2.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
dependencies:
- playwright: 1.63.0
+ '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+ '@types/react-dom': 19.3.0(@types/react@19.3.0)
- '@pondwader/socks5-server@1.0.10': {}
+ '@radix-ui/rect@1.1.3': {}
'@rolldown/binding-android-arm-eabi@1.2.9':
optional: true
@@ -2283,6 +4354,87 @@ snapshots:
'@rolldown/pluginutils@1.0.1': {}
+ '@scalar/helpers@0.0.11': {}
+
+ '@scalar/helpers@0.0.12': {}
+
+ '@scalar/json-magic@0.6.0':
+ dependencies:
+ '@scalar/helpers': 0.0.11
+ yaml: 2.8.0
+
+ '@scalar/json-magic@0.6.1':
+ dependencies:
+ '@scalar/helpers': 0.0.12
+ yaml: 2.8.0
+
+ '@scalar/openapi-parser@0.22.1':
+ dependencies:
+ '@scalar/json-magic': 0.6.0
+ '@scalar/openapi-types': 0.4.0
+ '@scalar/openapi-upgrader': 0.1.1
+ ajv: 8.20.0
+ ajv-draft-04: 1.0.0(ajv@8.20.0)
+ ajv-formats: 3.0.1(ajv@8.20.0)
+ jsonpointer: 5.0.1
+ leven: 4.1.0
+ yaml: 2.8.0
+
+ '@scalar/openapi-types@0.4.0':
+ dependencies:
+ zod: 4.1.11
+
+ '@scalar/openapi-upgrader@0.1.1':
+ dependencies:
+ '@scalar/openapi-types': 0.4.0
+
+ '@shikijs/core@3.23.0':
+ dependencies:
+ '@shikijs/types': 3.23.0
+ '@shikijs/vscode-textmate': 10.0.2
+ '@types/hast': 3.0.5
+ hast-util-to-html: 9.0.5
+
+ '@shikijs/engine-javascript@3.23.0':
+ dependencies:
+ '@shikijs/types': 3.23.0
+ '@shikijs/vscode-textmate': 10.0.2
+ oniguruma-to-es: 4.3.6
+
+ '@shikijs/engine-oniguruma@3.23.0':
+ dependencies:
+ '@shikijs/types': 3.23.0
+ '@shikijs/vscode-textmate': 10.0.2
+
+ '@shikijs/langs@3.23.0':
+ dependencies:
+ '@shikijs/types': 3.23.0
+
+ '@shikijs/rehype@3.23.0':
+ dependencies:
+ '@shikijs/types': 3.23.0
+ '@types/hast': 3.0.5
+ hast-util-to-string: 3.0.1
+ shiki: 3.23.0
+ unified: 11.0.5
+ unist-util-visit: 5.1.0
+
+ '@shikijs/themes@3.23.0':
+ dependencies:
+ '@shikijs/types': 3.23.0
+
+ '@shikijs/transformers@3.23.0':
+ dependencies:
+ '@shikijs/core': 3.23.0
+ '@shikijs/types': 3.23.0
+
+ '@shikijs/types@3.23.0':
+ dependencies:
+ '@shikijs/vscode-textmate': 10.0.2
+ '@types/hast': 3.0.5
+
+ '@shikijs/vscode-textmate@10.0.2': {}
+
'@silvia-odwyer/photon-node@0.3.4': {}
'@sinclair/typebox@0.34.52': {}
@@ -2291,6 +4443,10 @@ snapshots:
'@standard-schema/spec@1.1.0': {}
+ '@swc/helpers@0.5.15':
+ dependencies:
+ tslib: 2.8.1
+
'@tailwindcss/node@4.3.3':
dependencies:
'@jridgewell/remapping': 2.3.5
@@ -2352,12 +4508,20 @@ snapshots:
'@tailwindcss/oxide-win32-arm64-msvc': 4.3.3
'@tailwindcss/oxide-win32-x64-msvc': 4.3.3
- '@tailwindcss/vite@4.3.3(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))':
+ '@tailwindcss/postcss@4.3.3':
+ dependencies:
+ '@alloc/quick-lru': 5.3.0
+ '@tailwindcss/node': 4.3.3
+ '@tailwindcss/oxide': 4.3.3
+ postcss: 8.5.28
+ tailwindcss: 4.3.3
+
+ '@tailwindcss/vite@4.3.3(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))':
dependencies:
'@tailwindcss/node': 4.3.3
'@tailwindcss/oxide': 4.3.3
tailwindcss: 4.3.3
- vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)
+ vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0)
'@tanstack/query-core@5.103.2': {}
@@ -2395,12 +4559,20 @@ snapshots:
dependencies:
'@types/unist': 3.0.3
+ '@types/json-schema@7.0.15': {}
+
'@types/mdast@4.0.4':
dependencies:
'@types/unist': 3.0.3
+ '@types/mdx@2.0.14': {}
+
'@types/ms@2.1.0': {}
+ '@types/node@22.20.4':
+ dependencies:
+ undici-types: 6.21.0
+
'@types/node@26.1.0':
dependencies:
undici-types: 8.3.0
@@ -2419,10 +4591,10 @@ snapshots:
'@ungap/structured-clone@1.4.0': {}
- '@vitejs/plugin-react@6.1.1(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))':
+ '@vitejs/plugin-react@6.1.1(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))':
dependencies:
'@rolldown/pluginutils': 1.0.1
- vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)
+ vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0)
'@vitest/expect@4.1.11':
dependencies:
@@ -2433,13 +4605,13 @@ snapshots:
chai: 6.2.2
tinyrainbow: 3.1.1
- '@vitest/mocker@4.1.11(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))':
+ '@vitest/mocker@4.1.11(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))':
dependencies:
'@vitest/spy': 4.1.11
estree-walker: 3.0.3
magic-string: 0.30.21
optionalDependencies:
- vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)
+ vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0)
'@vitest/pretty-format@4.1.11':
dependencies:
@@ -2470,6 +4642,16 @@ snapshots:
mime-types: 3.0.2
negotiator: 1.1.0
+ acorn-jsx@5.3.2(acorn@8.18.0):
+ dependencies:
+ acorn: 8.18.0
+
+ acorn@8.18.0: {}
+
+ ajv-draft-04@1.0.0(ajv@8.20.0):
+ optionalDependencies:
+ ajv: 8.20.0
+
ajv-formats@3.0.1(ajv@8.20.0):
optionalDependencies:
ajv: 8.20.0
@@ -2481,8 +4663,22 @@ snapshots:
json-schema-traverse: 1.0.0
require-from-string: 2.0.2
+ anynum@1.0.1: {}
+
+ argparse@1.0.10:
+ dependencies:
+ sprintf-js: 1.0.3
+
+ argparse@2.0.1: {}
+
+ aria-hidden@1.2.6:
+ dependencies:
+ tslib: 2.8.1
+
assertion-error@2.0.1: {}
+ astring@1.9.0: {}
+
bail@2.0.2: {}
balanced-match@4.0.4: {}
@@ -2517,6 +4713,8 @@ snapshots:
call-bind-apply-helpers: 1.0.2
get-intrinsic: 1.3.0
+ caniuse-lite@1.0.30001812: {}
+
ccount@2.0.1: {}
chai@6.2.2: {}
@@ -2531,14 +4729,24 @@ snapshots:
character-reference-invalid@2.0.1: {}
+ chokidar@4.0.3:
+ dependencies:
+ readdirp: 4.1.2
+
class-variance-authority@0.7.1:
dependencies:
clsx: 2.1.1
+ client-only@0.0.1: {}
+
clsx@2.1.1: {}
+ collapse-white-space@2.1.0: {}
+
comma-separated-tokens@2.0.3: {}
+ compute-scroll-into-view@3.1.1: {}
+
content-disposition@1.1.0: {}
content-type@1.0.5: {}
@@ -2562,6 +4770,8 @@ snapshots:
shebang-command: 2.0.0
which: 2.0.2
+ cssesc@3.0.0: {}
+
csstype@3.2.3: {}
debug@4.4.3:
@@ -2578,6 +4788,8 @@ snapshots:
detect-libc@2.1.2: {}
+ detect-node-es@1.1.0: {}
+
devlop@1.1.0:
dependencies:
dequal: 2.0.3
@@ -2609,6 +4821,49 @@ snapshots:
dependencies:
es-errors: 1.3.0
+ esast-util-from-estree@2.0.0:
+ dependencies:
+ '@types/estree-jsx': 1.0.5
+ devlop: 1.1.0
+ estree-util-visit: 2.0.0
+ unist-util-position-from-estree: 2.0.0
+
+ esast-util-from-js@2.0.1:
+ dependencies:
+ '@types/estree-jsx': 1.0.5
+ acorn: 8.18.0
+ esast-util-from-estree: 2.0.0
+ vfile-message: 4.0.3
+
+ esbuild@0.25.12:
+ optionalDependencies:
+ '@esbuild/aix-ppc64': 0.25.12
+ '@esbuild/android-arm': 0.25.12
+ '@esbuild/android-arm64': 0.25.12
+ '@esbuild/android-x64': 0.25.12
+ '@esbuild/darwin-arm64': 0.25.12
+ '@esbuild/darwin-x64': 0.25.12
+ '@esbuild/freebsd-arm64': 0.25.12
+ '@esbuild/freebsd-x64': 0.25.12
+ '@esbuild/linux-arm': 0.25.12
+ '@esbuild/linux-arm64': 0.25.12
+ '@esbuild/linux-ia32': 0.25.12
+ '@esbuild/linux-loong64': 0.25.12
+ '@esbuild/linux-mips64el': 0.25.12
+ '@esbuild/linux-ppc64': 0.25.12
+ '@esbuild/linux-riscv64': 0.25.12
+ '@esbuild/linux-s390x': 0.25.12
+ '@esbuild/linux-x64': 0.25.12
+ '@esbuild/netbsd-arm64': 0.25.12
+ '@esbuild/netbsd-x64': 0.25.12
+ '@esbuild/openbsd-arm64': 0.25.12
+ '@esbuild/openbsd-x64': 0.25.12
+ '@esbuild/openharmony-arm64': 0.25.12
+ '@esbuild/sunos-x64': 0.25.12
+ '@esbuild/win32-arm64': 0.25.12
+ '@esbuild/win32-ia32': 0.25.12
+ '@esbuild/win32-x64': 0.25.12
+
esbuild@0.28.2:
optionalDependencies:
'@esbuild/aix-ppc64': 0.28.2
@@ -2644,8 +4899,41 @@ snapshots:
esm-env@1.2.2: {}
+ esprima@4.0.1: {}
+
+ estree-util-attach-comments@3.0.0:
+ dependencies:
+ '@types/estree': 1.0.9
+
+ estree-util-build-jsx@3.0.1:
+ dependencies:
+ '@types/estree-jsx': 1.0.5
+ devlop: 1.1.0
+ estree-util-is-identifier-name: 3.0.0
+ estree-walker: 3.0.3
+
estree-util-is-identifier-name@3.0.0: {}
+ estree-util-scope@1.0.1:
+ dependencies:
+ '@types/estree': 1.0.9
+ devlop: 1.1.0
+
+ estree-util-to-js@2.0.0:
+ dependencies:
+ '@types/estree-jsx': 1.0.5
+ astring: 1.9.0
+ source-map: 0.7.6
+
+ estree-util-value-to-estree@3.5.0:
+ dependencies:
+ '@types/estree': 1.0.9
+
+ estree-util-visit@2.0.0:
+ dependencies:
+ '@types/estree-jsx': 1.0.5
+ '@types/unist': 3.0.3
+
estree-walker@3.0.3:
dependencies:
'@types/estree': 1.0.9
@@ -2701,6 +4989,10 @@ snapshots:
transitivePeerDependencies:
- supports-color
+ extend-shallow@2.0.1:
+ dependencies:
+ is-extendable: 0.1.1
+
extend@3.0.2: {}
fast-deep-equal@3.1.3: {}
@@ -2709,6 +5001,20 @@ snapshots:
fast-uri@3.1.7: {}
+ fast-xml-builder@1.3.1:
+ dependencies:
+ path-expression-matcher: 1.6.2
+ xml-naming: 0.3.0
+
+ fast-xml-parser@5.11.1:
+ dependencies:
+ '@nodable/entities': 3.0.0
+ fast-xml-builder: 1.3.1
+ is-unsafe: 2.0.2
+ path-expression-matcher: 1.6.2
+ strnum: 2.4.2
+ xml-naming: 0.3.0
+
fdir@6.5.0(picomatch@4.0.7):
optionalDependencies:
picomatch: 4.0.7
@@ -2724,6 +5030,8 @@ snapshots:
transitivePeerDependencies:
- supports-color
+ foreach@2.0.6: {}
+
forwarded@0.2.0: {}
framer-motion@13.4.3(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
@@ -2740,6 +5048,138 @@ snapshots:
fsevents@2.3.3:
optional: true
+ fumadocs-core@15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+ dependencies:
+ '@formatjs/intl-localematcher': 0.6.2
+ '@orama/orama': 3.1.18
+ '@shikijs/rehype': 3.23.0
+ '@shikijs/transformers': 3.23.0
+ github-slugger: 2.0.0
+ hast-util-to-estree: 3.1.3
+ hast-util-to-jsx-runtime: 2.3.6
+ image-size: 2.0.4
+ negotiator: 1.1.0
+ npm-to-yarn: 3.2.0
+ path-to-regexp: 8.4.2
+ react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+ remark: 15.0.1
+ remark-gfm: 4.0.1
+ remark-rehype: 11.1.2
+ scroll-into-view-if-needed: 3.1.0
+ shiki: 3.23.0
+ unist-util-visit: 5.1.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+ lucide-react: 1.47.0(react@19.3.0)
+ next: 15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ transitivePeerDependencies:
+ - supports-color
+
+ fumadocs-mdx@12.0.3(fumadocs-core@15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0):
+ dependencies:
+ '@mdx-js/mdx': 3.1.1
+ '@standard-schema/spec': 1.1.0
+ chokidar: 4.0.3
+ esbuild: 0.25.12
+ estree-util-value-to-estree: 3.5.0
+ fumadocs-core: 15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ js-yaml: 4.3.2
+ lru-cache: 11.5.3
+ mdast-util-to-markdown: 2.1.2
+ picocolors: 1.1.1
+ remark-mdx: 3.1.1
+ remark-parse: 11.0.0
+ tinyexec: 1.3.1
+ tinyglobby: 0.2.17
+ unified: 11.0.5
+ unist-util-visit: 5.1.0
+ zod: 4.4.3
+ optionalDependencies:
+ next: 15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ react: 19.3.0
+ transitivePeerDependencies:
+ - supports-color
+
+ fumadocs-openapi@9.5.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(tailwindcss@4.3.3):
+ dependencies:
+ '@fumari/json-schema-to-typescript': 1.1.3
+ '@radix-ui/react-accordion': 1.2.20(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-dialog': 1.1.23(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-select': 2.3.7(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ '@scalar/json-magic': 0.6.1
+ '@scalar/openapi-parser': 0.22.1
+ ajv: 8.20.0
+ class-variance-authority: 0.7.1
+ fumadocs-core: 15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ fumadocs-ui: 15.8.5(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(tailwindcss@4.3.3)
+ github-slugger: 2.0.0
+ gray-matter: 4.0.3
+ hast-util-to-jsx-runtime: 2.3.6
+ js-yaml: 4.3.2
+ next-themes: 0.4.6(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ openapi-sampler: 1.7.6
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ react-hook-form: 7.89.0(@types/react@19.3.0)(react@19.3.0)
+ remark: 15.0.1
+ remark-rehype: 11.1.2
+ tinyglobby: 0.2.17
+ xml-js: 1.6.11
+ optionalDependencies:
+ '@types/react': 19.3.0
+ transitivePeerDependencies:
+ - '@mixedbread/sdk'
+ - '@oramacloud/client'
+ - '@tanstack/react-router'
+ - '@types/react-dom'
+ - algoliasearch
+ - lucide-react
+ - next
+ - react-router
+ - supports-color
+ - tailwindcss
+ - waku
+
+ fumadocs-ui@15.8.5(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(tailwindcss@4.3.3):
+ dependencies:
+ '@radix-ui/react-accordion': 1.2.20(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-collapsible': 1.1.20(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-dialog': 1.1.23(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-direction': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-navigation-menu': 1.2.22(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-popover': 1.1.23(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-scroll-area': 1.2.18(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ '@radix-ui/react-slot': 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ '@radix-ui/react-tabs': 1.1.21(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ class-variance-authority: 0.7.1
+ fumadocs-core: 15.8.5(@types/react@19.3.0)(lucide-react@1.47.0(react@19.3.0))(next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ lodash.merge: 4.6.2
+ next-themes: 0.4.6(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ postcss-selector-parser: 7.1.6
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ react-medium-image-zoom: 5.4.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ scroll-into-view-if-needed: 3.1.0
+ tailwind-merge: 3.7.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+ next: 15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+ tailwindcss: 4.3.3
+ transitivePeerDependencies:
+ - '@mixedbread/sdk'
+ - '@oramacloud/client'
+ - '@tanstack/react-router'
+ - '@types/react-dom'
+ - algoliasearch
+ - lucide-react
+ - react-router
+ - supports-color
+ - waku
+
function-bind@1.1.2: {}
get-east-asian-width@1.6.0: {}
@@ -2757,21 +5197,67 @@ snapshots:
hasown: 2.0.4
math-intrinsics: 1.1.0
+ get-nonce@1.0.1: {}
+
get-proto@1.0.1:
dependencies:
dunder-proto: 1.0.1
es-object-atoms: 1.1.2
+ github-slugger@2.0.0: {}
+
gopd@1.2.0: {}
graceful-fs@4.2.11: {}
+ gray-matter@4.0.3:
+ dependencies:
+ js-yaml: 3.15.2
+ kind-of: 6.0.3
+ section-matter: 1.0.0
+ strip-bom-string: 1.0.0
+
has-symbols@1.1.0: {}
hasown@2.0.4:
dependencies:
function-bind: 1.1.2
+ hast-util-to-estree@3.1.3:
+ dependencies:
+ '@types/estree': 1.0.9
+ '@types/estree-jsx': 1.0.5
+ '@types/hast': 3.0.5
+ comma-separated-tokens: 2.0.3
+ devlop: 1.1.0
+ estree-util-attach-comments: 3.0.0
+ estree-util-is-identifier-name: 3.0.0
+ hast-util-whitespace: 3.0.0
+ mdast-util-mdx-expression: 2.0.1
+ mdast-util-mdx-jsx: 3.2.0
+ mdast-util-mdxjs-esm: 2.0.1
+ property-information: 7.2.0
+ space-separated-tokens: 2.0.2
+ style-to-js: 1.1.21
+ unist-util-position: 5.0.0
+ zwitch: 2.0.4
+ transitivePeerDependencies:
+ - supports-color
+
+ hast-util-to-html@9.0.5:
+ dependencies:
+ '@types/hast': 3.0.5
+ '@types/unist': 3.0.3
+ ccount: 2.0.1
+ comma-separated-tokens: 2.0.3
+ hast-util-whitespace: 3.0.0
+ html-void-elements: 3.0.0
+ mdast-util-to-hast: 13.2.1
+ property-information: 7.2.0
+ space-separated-tokens: 2.0.2
+ stringify-entities: 4.0.4
+ zwitch: 2.0.4
+
hast-util-to-jsx-runtime@2.3.6:
dependencies:
'@types/estree': 1.0.9
@@ -2792,6 +5278,10 @@ snapshots:
transitivePeerDependencies:
- supports-color
+ hast-util-to-string@3.0.1:
+ dependencies:
+ '@types/hast': 3.0.5
+
hast-util-whitespace@3.0.0:
dependencies:
'@types/hast': 3.0.5
@@ -2804,6 +5294,8 @@ snapshots:
html-url-attributes@3.0.1: {}
+ html-void-elements@3.0.0: {}
+
http-errors@2.0.1:
dependencies:
depd: 2.0.0
@@ -2820,6 +5312,8 @@ snapshots:
dependencies:
safer-buffer: 2.1.2
+ image-size@2.0.4: {}
+
inherits@2.0.4: {}
inline-style-parser@0.2.7: {}
@@ -2837,18 +5331,35 @@ snapshots:
is-decimal@2.0.1: {}
+ is-extendable@0.1.1: {}
+
is-hexadecimal@2.0.1: {}
is-plain-obj@4.1.0: {}
is-promise@4.0.0: {}
+ is-unsafe@2.0.2: {}
+
isexe@2.0.0: {}
jiti@2.7.0: {}
jose@6.2.12: {}
+ js-yaml@3.15.2:
+ dependencies:
+ argparse: 1.0.10
+ esprima: 4.0.1
+
+ js-yaml@4.3.2:
+ dependencies:
+ argparse: 2.0.1
+
+ json-pointer@0.6.2:
+ dependencies:
+ foreach: 2.0.6
+
json-schema-to-ts@3.1.1:
dependencies:
'@babel/runtime': 7.29.7
@@ -2858,6 +5369,12 @@ snapshots:
json-schema-typed@8.0.2: {}
+ jsonpointer@5.0.1: {}
+
+ kind-of@6.0.3: {}
+
+ leven@4.1.0: {}
+
lightningcss-android-arm64@1.32.0:
optional: true
@@ -2956,8 +5473,12 @@ snapshots:
lightningcss-win32-arm64-msvc: 1.33.0
lightningcss-win32-x64-msvc: 1.33.0
+ lodash.merge@4.6.2: {}
+
longest-streak@3.1.0: {}
+ lru-cache@11.5.3: {}
+
lucide-react@1.47.0(react@19.3.0):
dependencies:
react: 19.3.0
@@ -2966,6 +5487,8 @@ snapshots:
dependencies:
'@jridgewell/sourcemap-codec': 1.6.0
+ markdown-extensions@2.0.0: {}
+
markdown-table@3.0.4: {}
marked@18.0.12: {}
@@ -3081,6 +5604,16 @@ snapshots:
transitivePeerDependencies:
- supports-color
+ mdast-util-mdx@3.0.0:
+ dependencies:
+ mdast-util-from-markdown: 2.0.3
+ mdast-util-mdx-expression: 2.0.1
+ mdast-util-mdx-jsx: 3.2.0
+ mdast-util-mdxjs-esm: 2.0.1
+ mdast-util-to-markdown: 2.1.2
+ transitivePeerDependencies:
+ - supports-color
+
mdast-util-mdxjs-esm@2.0.1:
dependencies:
'@types/estree-jsx': 1.0.5
@@ -3206,6 +5739,57 @@ snapshots:
micromark-util-combine-extensions: 2.0.1
micromark-util-types: 2.0.2
+ micromark-extension-mdx-expression@3.0.1:
+ dependencies:
+ '@types/estree': 1.0.9
+ devlop: 1.1.0
+ micromark-factory-mdx-expression: 2.0.3
+ micromark-factory-space: 2.0.1
+ micromark-util-character: 2.1.1
+ micromark-util-events-to-acorn: 2.0.3
+ micromark-util-symbol: 2.0.1
+ micromark-util-types: 2.0.2
+
+ micromark-extension-mdx-jsx@3.0.2:
+ dependencies:
+ '@types/estree': 1.0.9
+ devlop: 1.1.0
+ estree-util-is-identifier-name: 3.0.0
+ micromark-factory-mdx-expression: 2.0.3
+ micromark-factory-space: 2.0.1
+ micromark-util-character: 2.1.1
+ micromark-util-events-to-acorn: 2.0.3
+ micromark-util-symbol: 2.0.1
+ micromark-util-types: 2.0.2
+ vfile-message: 4.0.3
+
+ micromark-extension-mdx-md@2.0.0:
+ dependencies:
+ micromark-util-types: 2.0.2
+
+ micromark-extension-mdxjs-esm@3.0.0:
+ dependencies:
+ '@types/estree': 1.0.9
+ devlop: 1.1.0
+ micromark-core-commonmark: 2.0.3
+ micromark-util-character: 2.1.1
+ micromark-util-events-to-acorn: 2.0.3
+ micromark-util-symbol: 2.0.1
+ micromark-util-types: 2.0.2
+ unist-util-position-from-estree: 2.0.0
+ vfile-message: 4.0.3
+
+ micromark-extension-mdxjs@3.0.0:
+ dependencies:
+ acorn: 8.18.0
+ acorn-jsx: 5.3.2(acorn@8.18.0)
+ micromark-extension-mdx-expression: 3.0.1
+ micromark-extension-mdx-jsx: 3.0.2
+ micromark-extension-mdx-md: 2.0.0
+ micromark-extension-mdxjs-esm: 3.0.0
+ micromark-util-combine-extensions: 2.0.1
+ micromark-util-types: 2.0.2
+
micromark-factory-destination@2.0.1:
dependencies:
micromark-util-character: 2.1.1
@@ -3219,6 +5803,18 @@ snapshots:
micromark-util-symbol: 2.0.1
micromark-util-types: 2.0.2
+ micromark-factory-mdx-expression@2.0.3:
+ dependencies:
+ '@types/estree': 1.0.9
+ devlop: 1.1.0
+ micromark-factory-space: 2.0.1
+ micromark-util-character: 2.1.1
+ micromark-util-events-to-acorn: 2.0.3
+ micromark-util-symbol: 2.0.1
+ micromark-util-types: 2.0.2
+ unist-util-position-from-estree: 2.0.0
+ vfile-message: 4.0.3
+
micromark-factory-space@2.0.1:
dependencies:
micromark-util-character: 2.1.1
@@ -3271,6 +5867,16 @@ snapshots:
micromark-util-encode@2.0.1: {}
+ micromark-util-events-to-acorn@2.0.3:
+ dependencies:
+ '@types/estree': 1.0.9
+ '@types/unist': 3.0.3
+ devlop: 1.1.0
+ estree-util-visit: 2.0.0
+ micromark-util-symbol: 2.0.1
+ micromark-util-types: 2.0.2
+ vfile-message: 4.0.3
+
micromark-util-html-tag-name@2.0.1: {}
micromark-util-normalize-identifier@2.0.1:
@@ -3352,8 +5958,40 @@ snapshots:
dependencies:
content-type: 2.1.0
+ next-themes@0.4.6(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+ dependencies:
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+
+ next@15.5.26(@playwright/test@1.63.0)(@types/node@22.20.4)(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+ dependencies:
+ '@next/env': 15.5.26
+ '@swc/helpers': 0.5.15
+ caniuse-lite: 1.0.30001812
+ postcss: 8.4.31
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+ styled-jsx: 5.1.6(react@19.3.0)
+ optionalDependencies:
+ '@next/swc-darwin-arm64': 15.5.26
+ '@next/swc-darwin-x64': 15.5.26
+ '@next/swc-linux-arm64-gnu': 15.5.26
+ '@next/swc-linux-arm64-musl': 15.5.26
+ '@next/swc-linux-x64-gnu': 15.5.26
+ '@next/swc-linux-x64-musl': 15.5.26
+ '@next/swc-win32-arm64-msvc': 15.5.26
+ '@next/swc-win32-x64-msvc': 15.5.26
+ '@playwright/test': 1.63.0
+ sharp: 0.35.5(@types/node@22.20.4)
+ transitivePeerDependencies:
+ - '@babel/core'
+ - '@types/node'
+ - babel-plugin-macros
+
node-forge@1.4.0: {}
+ npm-to-yarn@3.2.0: {}
+
number-flow@0.6.2:
dependencies:
esm-env: 1.2.2
@@ -3372,6 +6010,20 @@ snapshots:
dependencies:
wrappy: 1.0.2
+ oniguruma-parser@0.12.2: {}
+
+ oniguruma-to-es@4.3.6:
+ dependencies:
+ oniguruma-parser: 0.12.2
+ regex: 6.1.0
+ regex-recursion: 6.0.2
+
+ openapi-sampler@1.7.6:
+ dependencies:
+ '@types/json-schema': 7.0.15
+ fast-xml-parser: 5.11.1
+ json-pointer: 0.6.2
+
parse-entities@4.0.2:
dependencies:
'@types/unist': 2.0.11
@@ -3384,6 +6036,8 @@ snapshots:
parseurl@1.3.3: {}
+ path-expression-matcher@1.6.2: {}
+
path-key@3.1.1: {}
path-to-regexp@8.4.2: {}
@@ -3402,12 +6056,25 @@ snapshots:
dependencies:
playwright-core: 1.63.0
+ postcss-selector-parser@7.1.6:
+ dependencies:
+ cssesc: 3.0.0
+ util-deprecate: 1.0.2
+
+ postcss@8.4.31:
+ dependencies:
+ nanoid: 3.3.19
+ picocolors: 1.1.1
+ source-map-js: 1.2.1
+
postcss@8.5.28:
dependencies:
nanoid: 3.3.19
picocolors: 1.1.1
source-map-js: 1.2.1
+ prettier@3.9.9: {}
+
property-information@7.2.0: {}
proxy-addr@2.0.7:
@@ -3434,6 +6101,12 @@ snapshots:
react: 19.3.0
scheduler: 0.28.0
+ react-hook-form@7.89.0(@types/react@19.3.0)(react@19.3.0):
+ dependencies:
+ react: 19.3.0
+ optionalDependencies:
+ '@types/react': 19.3.0
+
react-i18next@17.0.15(i18next@26.4.2(typescript@5.9.3))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(typescript@5.9.3):
dependencies:
'@babel/runtime': 7.29.7
@@ -3463,8 +6136,89 @@ snapshots:
transitivePeerDependencies:
- supports-color
+ react-medium-image-zoom@5.4.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+ dependencies:
+ react: 19.3.0
+ react-dom: 19.3.0(react@19.3.0)
+
+ react-remove-scroll-bar@2.3.8(@types/react@19.3.0)(react@19.3.0):
+ dependencies:
+ react: 19.3.0
+ react-style-singleton: 2.2.3(@types/react@19.3.0)(react@19.3.0)
+ tslib: 2.8.1
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ react-remove-scroll@2.7.2(@types/react@19.3.0)(react@19.3.0):
+ dependencies:
+ react: 19.3.0
+ react-remove-scroll-bar: 2.3.8(@types/react@19.3.0)(react@19.3.0)
+ react-style-singleton: 2.2.3(@types/react@19.3.0)(react@19.3.0)
+ tslib: 2.8.1
+ use-callback-ref: 1.3.3(@types/react@19.3.0)(react@19.3.0)
+ use-sidecar: 1.1.3(@types/react@19.3.0)(react@19.3.0)
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ react-style-singleton@2.2.3(@types/react@19.3.0)(react@19.3.0):
+ dependencies:
+ get-nonce: 1.0.1
+ react: 19.3.0
+ tslib: 2.8.1
+ optionalDependencies:
+ '@types/react': 19.3.0
+
react@19.3.0: {}
+ readdirp@4.1.2: {}
+
+ recma-build-jsx@1.0.0:
+ dependencies:
+ '@types/estree': 1.0.9
+ estree-util-build-jsx: 3.0.1
+ vfile: 6.0.3
+
+ recma-jsx@1.0.1(acorn@8.18.0):
+ dependencies:
+ acorn: 8.18.0
+ acorn-jsx: 5.3.2(acorn@8.18.0)
+ estree-util-to-js: 2.0.0
+ recma-parse: 1.0.0
+ recma-stringify: 1.0.0
+ unified: 11.0.5
+
+ recma-parse@1.0.0:
+ dependencies:
+ '@types/estree': 1.0.9
+ esast-util-from-js: 2.0.1
+ unified: 11.0.5
+ vfile: 6.0.3
+
+ recma-stringify@1.0.0:
+ dependencies:
+ '@types/estree': 1.0.9
+ estree-util-to-js: 2.0.0
+ unified: 11.0.5
+ vfile: 6.0.3
+
+ regex-recursion@6.0.2:
+ dependencies:
+ regex-utilities: 2.3.0
+
+ regex-utilities@2.3.0: {}
+
+ regex@6.1.0:
+ dependencies:
+ regex-utilities: 2.3.0
+
+ rehype-recma@1.0.0:
+ dependencies:
+ '@types/estree': 1.0.9
+ '@types/hast': 3.0.5
+ hast-util-to-estree: 3.1.3
+ transitivePeerDependencies:
+ - supports-color
+
remark-gfm@4.0.1:
dependencies:
'@types/mdast': 4.0.4
@@ -3476,6 +6230,13 @@ snapshots:
transitivePeerDependencies:
- supports-color
+ remark-mdx@3.1.1:
+ dependencies:
+ mdast-util-mdx: 3.0.0
+ micromark-extension-mdxjs: 3.0.0
+ transitivePeerDependencies:
+ - supports-color
+
remark-parse@11.0.0:
dependencies:
'@types/mdast': 4.0.4
@@ -3499,6 +6260,15 @@ snapshots:
mdast-util-to-markdown: 2.1.2
unified: 11.0.5
+ remark@15.0.1:
+ dependencies:
+ '@types/mdast': 4.0.4
+ remark-parse: 11.0.0
+ remark-stringify: 11.0.0
+ unified: 11.0.5
+ transitivePeerDependencies:
+ - supports-color
+
require-from-string@2.0.2: {}
reselect@5.3.0: {}
@@ -3536,8 +6306,22 @@ snapshots:
safer-buffer@2.1.2: {}
+ sax@1.6.1: {}
+
scheduler@0.28.0: {}
+ scroll-into-view-if-needed@3.1.0:
+ dependencies:
+ compute-scroll-into-view: 3.1.1
+
+ section-matter@1.0.0:
+ dependencies:
+ extend-shallow: 2.0.1
+ kind-of: 6.0.3
+
+ semver@7.8.5:
+ optional: true
+
send@1.2.1:
dependencies:
debug: 4.4.3
@@ -3567,12 +6351,57 @@ snapshots:
shadow-plugin@2.1.1: {}
+ sharp@0.35.5(@types/node@22.20.4):
+ dependencies:
+ '@img/colour': 1.1.0
+ detect-libc: 2.1.2
+ semver: 7.8.5
+ optionalDependencies:
+ '@img/sharp-darwin-arm64': 0.35.5
+ '@img/sharp-darwin-x64': 0.35.5
+ '@img/sharp-freebsd-wasm32': 0.35.5
+ '@img/sharp-libvips-darwin-arm64': 1.3.4
+ '@img/sharp-libvips-darwin-x64': 1.3.4
+ '@img/sharp-libvips-linux-arm': 1.3.4
+ '@img/sharp-libvips-linux-arm64': 1.3.4
+ '@img/sharp-libvips-linux-ppc64': 1.3.4
+ '@img/sharp-libvips-linux-riscv64': 1.3.4
+ '@img/sharp-libvips-linux-s390x': 1.3.4
+ '@img/sharp-libvips-linux-x64': 1.3.4
+ '@img/sharp-libvips-linuxmusl-arm64': 1.3.4
+ '@img/sharp-libvips-linuxmusl-x64': 1.3.4
+ '@img/sharp-linux-arm': 0.35.5
+ '@img/sharp-linux-arm64': 0.35.5
+ '@img/sharp-linux-ppc64': 0.35.5
+ '@img/sharp-linux-riscv64': 0.35.5
+ '@img/sharp-linux-s390x': 0.35.5
+ '@img/sharp-linux-x64': 0.35.5
+ '@img/sharp-linuxmusl-arm64': 0.35.5
+ '@img/sharp-linuxmusl-x64': 0.35.5
+ '@img/sharp-webcontainers-wasm32': 0.35.5
+ '@img/sharp-win32-arm64': 0.35.5
+ '@img/sharp-win32-ia32': 0.35.5
+ '@img/sharp-win32-x64': 0.35.5
+ '@types/node': 22.20.4
+ optional: true
+
shebang-command@2.0.0:
dependencies:
shebang-regex: 3.0.0
shebang-regex@3.0.0: {}
+ shiki@3.23.0:
+ dependencies:
+ '@shikijs/core': 3.23.0
+ '@shikijs/engine-javascript': 3.23.0
+ '@shikijs/engine-oniguruma': 3.23.0
+ '@shikijs/langs': 3.23.0
+ '@shikijs/themes': 3.23.0
+ '@shikijs/types': 3.23.0
+ '@shikijs/vscode-textmate': 10.0.2
+ '@types/hast': 3.0.5
+
side-channel-list@1.0.1:
dependencies:
es-errors: 1.3.0
@@ -3605,8 +6434,12 @@ snapshots:
source-map-js@1.2.1: {}
+ source-map@0.7.6: {}
+
space-separated-tokens@2.0.2: {}
+ sprintf-js@1.0.3: {}
+
stackback@0.0.2: {}
standardwebhooks@1.1.1:
@@ -3623,6 +6456,12 @@ snapshots:
character-entities-html4: 2.1.0
character-entities-legacy: 3.0.0
+ strip-bom-string@1.0.0: {}
+
+ strnum@2.4.2:
+ dependencies:
+ anynum: 1.0.1
+
style-to-js@1.1.21:
dependencies:
style-to-object: 1.0.14
@@ -3631,6 +6470,11 @@ snapshots:
dependencies:
inline-style-parser: 0.2.7
+ styled-jsx@5.1.6(react@19.3.0):
+ dependencies:
+ client-only: 0.0.1
+ react: 19.3.0
+
tailwind-merge@3.7.0: {}
tailwindcss@4.3.3: {}
@@ -3668,6 +6512,8 @@ snapshots:
typescript@5.9.3: {}
+ undici-types@6.21.0: {}
+
undici-types@8.3.0: {}
unified@11.0.5:
@@ -3684,6 +6530,10 @@ snapshots:
dependencies:
'@types/unist': 3.0.3
+ unist-util-position-from-estree@2.0.0:
+ dependencies:
+ '@types/unist': 3.0.3
+
unist-util-position@5.0.0:
dependencies:
'@types/unist': 3.0.3
@@ -3707,10 +6557,27 @@ snapshots:
unpipe@1.0.0: {}
+ use-callback-ref@1.3.3(@types/react@19.3.0)(react@19.3.0):
+ dependencies:
+ react: 19.3.0
+ tslib: 2.8.1
+ optionalDependencies:
+ '@types/react': 19.3.0
+
+ use-sidecar@1.1.3(@types/react@19.3.0)(react@19.3.0):
+ dependencies:
+ detect-node-es: 1.1.0
+ react: 19.3.0
+ tslib: 2.8.1
+ optionalDependencies:
+ '@types/react': 19.3.0
+
use-sync-external-store@1.7.0(react@19.3.0):
dependencies:
react: 19.3.0
+ util-deprecate@1.0.2: {}
+
vary@1.1.2: {}
vfile-message@4.0.3:
@@ -3723,7 +6590,7 @@ snapshots:
'@types/unist': 3.0.3
vfile-message: 4.0.3
- vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0):
+ vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0):
dependencies:
lightningcss: 1.33.0
picomatch: 4.0.7
@@ -3735,11 +6602,12 @@ snapshots:
esbuild: 0.28.2
fsevents: 2.3.3
jiti: 2.7.0
+ yaml: 2.8.0
- vitest@4.1.11(@types/node@26.1.0)(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)):
+ vitest@4.1.11(@types/node@26.1.0)(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0)):
dependencies:
'@vitest/expect': 4.1.11
- '@vitest/mocker': 4.1.11(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0))
+ '@vitest/mocker': 4.1.11(vite@8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0))
'@vitest/pretty-format': 4.1.11
'@vitest/runner': 4.1.11
'@vitest/snapshot': 4.1.11
@@ -3756,7 +6624,7 @@ snapshots:
tinyexec: 1.3.1
tinyglobby: 0.2.17
tinyrainbow: 3.1.1
- vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)
+ vite: 8.3.0(@types/node@26.1.0)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.8.0)
why-is-node-running: 2.3.0
optionalDependencies:
'@types/node': 26.1.0
@@ -3774,6 +6642,14 @@ snapshots:
wrappy@1.0.2: {}
+ xml-js@1.6.11:
+ dependencies:
+ sax: 1.6.1
+
+ xml-naming@0.3.0: {}
+
+ yaml@2.8.0: {}
+
zod-to-json-schema@3.25.2(zod@3.25.76):
dependencies:
zod: 3.25.76
@@ -3784,6 +6660,8 @@ snapshots:
zod@3.25.76: {}
+ zod@4.1.11: {}
+
zod@4.4.3: {}
zwitch@2.0.4: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f1bf6461b..32659b903 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,4 @@
packages:
- "apps/web"
+ - "apps/docs"
- "packages/*"
diff --git a/scripts/name-allowlist.json b/scripts/name-allowlist.json
index 0b07e68a4..a8c53ae8f 100644
--- a/scripts/name-allowlist.json
+++ b/scripts/name-allowlist.json
@@ -778,5 +778,50 @@
"path": "apps/web/src/style.css",
"regex": "Parsar apply_patch",
"reason": "This comment identifies the recognized product-origin patch extension, matching the intentionally retained parser symbol."
+ },
+ {
+ "path": "apps/docs/content/docs/concepts.mdx",
+ "regex": "Parsar is an ordinary API-key holder",
+ "reason": "Generated copy of docs/design-principles.md: These exact phrases refer to the separate Parsar product, its ownership or historical source, not the OpenAgentCore brand."
+ },
+ {
+ "path": "apps/docs/content/docs/execution-model.mdx",
+ "regex": "including Parsar",
+ "reason": "Generated copy of docs/web/architecture.md: These exact phrases refer to the separate Parsar product, its ownership or historical source, not the OpenAgentCore brand."
+ },
+ {
+ "path": "apps/docs/content/docs/install.mdx",
+ "regex": "~?/\\.parsar/core",
+ "reason": "Generated copy of docs/getting-started/install.md: The installer refuses the old default installation and directs the operator to conversion."
+ },
+ {
+ "path": "apps/docs/content/docs/configure.mdx",
+ "regex": "(?:AGENTS_API_|CORE_CONSOLE_|PARSAR_)[A-Z0-9_]*\\*?|X-Parsar-Node-ID",
+ "reason": "Generated copy of docs/configuration.md: These names appear in retirement documentation or instructions for an explicitly pinned historical release; current configuration uses OAC settings."
+ },
+ {
+ "path": "apps/docs/content/docs/hosted-providers.mdx",
+ "regex": "parsar-node(?:-[A-Za-z0-9<>_.-]*)?|\\.parsar/nodes",
+ "reason": "Generated copy of docs/getting-started/nodes.md: The legacy-node section gives scoped uninstall instructions; new installation and enrollment examples use oac-node."
+ },
+ {
+ "path": "apps/docs/content/docs/self-hosted-execution.mdx",
+ "regex": "parsar-selfhost-\\*|\\.parsar/self-hosted",
+ "reason": "Generated copy of docs/getting-started/self-hosted.md: The legacy self-hosted section explains retained old resources and explicit refusal, not conversion or new defaults."
+ },
+ {
+ "path": "apps/docs/content/docs/troubleshooting.mdx",
+ "regex": "(?:AGENTS_API_|CORE_CONSOLE_|PARSAR_)[A-Z0-9_]*\\*?|parsar(?:[A-Za-z0-9_.*/-]*)|agents-api(?:-[a-z0-9*-]+)?|core-console|agents-runtime-",
+ "reason": "Generated copy of docs/getting-started/operations.md: The conversion and retirement table must name the exact old commands, paths, labels, settings and retained backups that operators migrate."
+ },
+ {
+ "path": "apps/docs/content/docs/troubleshooting.mdx",
+ "regex": "Parsar-product hooks",
+ "reason": "Generated copy of docs/getting-started/operations.md: These exact phrases refer to the separate Parsar product, its ownership or historical source, not the OpenAgentCore brand."
+ },
+ {
+ "path": "apps/docs/lib/legacy-redirects.ts",
+ "regex": "\"agents-api(?:-sessions|-errors)?\"",
+ "reason": "Retired documentation URL keys redirect to the current public API guide; these are not current commands or API namespaces."
}
]
diff --git a/services/agents-api/internal/api/admin_agents_routes.go b/services/agents-api/internal/api/admin_agents_routes.go
index 14b787eab..de13a90f2 100644
--- a/services/agents-api/internal/api/admin_agents_routes.go
+++ b/services/agents-api/internal/api/admin_agents_routes.go
@@ -11,7 +11,7 @@ import "net/http"
// @Param limit query int64 false "Page size; 0 is treated as 1 and values above 100 as 100" minimum(0) default(20)
// @Param order query string false "Creation order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Success 200 {object} v1.SavedAgentList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/agents [get]
func (h *Handler) adminListAgents(w http.ResponseWriter, r *http.Request) {
@@ -25,7 +25,7 @@ func (h *Handler) adminListAgents(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param agent_id path string true "Agent ID"
// @Success 200 {object} v1.SavedAgent
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/agents/{agent_id} [get]
func (h *Handler) adminGetAgent(w http.ResponseWriter, r *http.Request) {
@@ -39,7 +39,7 @@ func (h *Handler) adminGetAgent(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param agent_id path string true "Agent ID"
// @Success 200 {object} v1.AgentDeleted
-// @Failure 400,401,404,413,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,413,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/agents/{agent_id} [delete]
func (h *Handler) adminDeleteAgent(w http.ResponseWriter, r *http.Request) {
diff --git a/services/agents-api/internal/api/admin_environment_templates_routes.go b/services/agents-api/internal/api/admin_environment_templates_routes.go
index 9b0dea39a..29f3aba8c 100644
--- a/services/agents-api/internal/api/admin_environment_templates_routes.go
+++ b/services/agents-api/internal/api/admin_environment_templates_routes.go
@@ -11,7 +11,7 @@ import "net/http"
// @Param limit query integer false "Page size; 0 is treated as 1 and values above 100 as 100" default(20) minimum(0)
// @Param order query string false "Creation order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Success 200 {object} v1.EnvironmentTemplateList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/environment-templates [get]
func (h *Handler) adminListEnvironmentTemplates(w http.ResponseWriter, r *http.Request) {
@@ -25,7 +25,7 @@ func (h *Handler) adminListEnvironmentTemplates(w http.ResponseWriter, r *http.R
// @Security DeploymentAdminAuth
// @Param environment_template_id path string true "Template ID"
// @Success 200 {object} v1.EnvironmentTemplate
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/environment-templates/{environment_template_id} [get]
func (h *Handler) adminGetEnvironmentTemplate(w http.ResponseWriter, r *http.Request) {
@@ -39,7 +39,7 @@ func (h *Handler) adminGetEnvironmentTemplate(w http.ResponseWriter, r *http.Req
// @Security DeploymentAdminAuth
// @Param environment_template_id path string true "Template ID"
// @Success 200 {object} v1.EnvironmentTemplateDeleted
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/environment-templates/{environment_template_id} [delete]
func (h *Handler) adminDeleteEnvironmentTemplate(w http.ResponseWriter, r *http.Request) {
diff --git a/services/agents-api/internal/api/admin_files_routes.go b/services/agents-api/internal/api/admin_files_routes.go
index b37410233..12baf49ce 100644
--- a/services/agents-api/internal/api/admin_files_routes.go
+++ b/services/agents-api/internal/api/admin_files_routes.go
@@ -12,7 +12,7 @@ import "net/http"
// @Param order query string false "Creation order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Param purpose query string false "Only return Files with this purpose"
// @Success 200 {object} v1.SourceFileList
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/files [get]
func (h *Handler) adminListSourceFiles(w http.ResponseWriter, r *http.Request) {
@@ -26,7 +26,7 @@ func (h *Handler) adminListSourceFiles(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param file_id path string true "Source file ID"
// @Success 200 {object} v1.SourceFile
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/files/{file_id} [get]
func (h *Handler) adminGetSourceFile(w http.ResponseWriter, r *http.Request) {
@@ -40,7 +40,7 @@ func (h *Handler) adminGetSourceFile(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param file_id path string true "Source file ID"
// @Success 200 {object} v1.SourceFileDeleted
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/files/{file_id} [delete]
func (h *Handler) adminDeleteSourceFile(w http.ResponseWriter, r *http.Request) {
diff --git a/services/agents-api/internal/api/admin_history.go b/services/agents-api/internal/api/admin_history.go
index ca3d26551..30fd05457 100644
--- a/services/agents-api/internal/api/admin_history.go
+++ b/services/agents-api/internal/api/admin_history.go
@@ -22,7 +22,7 @@ import (
// @Param limit query int false "Page size" minimum(1) maximum(100) default(50)
// @Param after query string false "Opaque next_cursor from the preceding page"
// @Success 200 {object} store.AdminAuditPage
-// @Failure 400,401,500 {object} v1.ErrorResponse
+// @Failure 400,401,500 {object} CoreErrorResponse
// @Router /core/v1/audit-log [get]
func (h *Handler) listAdminAudit(w http.ResponseWriter, r *http.Request) {
values, err := url.ParseQuery(r.URL.RawQuery)
diff --git a/services/agents-api/internal/api/admin_runtime.go b/services/agents-api/internal/api/admin_runtime.go
index 82bb03bd9..e5c1868af 100644
--- a/services/agents-api/internal/api/admin_runtime.go
+++ b/services/agents-api/internal/api/admin_runtime.go
@@ -44,7 +44,7 @@ type AdminRuntimeObservationList struct {
// @Param limit query int false "Page size" minimum(1) maximum(100) default(20)
// @Param order query string false "Session creation order" Enums(asc,desc) default(desc)
// @Success 200 {object} api.AdminRuntimeObservationList
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/runtime-observations [get]
func (h *Handler) adminRuntimeObservations(w http.ResponseWriter, r *http.Request) {
if h.runtimeObservations == nil {
diff --git a/services/agents-api/internal/api/admin_session_archive.go b/services/agents-api/internal/api/admin_session_archive.go
index 1b44122b7..b9ccdaa38 100644
--- a/services/agents-api/internal/api/admin_session_archive.go
+++ b/services/agents-api/internal/api/admin_session_archive.go
@@ -27,7 +27,7 @@ type AdminSessionArchiveRequest struct {
// @Param session_id path string true "Session ID"
// @Param body body api.AdminSessionArchiveRequest true "Current deployment generation"
// @Success 200 {object} store.ManagedSessionArchive
-// @Failure 400,401,404,409,413,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,413,500,503 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/archive [post]
func (h *Handler) adminArchiveSession(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBodyLimit(w, r, 4096, "Archive request is too large.")
@@ -59,7 +59,7 @@ func (h *Handler) adminArchiveSession(w http.ResponseWriter, r *http.Request) {
// @Param project_id path string true "Project ID"
// @Param session_id path string true "Session ID"
// @Success 200 {object} store.ManagedSessionArchive
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/archive [get]
func (h *Handler) adminGetSessionArchive(w http.ResponseWriter, r *http.Request) {
result, err := h.adminManagement.GetManagedSessionArchive(r.Context(), tenantID(r), chi.URLParam(r, "session_id"))
diff --git a/services/agents-api/internal/api/admin_sessions_routes.go b/services/agents-api/internal/api/admin_sessions_routes.go
index 5ad0e5924..7775b4e27 100644
--- a/services/agents-api/internal/api/admin_sessions_routes.go
+++ b/services/agents-api/internal/api/admin_sessions_routes.go
@@ -12,7 +12,7 @@ import "net/http"
// @Param limit query int false "Page size; 0 is treated as 1 and values above 100 as 100" minimum(0) default(20)
// @Param order query string false "Creation order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Success 200 {object} v1.SessionList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions [get]
func (h *Handler) adminListSessions(w http.ResponseWriter, r *http.Request) {
@@ -26,7 +26,7 @@ func (h *Handler) adminListSessions(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param session_id path string true "Session ID"
// @Success 200 {object} v1.Session
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id} [get]
func (h *Handler) adminGetSession(w http.ResponseWriter, r *http.Request) {
@@ -40,7 +40,7 @@ func (h *Handler) adminGetSession(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param session_id path string true "Session ID"
// @Success 200 {object} v1.SessionDeleted
-// @Failure 400,401,404,409,413,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,413,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id} [delete]
func (h *Handler) adminDeleteSession(w http.ResponseWriter, r *http.Request) {
@@ -57,7 +57,7 @@ func (h *Handler) adminDeleteSession(w http.ResponseWriter, r *http.Request) {
// @Param limit query int false "Page size" minimum(1) maximum(100) default(20)
// @Param order query string false "Creation order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Success 200 {object} v1.TurnList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/turns [get]
func (h *Handler) adminListTurns(w http.ResponseWriter, r *http.Request) {
@@ -72,7 +72,7 @@ func (h *Handler) adminListTurns(w http.ResponseWriter, r *http.Request) {
// @Param session_id path string true "Session ID"
// @Param turn_id path string true "Turn ID"
// @Success 200 {object} v1.Turn
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/turns/{turn_id} [get]
func (h *Handler) adminGetTurn(w http.ResponseWriter, r *http.Request) {
@@ -89,7 +89,7 @@ func (h *Handler) adminGetTurn(w http.ResponseWriter, r *http.Request) {
// @Param limit query int false "Page size; 0 is treated as 1 and values above 100 as 100" minimum(0) default(20)
// @Param order query string false "Creation order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Success 200 {object} v1.ItemList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/items [get]
func (h *Handler) adminListItems(w http.ResponseWriter, r *http.Request) {
@@ -107,7 +107,7 @@ func (h *Handler) adminListItems(w http.ResponseWriter, r *http.Request) {
// @Param limit query int false "Page size" minimum(1) maximum(100) default(20)
// @Param order query string false "Publication order; omit for descending, explicit empty values are invalid" Enums(asc,desc) default(desc)
// @Success 200 {object} v1.SessionArtifactList
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/artifacts [get]
func (h *Handler) adminListSessionArtifacts(w http.ResponseWriter, r *http.Request) {
@@ -122,7 +122,7 @@ func (h *Handler) adminListSessionArtifacts(w http.ResponseWriter, r *http.Reque
// @Param session_id path string true "Session ID"
// @Param artifact_id path string true "Artifact ID"
// @Success 200 {object} v1.SessionArtifact
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/artifacts/{artifact_id} [get]
func (h *Handler) adminGetSessionArtifact(w http.ResponseWriter, r *http.Request) {
@@ -137,7 +137,7 @@ func (h *Handler) adminGetSessionArtifact(w http.ResponseWriter, r *http.Request
// @Param session_id path string true "Session ID"
// @Param artifact_id path string true "Artifact ID"
// @Success 200 {object} v1.SessionArtifactDeleted
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/artifacts/{artifact_id} [delete]
func (h *Handler) adminDeleteSessionArtifact(w http.ResponseWriter, r *http.Request) {
@@ -152,7 +152,7 @@ func (h *Handler) adminDeleteSessionArtifact(w http.ResponseWriter, r *http.Requ
// @Param session_id path string true "Session ID"
// @Param artifact_id path string true "Artifact ID"
// @Success 200 {file} binary
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/artifacts/{artifact_id}/content [get]
func (h *Handler) adminSessionArtifactContent(w http.ResponseWriter, r *http.Request) {
@@ -166,7 +166,7 @@ func (h *Handler) adminSessionArtifactContent(w http.ResponseWriter, r *http.Req
// @Security DeploymentAdminAuth
// @Param session_id path string true "Session ID"
// @Success 200 {object} v1.SessionExecutionConfiguration
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/execution-configuration [get]
func (h *Handler) adminGetSessionExecutionConfiguration(w http.ResponseWriter, r *http.Request) {
@@ -180,7 +180,7 @@ func (h *Handler) adminGetSessionExecutionConfiguration(w http.ResponseWriter, r
// @Security DeploymentAdminAuth
// @Param session_id path string true "Session ID"
// @Success 200 {object} v1.RuntimeObservation
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/runtime-observation [get]
func (h *Handler) adminGetRuntimeObservation(w http.ResponseWriter, r *http.Request) {
@@ -197,7 +197,7 @@ func (h *Handler) adminGetRuntimeObservation(w http.ResponseWriter, r *http.Requ
// @Param end query integer true "Exclusive Unix-second end" minimum(1) maximum(9007199254740991)
// @Param max_points query integer false "Maximum points per series; defaults to the lower of 120 and the advertised service maximum" minimum(2) maximum(10000)
// @Success 200 {object} v1.RuntimeHistory
-// @Failure 400,401,404,409,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,503 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/sessions/{session_id}/runtime-history [get]
func (h *Handler) adminGetRuntimeHistory(w http.ResponseWriter, r *http.Request) {
diff --git a/services/agents-api/internal/api/admin_summary.go b/services/agents-api/internal/api/admin_summary.go
index ec6f4a6bd..473036858 100644
--- a/services/agents-api/internal/api/admin_summary.go
+++ b/services/agents-api/internal/api/admin_summary.go
@@ -66,7 +66,7 @@ func adminSummaryTime(r *http.Request, name string) (*time.Time, error) {
// @Param limit query int false "Number of Projects" minimum(1) maximum(100) default(20)
// @Param order query string false "Project order" Enums(asc,desc) default(desc)
// @Success 200 {object} api.AdminSummaryResponse
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Router /core/v1/summary [get]
func (h *Handler) adminSummary(w http.ResponseWriter, r *http.Request) {
options, ok := readPage(w, r, "project_id", "group_by", "created_after", "created_before")
diff --git a/services/agents-api/internal/api/admin_vaults_routes.go b/services/agents-api/internal/api/admin_vaults_routes.go
index d9ec9d0fc..2a1eb20dd 100644
--- a/services/agents-api/internal/api/admin_vaults_routes.go
+++ b/services/agents-api/internal/api/admin_vaults_routes.go
@@ -13,7 +13,7 @@ import "net/http"
// @Param status query string false "Scalar status filter" Enums(active,archived)
// @Param status[] query []string false "Array status filter; combined with status as a union" collectionFormat(multi) Enums(active,archived)
// @Success 200 {object} v1.VaultList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/vaults [get]
func (h *Handler) adminListVaults(w http.ResponseWriter, r *http.Request) {
@@ -27,7 +27,7 @@ func (h *Handler) adminListVaults(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param vault_id path string true "Vault ID"
// @Success 200 {object} v1.Vault
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/vaults/{vault_id} [get]
func (h *Handler) adminGetVault(w http.ResponseWriter, r *http.Request) {
@@ -41,7 +41,7 @@ func (h *Handler) adminGetVault(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param vault_id path string true "Vault ID"
// @Success 200 {object} v1.VaultDeleted
-// @Failure 400,401,404,413,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,413,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/vaults/{vault_id} [delete]
func (h *Handler) adminDeleteVault(w http.ResponseWriter, r *http.Request) {
@@ -60,7 +60,7 @@ func (h *Handler) adminDeleteVault(w http.ResponseWriter, r *http.Request) {
// @Param status query string false "Scalar status filter" Enums(active,archived)
// @Param status[] query []string false "Array status filter; combined with status as a union" collectionFormat(multi) Enums(active,archived)
// @Success 200 {object} v1.CredentialList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/vaults/{vault_id}/credentials [get]
func (h *Handler) adminListCredentials(w http.ResponseWriter, r *http.Request) {
@@ -75,7 +75,7 @@ func (h *Handler) adminListCredentials(w http.ResponseWriter, r *http.Request) {
// @Param vault_id path string true "Vault ID"
// @Param credential_id path string true "Credential ID"
// @Success 200 {object} v1.Credential
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/vaults/{vault_id}/credentials/{credential_id} [get]
func (h *Handler) adminGetCredential(w http.ResponseWriter, r *http.Request) {
@@ -90,7 +90,7 @@ func (h *Handler) adminGetCredential(w http.ResponseWriter, r *http.Request) {
// @Param vault_id path string true "Vault ID"
// @Param credential_id path string true "Credential ID"
// @Success 200 {object} v1.CredentialDeleted
-// @Failure 400,401,404,413,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,413,500 {object} CoreErrorResponse
// @Param project_id path string true "Project ID"
// @Router /core/v1/projects/{project_id}/vaults/{vault_id}/credentials/{credential_id} [delete]
func (h *Handler) adminDeleteCredential(w http.ResponseWriter, r *http.Request) {
diff --git a/services/agents-api/internal/api/core_errors.go b/services/agents-api/internal/api/core_errors.go
new file mode 100644
index 000000000..1994389e9
--- /dev/null
+++ b/services/agents-api/internal/api/core_errors.go
@@ -0,0 +1,114 @@
+package api
+
+import (
+ "encoding/json"
+ "math"
+ "net/http"
+)
+
+// CoreErrorResponse is the administration error envelope. Public and machine
+// routes retain v1.ErrorResponse and never emit Details.
+type CoreErrorResponse struct {
+ Error CoreAPIError `json:"error" binding:"required"`
+}
+
+type CoreAPIError struct {
+ Message string `json:"message" binding:"required"`
+ Type string `json:"type" binding:"required"`
+ Code *string `json:"code" extensions:"x-nullable"`
+ Param *string `json:"param" extensions:"x-nullable"`
+ // Details contains only documented, Core-owned facts: string, finite number,
+ // boolean, null or string array values. Never include request echoes, secrets
+ // or native/provider error text. Empty or invalid details are omitted.
+ Details CoreErrorDetails `json:"details,omitempty" swaggertype:"object"`
+}
+
+type CoreErrorDetails map[string]CoreErrorDetail
+
+// CoreErrorDetail has a closed set of constructors so nested objects, arbitrary
+// errors and provider responses cannot be passed as detail values. The zero
+// value represents JSON null. Callers must choose documented fixed keys and
+// safe facts; a string constructor is not a redaction mechanism.
+type CoreErrorDetail struct{ value any }
+
+func CoreErrorString(value string) CoreErrorDetail { return CoreErrorDetail{value} }
+func CoreErrorNumber(value float64) CoreErrorDetail { return CoreErrorDetail{value} }
+func CoreErrorBoolean(value bool) CoreErrorDetail { return CoreErrorDetail{value} }
+func CoreErrorNull() CoreErrorDetail { return CoreErrorDetail{} }
+func CoreErrorStrings(values ...string) CoreErrorDetail {
+ return CoreErrorDetail{append([]string{}, values...)}
+}
+
+func (value CoreErrorDetail) MarshalJSON() ([]byte, error) { return json.Marshal(value.value) }
+
+func validCoreDetails(details CoreErrorDetails) CoreErrorDetails {
+ if len(details) == 0 {
+ return nil
+ }
+ for key, detail := range details {
+ if key == "" {
+ return nil
+ }
+ switch value := detail.value.(type) {
+ case nil, string, bool, []string:
+ case float64:
+ if math.IsNaN(value) || math.IsInf(value, 0) {
+ return nil
+ }
+ default:
+ return nil
+ }
+ }
+ return details
+}
+
+// writeCoreError is for fixed administration diagnostics, not native error
+// text. The router mark, rather than a caller's path or choice of helper,
+// determines whether details can be emitted.
+func writeCoreError(w http.ResponseWriter, status int, code, message string, details CoreErrorDetails, param ...string) {
+ writeAPIError(w, status, code, message, details, param...)
+}
+
+func coreErrorResponses(next http.Handler) http.Handler {
+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ next.ServeHTTP(&coreErrorWriter{w}, r)
+ })
+}
+
+type coreErrorWriter struct{ http.ResponseWriter }
+
+func (*coreErrorWriter) coreErrorResponse() {}
+func (w *coreErrorWriter) Unwrap() http.ResponseWriter { return w.ResponseWriter }
+func (w *coreErrorWriter) FlushError() error {
+ return http.NewResponseController(w.ResponseWriter).Flush()
+}
+func (w *coreErrorWriter) Flush() { _ = w.FlushError() }
+func (w *coreErrorWriter) reportAPIError(code string) { reportAPIError(w.ResponseWriter, code) }
+
+func isCoreErrorWriter(w http.ResponseWriter) bool {
+ for w != nil {
+ if _, ok := w.(interface{ coreErrorResponse() }); ok {
+ return true
+ }
+ unwrapper, ok := w.(interface{ Unwrap() http.ResponseWriter })
+ if !ok {
+ break
+ }
+ w = unwrapper.Unwrap()
+ }
+ return false
+}
+
+func reportAPIError(w http.ResponseWriter, code string) {
+ for w != nil {
+ if observer, ok := w.(interface{ reportAPIError(string) }); ok {
+ observer.reportAPIError(code)
+ return
+ }
+ unwrapper, ok := w.(interface{ Unwrap() http.ResponseWriter })
+ if !ok {
+ return
+ }
+ w = unwrapper.Unwrap()
+ }
+}
diff --git a/services/agents-api/internal/api/core_errors_test.go b/services/agents-api/internal/api/core_errors_test.go
new file mode 100644
index 000000000..bff67fb1f
--- /dev/null
+++ b/services/agents-api/internal/api/core_errors_test.go
@@ -0,0 +1,139 @@
+package api
+
+import (
+ "encoding/json"
+ "math"
+ "net/http"
+ "net/http/httptest"
+ "reflect"
+ "strings"
+ "testing"
+ "time"
+
+ "github.com/MiniMax-AI-Dev/parsar/internal/agentdaemon/device"
+ "github.com/go-chi/chi/v5"
+)
+
+func TestCoreErrorDetailsAreScopedByRouterNotRequestPath(t *testing.T) {
+ shared := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ writeCoreError(w, 409, "sandbox_generation_stale", "Refresh the configuration.", CoreErrorDetails{
+ "current_generation": CoreErrorNumber(4), "kinds": CoreErrorStrings("docker", "microsandbox"),
+ }, "expected_generation")
+ })
+ router := chi.NewRouter()
+ admin, err := NewDeploymentAuthenticator([]string{device.HashCredential("admin")})
+ if err != nil {
+ t.Fatal(err)
+ }
+ (&Handler{deploymentAuth: admin}).registerCoreRoutes(router)
+ var core chi.Router
+ for _, route := range router.Routes() {
+ if route.Pattern == "/core/v1/*" {
+ core, _ = route.SubRoutes.(chi.Router)
+ }
+ }
+ if core == nil {
+ t.Fatal("Core router is missing")
+ }
+ core.Handle("/test", shared)
+ router.Handle("/v1/test", shared)
+ router.Handle("/api/v1/test", shared)
+ golden := "{\"error\":{\"message\":\"Refresh the configuration.\",\"type\":\"conflict_error\",\"code\":\"sandbox_generation_stale\",\"param\":\"expected_generation\"}}\n"
+ for _, path := range []string{"/core/v1/test", "/v1/test", "/api/v1/test"} {
+ out := httptest.NewRecorder()
+ request := httptest.NewRequest("GET", path, nil)
+ request.Header.Set("Authorization", "Bearer admin")
+ router.ServeHTTP(out, request)
+ if out.Code != 409 || out.Header().Get("Cache-Control") != "no-store" {
+ t.Fatal(path, out.Code, out.Header())
+ }
+ if path != "/core/v1/test" {
+ if out.Body.String() != golden {
+ t.Fatalf("%s changed public/machine error: %s", path, out.Body)
+ }
+ } else {
+ var body map[string]map[string]any
+ if err := json.Unmarshal(out.Body.Bytes(), &body); err != nil {
+ t.Fatal(err)
+ }
+ want := map[string]any{"current_generation": float64(4), "kinds": []any{"docker", "microsandbox"}}
+ if !reflect.DeepEqual(body["error"]["details"], want) {
+ t.Fatal(body)
+ }
+ }
+ }
+ for _, path := range []string{"/core/v1/test", "/core/v1/sandbox/unknown"} {
+ out := httptest.NewRecorder()
+ router.ServeHTTP(out, httptest.NewRequest("GET", path, nil))
+ if out.Code != 401 || !strings.Contains(out.Body.String(), `"code":"invalid_admin_key"`) || strings.Contains(out.Body.String(), `"details"`) {
+ t.Fatal("authentication did not precede operation", path, out.Code, out.Body)
+ }
+ }
+ // A Core-looking path cannot itself authorize the optional field.
+ out := httptest.NewRecorder()
+ shared.ServeHTTP(out, httptest.NewRequest("GET", "/core/v1/test", nil))
+ if out.Body.String() != golden {
+ t.Fatal("request path bypassed the router mark", out.Body)
+ }
+}
+
+func TestCoreDetailsTypesOmissionAndSnapshot(t *testing.T) {
+ values := []string{"docker"}
+ stringsDetail := CoreErrorStrings(values...)
+ values[0] = "private-request-value"
+ valid := CoreErrorDetails{"label": CoreErrorString("ready"), "number": CoreErrorNumber(1.5), "enabled": CoreErrorBoolean(true), "unset": CoreErrorNull(), "values": stringsDetail, "empty": CoreErrorStrings()}
+ for _, details := range []CoreErrorDetails{nil, {}, {"bad": CoreErrorNumber(math.NaN())}, {"bad": CoreErrorNumber(math.Inf(1))}, {"bad": CoreErrorDetail{map[string]string{"nested": "private"}}}, {"": CoreErrorString("private")}, valid} {
+ out := httptest.NewRecorder()
+ coreErrorResponses(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+ writeCoreError(w, 400, "invalid_request", "Invalid request.", details)
+ })).ServeHTTP(out, httptest.NewRequest("GET", "/core/v1/test", nil))
+ var body map[string]map[string]any
+ if err := json.Unmarshal(out.Body.Bytes(), &body); err != nil {
+ t.Fatal(err)
+ }
+ _, present := body["error"]["details"]
+ if present != (len(details) == len(valid)) || strings.Contains(out.Body.String(), "private") {
+ t.Fatal(out.Body)
+ }
+ }
+}
+
+type detailDeadlineWriter struct {
+ *httptest.ResponseRecorder
+ deadline time.Time
+}
+
+func (w *detailDeadlineWriter) SetWriteDeadline(value time.Time) error {
+ w.deadline = value
+ return nil
+}
+
+func TestCoreMarkerPreservesObservationAndStreamingWrappers(t *testing.T) {
+ for _, markerOutside := range []bool{true, false} {
+ out := &detailDeadlineWriter{ResponseRecorder: httptest.NewRecorder()}
+ var observed []string
+ handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ deadline := time.Unix(1234, 0)
+ if err := http.NewResponseController(w).SetWriteDeadline(deadline); err != nil {
+ t.Fatal(err)
+ }
+ writeCoreError(w, 503, "execution_unavailable", "Unavailable.", CoreErrorDetails{"retryable": CoreErrorBoolean(false)})
+ if f, ok := w.(http.Flusher); !ok {
+ t.Fatal("Flusher was lost")
+ } else {
+ f.Flush()
+ }
+ writeError(w, 503, "execution_unavailable", "After headers.")
+ }))
+ observer := func(code string) { observed = append(observed, code) }
+ if markerOutside {
+ handler = coreErrorResponses(responseHeadersWithErrors(handler, observer))
+ } else {
+ handler = responseHeadersWithErrors(coreErrorResponses(handler), observer)
+ }
+ handler.ServeHTTP(out, httptest.NewRequest("GET", "/core/v1/test", nil))
+ if !out.Flushed || !out.deadline.Equal(time.Unix(1234, 0)) || out.Header().Get("Openai-Processing-Ms") == "" || !reflect.DeepEqual(observed, []string{"execution_unavailable"}) || !strings.Contains(out.Body.String(), `"details":{"retryable":false}`) {
+ t.Fatal(markerOutside, out, observed)
+ }
+ }
+}
diff --git a/services/agents-api/internal/api/core_metrics.go b/services/agents-api/internal/api/core_metrics.go
index 7f19bf72e..b40106bae 100644
--- a/services/agents-api/internal/api/core_metrics.go
+++ b/services/agents-api/internal/api/core_metrics.go
@@ -24,7 +24,7 @@ func WithCoreMetrics(service CoreMetricsService) Option {
// @Security DeploymentAdminAuth
// @Param range query string false "Time range (default 1h)" Enums(1h,6h,24h,7d)
// @Success 200 {object} coremetrics.View
-// @Failure 400,401,503 {object} v1.ErrorResponse
+// @Failure 400,401,503 {object} CoreErrorResponse
// @Router /core/v1/metrics [get]
func (h *Handler) getCoreMetrics(w http.ResponseWriter, r *http.Request) {
values, err := url.ParseQuery(r.URL.RawQuery)
diff --git a/services/agents-api/internal/api/core_routes.go b/services/agents-api/internal/api/core_routes.go
index 38391bd8a..df1844802 100644
--- a/services/agents-api/internal/api/core_routes.go
+++ b/services/agents-api/internal/api/core_routes.go
@@ -14,6 +14,7 @@ func (h *Handler) registerCoreRoutes(router chi.Router) {
return
}
router.Route("/core/v1", func(r chi.Router) {
+ r.Use(coreErrorResponses)
r.Use(h.deploymentAuth.authenticate)
r.NotFound(func(w http.ResponseWriter, _ *http.Request) {
writeError(w, http.StatusNotFound, "not_found", "This Core operation does not exist.")
diff --git a/services/agents-api/internal/api/environment_executor_management.go b/services/agents-api/internal/api/environment_executor_management.go
index 46bf5b156..75c869718 100644
--- a/services/agents-api/internal/api/environment_executor_management.go
+++ b/services/agents-api/internal/api/environment_executor_management.go
@@ -52,7 +52,7 @@ func (h *Handler) registerExecutorCredentialRoutes(r chi.Router) {
// @Param project_id path string true "Project UUID"
// @Param environment_id path string true "Environment UUID"
// @Success 200 {object} api.ExecutorCredentialList
-// @Failure 401,404,500 {object} v1.ErrorResponse
+// @Failure 401,404,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials [get]
func (h *Handler) listExecutorCredentials(w http.ResponseWriter, r *http.Request, s EnvironmentExecutorStore) {
binding, ok := h.adminProjectScope(w, r)
@@ -77,7 +77,7 @@ func (h *Handler) listExecutorCredentials(w http.ResponseWriter, r *http.Request
// @Param environment_id path string true "Environment UUID"
// @Param body body api.EnvironmentExecutorCredentialRequest true "Request"
// @Success 201 {object} store.IssuedExecutorCredential
-// @Failure 400,401,404,409,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials [post]
func (h *Handler) issueExecutorCredential(w http.ResponseWriter, r *http.Request, s EnvironmentExecutorStore) {
// Check order: request body (400), target (404), archived Project (409),
@@ -112,7 +112,7 @@ func (h *Handler) issueExecutorCredential(w http.ResponseWriter, r *http.Request
// @Param environment_id path string true "Environment UUID"
// @Param key_id path string true "Executor key UUID"
// @Success 204
-// @Failure 401,404,500 {object} v1.ErrorResponse
+// @Failure 401,404,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials/{key_id} [delete]
func (h *Handler) revokeExecutorCredential(w http.ResponseWriter, r *http.Request, s EnvironmentExecutorStore) {
binding, ok := h.adminProjectScope(w, r)
diff --git a/services/agents-api/internal/api/errors.go b/services/agents-api/internal/api/errors.go
index 4ba1e2199..d28e126ff 100644
--- a/services/agents-api/internal/api/errors.go
+++ b/services/agents-api/internal/api/errors.go
@@ -24,9 +24,11 @@ func writeJSON(w http.ResponseWriter, status int, value any) {
// Every 401 has type invalid_request_error, as every observed official 401
// does (HP-07); an empty code serializes as null.
func writeError(w http.ResponseWriter, status int, code, message string, param ...string) {
- if observer, ok := w.(interface{ reportAPIError(string) }); ok {
- observer.reportAPIError(code)
- }
+ writeAPIError(w, status, code, message, nil, param...)
+}
+
+func writeAPIError(w http.ResponseWriter, status int, code, message string, details CoreErrorDetails, param ...string) {
+ reportAPIError(w, code)
kind := "invalid_request_error"
if status >= 500 {
kind = "server_error"
@@ -43,6 +45,10 @@ func writeError(w http.ResponseWriter, status int, code, message string, param .
if len(param) > 0 {
errorParam = ¶m[0]
}
+ if isCoreErrorWriter(w) {
+ writeJSON(w, status, CoreErrorResponse{Error: CoreAPIError{Message: message, Type: kind, Code: errorCode, Param: errorParam, Details: validCoreDetails(details)}})
+ return
+ }
writeJSON(w, status, v1.ErrorResponse{Error: v1.APIError{Message: message, Type: kind, Code: errorCode, Param: errorParam}})
}
diff --git a/services/agents-api/internal/api/harness_model_providers.go b/services/agents-api/internal/api/harness_model_providers.go
index dea43de51..e5ccf9bb4 100644
--- a/services/agents-api/internal/api/harness_model_providers.go
+++ b/services/agents-api/internal/api/harness_model_providers.go
@@ -85,7 +85,7 @@ func knownHarness(w http.ResponseWriter, r *http.Request) (string, bool) {
// @Produce json
// @Security DeploymentAdminAuth
// @Success 200 {object} api.CoreHarnessList
-// @Failure 401,500 {object} v1.ErrorResponse
+// @Failure 401,500 {object} CoreErrorResponse
// @Router /core/v1/harnesses [get]
func (h *Handler) listHarnesses(w http.ResponseWriter, r *http.Request, s DeploymentModelProviderStore) {
providers, err := s.ListDeploymentModelProviders(r.Context())
@@ -113,7 +113,7 @@ func (h *Handler) listHarnesses(w http.ResponseWriter, r *http.Request, s Deploy
// @Security DeploymentAdminAuth
// @Param harness path string true "Harness" Enums(claude_sdk,codex,mcode)
// @Success 200 {object} api.HarnessModelProvider
-// @Failure 401,404,500 {object} v1.ErrorResponse
+// @Failure 401,404,500 {object} CoreErrorResponse
// @Router /core/v1/harnesses/{harness}/model-provider [get]
func (h *Handler) getHarnessModelProvider(w http.ResponseWriter, r *http.Request, s DeploymentModelProviderStore) {
harness, ok := knownHarness(w, r)
@@ -149,7 +149,7 @@ var harnessModelProviderShape = shape{kind: objectValue, members: []member{
// @Param harness path string true "Harness" Enums(claude_sdk,codex,mcode)
// @Param body body v1.ModelProviderInput true "Complete model provider bundle"
// @Success 200 {object} api.HarnessModelProvider
-// @Failure 400,401,404,413,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,413,500,503 {object} CoreErrorResponse
// @Router /core/v1/harnesses/{harness}/model-provider [put]
func (h *Handler) setHarnessModelProvider(w http.ResponseWriter, r *http.Request, s DeploymentModelProviderStore) {
harness, ok := knownHarness(w, r)
@@ -185,7 +185,7 @@ func (h *Handler) setHarnessModelProvider(w http.ResponseWriter, r *http.Request
// @Security DeploymentAdminAuth
// @Param harness path string true "Harness" Enums(claude_sdk,codex,mcode)
// @Success 204
-// @Failure 401,404,500 {object} v1.ErrorResponse
+// @Failure 401,404,500 {object} CoreErrorResponse
// @Router /core/v1/harnesses/{harness}/model-provider [delete]
func (h *Handler) deleteHarnessModelProvider(w http.ResponseWriter, r *http.Request, s DeploymentModelProviderStore) {
harness, ok := knownHarness(w, r)
diff --git a/services/agents-api/internal/api/installation.go b/services/agents-api/internal/api/installation.go
index 1358bd0b7..726157bbc 100644
--- a/services/agents-api/internal/api/installation.go
+++ b/services/agents-api/internal/api/installation.go
@@ -112,7 +112,7 @@ func WithInstallation(value Installation, bindings func(context.Context) (store.
// @Produce json
// @Security DeploymentAdminAuth
// @Success 200 {object} api.Installation
-// @Failure 401,500 {object} v1.ErrorResponse
+// @Failure 401,500 {object} CoreErrorResponse
// @Router /core/v1/installation [get]
func (h *Handler) getInstallation(w http.ResponseWriter, r *http.Request) {
bindings, err := h.installationBindings(r.Context())
diff --git a/services/agents-api/internal/api/project_api_keys.go b/services/agents-api/internal/api/project_api_keys.go
index 8fa4c4847..84b329876 100644
--- a/services/agents-api/internal/api/project_api_keys.go
+++ b/services/agents-api/internal/api/project_api_keys.go
@@ -108,7 +108,7 @@ func adminCatalogPage(r *http.Request) (string, int, bool, error) {
// @Param limit query int false "Page size (1-100)"
// @Param order query string false "asc or desc by Project ID"
// @Success 200 {object} store.ProjectPage
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Router /core/v1/projects [get]
func (h *Handler) listProjects(w http.ResponseWriter, r *http.Request) {
after, limit, ascending, err := adminCatalogPage(r)
@@ -131,7 +131,7 @@ func (h *Handler) listProjects(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param body body api.ProjectRequest true "Project display name"
// @Success 201 {object} store.Project
-// @Failure 400,401,409,500 {object} v1.ErrorResponse
+// @Failure 400,401,409,500 {object} CoreErrorResponse
// @Router /core/v1/projects [post]
func (h *Handler) createProject(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBodyLimit(w, r, 4096, "Project request is too large.")
@@ -161,7 +161,7 @@ func (h *Handler) createProject(w http.ResponseWriter, r *http.Request) {
// @Param project_id path string true "Project UUID"
// @Param body body api.ProjectRequest true "Project display name"
// @Success 200 {object} store.Project
-// @Failure 400,401,404,409,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id} [post]
func (h *Handler) renameProject(w http.ResponseWriter, r *http.Request) {
binding, ok := h.adminProjectScope(w, r)
@@ -191,7 +191,7 @@ func (h *Handler) renameProject(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param project_id path string true "Project UUID"
// @Success 200 {object} store.Project
-// @Failure 401,404,409,500 {object} v1.ErrorResponse
+// @Failure 401,404,409,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/archive [post]
func (h *Handler) archiveProject(w http.ResponseWriter, r *http.Request) {
binding, ok := h.adminProjectScope(w, r)
@@ -215,7 +215,7 @@ func (h *Handler) archiveProject(w http.ResponseWriter, r *http.Request) {
// @Param limit query int false "Page size (1-100)"
// @Param order query string false "asc or desc by key ID"
// @Success 200 {object} store.ProjectAPIKeyPage
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/keys [get]
func (h *Handler) listProjectAPIKeys(w http.ResponseWriter, r *http.Request) {
binding, ok := h.adminProjectScope(w, r)
@@ -243,7 +243,7 @@ func (h *Handler) listProjectAPIKeys(w http.ResponseWriter, r *http.Request) {
// @Param project_id path string true "Project UUID"
// @Param body body api.ProjectAPIKeyRequest true "Key display name"
// @Success 201 {object} store.IssuedProjectAPIKey
-// @Failure 400,401,404,409,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/keys [post]
func (h *Handler) createProjectAPIKey(w http.ResponseWriter, r *http.Request) {
binding, ok := h.adminProjectScope(w, r)
@@ -274,7 +274,7 @@ func (h *Handler) createProjectAPIKey(w http.ResponseWriter, r *http.Request) {
// @Param project_id path string true "Project UUID"
// @Param key_id path string true "API key UUID"
// @Success 200 {object} api.SandboxMutationResponse
-// @Failure 401,404,409,500 {object} v1.ErrorResponse
+// @Failure 401,404,409,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/keys/{key_id} [delete]
func (h *Handler) revokeProjectAPIKey(w http.ResponseWriter, r *http.Request) {
binding, ok := h.adminProjectScope(w, r)
diff --git a/services/agents-api/internal/api/sandbox_deployment_setup.go b/services/agents-api/internal/api/sandbox_deployment_setup.go
index 210bd2a8b..c9eecbe76 100644
--- a/services/agents-api/internal/api/sandbox_deployment_setup.go
+++ b/services/agents-api/internal/api/sandbox_deployment_setup.go
@@ -71,7 +71,7 @@ func WithSandboxDeploymentChanges(
// @Accept json
// @Param body body api.SandboxDeploymentInput true "Deployment selection"
// @Success 200 {object} store.RuntimeDeploymentView
-// @Failure 400,401,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/deployment [post]
func (h *Handler) initializeSandboxDeployment(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBody(w, r)
@@ -106,7 +106,7 @@ func (h *Handler) initializeSandboxDeployment(w http.ResponseWriter, r *http.Req
// @Accept json
// @Param body body api.SandboxDeploymentChangeInput true "Replacement deployment selection"
// @Success 200 {object} store.RuntimeDeploymentView
-// @Failure 400,401,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/deployment [put]
func (h *Handler) updateSandboxDeployment(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBody(w, r)
@@ -141,7 +141,7 @@ func (h *Handler) updateSandboxDeployment(w http.ResponseWriter, r *http.Request
// @Accept json
// @Param body body store.SandboxMaintenanceRequest true "Maintenance state"
// @Success 200 {object} store.RuntimeDeploymentView
-// @Failure 400,401,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/deployment/maintenance [patch]
func (h *Handler) setSandboxMaintenance(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBody(w, r)
diff --git a/services/agents-api/internal/api/sandbox_manager.go b/services/agents-api/internal/api/sandbox_manager.go
index 6dd20649f..c24b9197a 100644
--- a/services/agents-api/internal/api/sandbox_manager.go
+++ b/services/agents-api/internal/api/sandbox_manager.go
@@ -70,7 +70,7 @@ func (h *Handler) registerSandboxManagerRoutes(r chi.Router) {
// @Produce json
// @Security DeploymentAdminAuth
// @Success 200 {object} store.RuntimeDeploymentView
-// @Failure 400,401,404,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/deployment [get]
func (h *Handler) sandboxDeployment(w http.ResponseWriter, r *http.Request) {
value, err := h.sandboxStore.GetRuntimeDeployment(r.Context())
@@ -87,7 +87,7 @@ func (h *Handler) sandboxDeployment(w http.ResponseWriter, r *http.Request) {
// @Produce json
// @Security DeploymentAdminAuth
// @Success 200 {object} api.SandboxNodeList
-// @Failure 400,401,404,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/nodes [get]
func (h *Handler) sandboxNodes(w http.ResponseWriter, r *http.Request) {
value, err := h.sandboxStore.ListRuntimeNodes(r.Context())
@@ -107,7 +107,7 @@ func (h *Handler) sandboxNodes(w http.ResponseWriter, r *http.Request) {
// @Accept json
// @Param body body store.RuntimeNodeUpdate true "Request"
// @Success 200 {object} api.SandboxMutationResponse
-// @Failure 400,401,404,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/nodes/{node_id} [patch]
func (h *Handler) updateSandboxNode(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBody(w, r)
@@ -134,7 +134,7 @@ func (h *Handler) updateSandboxNode(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param node_id path string true "Sandbox node UUID"
// @Success 200 {object} api.SandboxMutationResponse
-// @Failure 400,401,404,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/nodes/{node_id} [delete]
func (h *Handler) removeSandboxNode(w http.ResponseWriter, r *http.Request) {
id := chi.URLParam(r, "node_id")
@@ -152,7 +152,7 @@ func (h *Handler) removeSandboxNode(w http.ResponseWriter, r *http.Request) {
// @Security DeploymentAdminAuth
// @Param node_id path string true "Sandbox node UUID"
// @Success 200 {object} api.SandboxAllocationList
-// @Failure 400,401,404,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/nodes/{node_id}/allocations [get]
func (h *Handler) sandboxAllocations(w http.ResponseWriter, r *http.Request) {
value, err := h.sandboxStore.ListNodeRuntimeAllocations(r.Context(), chi.URLParam(r, "node_id"))
@@ -171,7 +171,7 @@ func (h *Handler) sandboxAllocations(w http.ResponseWriter, r *http.Request) {
// @Accept json
// @Param body body api.SandboxEnrollmentTokenRequest true "Request"
// @Success 201 {object} api.SandboxEnrollmentToken
-// @Failure 400,401,404,409,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,409,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/enrollment-tokens [post]
func (h *Handler) createSandboxEnrollment(w http.ResponseWriter, r *http.Request) {
raw, ok := readJSONBody(w, r)
diff --git a/services/agents-api/internal/api/sandbox_node_detail.go b/services/agents-api/internal/api/sandbox_node_detail.go
index 3d47db1eb..b7e6a581c 100644
--- a/services/agents-api/internal/api/sandbox_node_detail.go
+++ b/services/agents-api/internal/api/sandbox_node_detail.go
@@ -18,7 +18,7 @@ import (
// @Param node_id path string true "Sandbox node UUID"
// @Param range query string false "Time range (default 1h)" Enums(1h,6h,24h)
// @Success 200 {object} store.RuntimeNodeDetail
-// @Failure 400,401,404,500,503 {object} v1.ErrorResponse
+// @Failure 400,401,404,500,503 {object} CoreErrorResponse
// @Router /core/v1/sandbox/nodes/{node_id} [get]
func (h *Handler) sandboxNodeDetail(w http.ResponseWriter, r *http.Request) {
values, err := url.ParseQuery(r.URL.RawQuery)
diff --git a/services/agents-api/internal/api/write_audit.go b/services/agents-api/internal/api/write_audit.go
index eb3d88e88..fe2e6b528 100644
--- a/services/agents-api/internal/api/write_audit.go
+++ b/services/agents-api/internal/api/write_audit.go
@@ -65,7 +65,7 @@ func (h *Handler) writeAuditScope(w http.ResponseWriter, r *http.Request, allowe
// @Param resource_type query string true "Resource type"
// @Param resource_ids query string true "Comma-separated public resource IDs, maximum 100"
// @Success 200 {object} api.ResourceOwnerList
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/resource-owners [get]
func (h *Handler) getResourceOwners(w http.ResponseWriter, r *http.Request) {
values, tenant, ok := h.writeAuditScope(w, r, "resource_type", "resource_ids")
@@ -108,7 +108,7 @@ func (h *Handler) getResourceOwners(w http.ResponseWriter, r *http.Request) {
// @Param limit query int false "Page size, 1-100, default 50"
// @Param after query string false "Opaque next_cursor from the preceding page"
// @Success 200 {object} store.WriteOperationPage
-// @Failure 400,401,404,500 {object} v1.ErrorResponse
+// @Failure 400,401,404,500 {object} CoreErrorResponse
// @Router /core/v1/projects/{project_id}/write-operations [get]
func (h *Handler) listWriteOperations(w http.ResponseWriter, r *http.Request) {
values, tenant, ok := h.writeAuditScope(w, r, "key_id", "resource_type", "resource_id", "created_after", "created_before", "limit", "after")
diff --git a/services/core-console/core_errors.go b/services/core-console/core_errors.go
new file mode 100644
index 000000000..a2a7e85b0
--- /dev/null
+++ b/services/core-console/core_errors.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+ "net/http"
+ "strings"
+)
+
+// Console failures have fixed safe text, not transport errors or request values.
+// Core's own error responses pass through the proxy without reinterpretation.
+type consoleCoreAPIError struct {
+ Message string `json:"message"`
+ Type string `json:"type"`
+ Code string `json:"code"`
+ Param *string `json:"param"`
+}
+
+func consoleCoreError(w http.ResponseWriter, status int, code, message string) {
+ kind := "invalid_request_error"
+ if status >= 500 {
+ kind = "server_error"
+ }
+ authJSON(w, status, struct {
+ Error consoleCoreAPIError `json:"error"`
+ }{
+ Error: consoleCoreAPIError{Message: message, Type: kind, Code: code},
+ })
+}
+
+// The namespace controls local error formatting only. It does not authorize a
+// request or classify a bare/retired path as a proxyable Core operation.
+func consoleCoreNamespace(r *http.Request) bool {
+ return r.URL.Path == "/core" || strings.HasPrefix(r.URL.Path, "/core/")
+}
diff --git a/services/core-console/core_errors_test.go b/services/core-console/core_errors_test.go
new file mode 100644
index 000000000..ec2aed1b9
--- /dev/null
+++ b/services/core-console/core_errors_test.go
@@ -0,0 +1,78 @@
+package main
+
+import (
+ "encoding/json"
+ "errors"
+ "net/http"
+ "net/http/httptest"
+ "strings"
+ "sync/atomic"
+ "testing"
+)
+
+func assertConsoleCoreError(t *testing.T, body string, code string, status int) {
+ t.Helper()
+ var envelope struct {
+ Error map[string]any `json:"error"`
+ }
+ if err := json.Unmarshal([]byte(body), &envelope); err != nil {
+ t.Fatal(err, body)
+ }
+ kind := "invalid_request_error"
+ if status >= 500 {
+ kind = "server_error"
+ }
+ if len(envelope.Error) != 4 || envelope.Error["code"] != code || envelope.Error["param"] != nil || envelope.Error["type"] != kind {
+ t.Fatal(body)
+ }
+}
+
+type failingCoreTransport struct{ calls int }
+
+func (transport *failingCoreTransport) RoundTrip(*http.Request) (*http.Response, error) {
+ transport.calls++
+ return nil, errors.New("private provider URL https://private.invalid/?api_key=private-secret")
+}
+
+func TestCoreProxyFailureEnvelopeIsSafeAndNeverRetries(t *testing.T) {
+ c := coreKeyConsoleConfig(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { t.Error("unexpected real transport") }))
+ h := startConsole(t, c)
+ cookie := signIn(t, h)
+ transport := &failingCoreTransport{}
+ h.proxy.Transport = transport
+ out := authRequest(h, "GET", "/core/v1/projects", "", cookie)
+ if out.Code != 502 || transport.calls != 1 || strings.Contains(out.Body.String(), "private") || out.Header().Get("Content-Type") != "application/json" {
+ t.Fatal(out.Code, transport.calls, out.Body)
+ }
+ assertConsoleCoreError(t, out.Body.String(), "core_unreachable", 502)
+}
+
+func TestCoreProxyPreservesUpstreamEnvelopeAndAuthShape(t *testing.T) {
+ const upstream = `{"error":{"message":"Refresh the configuration.","type":"conflict_error","code":"sandbox_generation_stale","param":"expected_generation","details":{"current_generation":3}}}`
+ var calls atomic.Int32
+ c := coreKeyConsoleConfig(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ calls.Add(1)
+ w.Header().Set("Content-Type", "application/json")
+ w.WriteHeader(409)
+ _, _ = w.Write([]byte(upstream))
+ }))
+ h := startConsole(t, c)
+ cookie := signIn(t, h)
+ out := authRequest(h, "GET", "/core/v1/sandbox/deployment", "", cookie)
+ if out.Code != 409 || out.Body.String() != upstream || calls.Load() != 1 {
+ t.Fatal(out.Code, out.Body, calls.Load())
+ }
+ for _, path := range []string{"/core", "/core/", "/core/v1", "/core/retired", "/v1/agents", "/api/v1/sandbox-node/configuration"} {
+ out := authRequest(h, "GET", path, "", cookie)
+ if out.Code != 404 || calls.Load() != 1 {
+ t.Fatal("non-operation became proxyable", path, out.Code, calls.Load())
+ }
+ }
+ request := httptest.NewRequest("GET", "/console/auth", nil)
+ request.Host = "private-host.invalid"
+ out = httptest.NewRecorder()
+ h.ServeHTTP(out, request)
+ if out.Code != 403 || out.Body.String() != "{\"error\":\"Forbidden\"}\n" {
+ t.Fatal("auth shape changed", out.Code, out.Body)
+ }
+}
diff --git a/services/core-console/server.go b/services/core-console/server.go
index b301bdeb2..ed5e54ff4 100644
--- a/services/core-console/server.go
+++ b/services/core-console/server.go
@@ -93,7 +93,7 @@ func newConsole(c config) (*console, error) {
return nil
},
ErrorHandler: func(w http.ResponseWriter, _ *http.Request, _ error) {
- http.Error(w, "Core is unavailable", http.StatusBadGateway)
+ consoleCoreError(w, http.StatusBadGateway, "core_unreachable", "Core is unavailable")
},
}
return h, nil
@@ -130,11 +130,19 @@ func (h *console) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
if !h.sameOrigin(r) {
- authError(w, http.StatusForbidden, "Forbidden")
+ if consoleCoreNamespace(r) {
+ consoleCoreError(w, http.StatusForbidden, "console_origin_rejected", "Forbidden")
+ } else {
+ authError(w, http.StatusForbidden, "Forbidden")
+ }
return
}
if !safePath(r.URL.Path) || r.URL.IsAbs() || r.Method == http.MethodConnect || r.Method == http.MethodTrace || r.Header.Get("Upgrade") != "" {
- http.Error(w, "Invalid request", http.StatusBadRequest)
+ if consoleCoreNamespace(r) {
+ consoleCoreError(w, http.StatusBadRequest, "console_request_invalid", "Invalid request")
+ } else {
+ http.Error(w, "Invalid request", http.StatusBadRequest)
+ }
return
}
if r.URL.Path == "/console/auth" || strings.HasPrefix(r.URL.Path, "/console/auth/") {
@@ -146,7 +154,11 @@ func (h *console) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
if !h.auth.authenticated(r) {
- authError(w, http.StatusUnauthorized, "Sign in to the console")
+ if consoleCoreNamespace(r) {
+ consoleCoreError(w, http.StatusUnauthorized, "console_sign_in_required", "Sign in to the console")
+ } else {
+ authError(w, http.StatusUnauthorized, "Sign in to the console")
+ }
return
}
if r.URL.Path == "/console/config" && r.Method == http.MethodGet {
diff --git a/services/core-console/server_test.go b/services/core-console/server_test.go
index 5782cb0b7..7eff1f119 100644
--- a/services/core-console/server_test.go
+++ b/services/core-console/server_test.go
@@ -107,6 +107,8 @@ func TestAuthenticationAndCrossSiteAdmission(t *testing.T) {
if response.StatusCode != tc.status {
t.Fatalf("status = %d, body = %s", response.StatusCode, body)
}
+ code := map[int]string{401: "console_sign_in_required", 403: "console_origin_rejected", 400: "console_request_invalid"}[tc.status]
+ assertConsoleCoreError(t, body, code, tc.status)
if strings.Contains(body, "private-") {
t.Fatal("rejection exposed a credential")
}
@@ -178,6 +180,7 @@ func TestProxyRejectsRedirectWithoutFollowingOrExposingIt(t *testing.T) {
http.Redirect(w, r, destination.URL+"/?token=private-core-key", http.StatusTemporaryRedirect)
}))
response, body := responseBody(t, server, consoleRequest(t, server, "GET", "/core/v1/projects"))
+ assertConsoleCoreError(t, body, "core_unreachable", 502)
if response.StatusCode != 502 || response.Header.Get("Location") != "" || strings.Contains(body, "private-core-key") || destinationCalls.Load() != 0 {
t.Fatal("upstream redirect escaped the fixed proxy")
}