fix: align Forward and Managed API contracts with current documentation

CHANGELOG.md

@@ -5,6 +5,28 @@ existing `0.1.0` release; earlier development prereleases are not listed.
 
 ## [Unreleased]
 
+### Added
+
+- Add typed Forward Session budgets across create/update responses and events, including omission, explicit null clearing and decimal-string limits.
+- Add Forward Session `config.model` overrides and model `speed` configuration, plus optional approval evaluation details, Outcome/status event fields and cumulative top-level Credits on `session.usage`.
+- Add `startup_script` to Forward/Managed Environment models and Managed cloud/self-hosted parameters. It runs on sandbox start/resume; the external worker controls self-hosted execution.
+- Add Managed Memory `version`, version `redacted`, and Vault creation-response `credentials` fields. Vault creation still does not accept credentials in its request.
+
+### Fixed
+
+- Decode Forward `evaluated_permission` through a string declaration and make event-specific payload fields optional instead of requiring fields from every event variant.
+- Align Managed Thread/coordinator exported model helper types with string effort and context windows. Add Memory version `updated`, retaining `modified` through a deprecated compatibility type.
+
+### Breaking changes
+
+- Forward `SessionEvent.evaluated_permission` is now `string | undefined`, and event-specific fields may be absent. The two Managed nested-model helper types now use string effort.
+
+### Migration
+
+- Compare `event.evaluated_permission` directly to `"allow"`, `"ask"` or `"deny"`; automatic approval details are under `event.evaluation?.evaluated_permission`. Check optional event fields before reading them.
+- Omit `budget` to keep the default/current limit; pass `null` to clear it. Omit the model on create to inherit; update `config.model` to `null` to restore inheritance.
+- Use the new `updated` Memory operation for current responses. Legacy Managed nested-model `speed` remains deprecated. Treat `session.usage` as cumulative snapshots rather than adding successive events.
+
 ### Changed
 
 - Remove resource-specific sections and inventories from the README to keep it focused on SDK setup and shared client behavior.

README.md

@@ -113,6 +113,22 @@ const params: SessionCreateParams = { identity_id: 'identity_id', template_id: '
 
 All fields keep the snake_case naming used on the wire. Unknown fields are preserved when decoding, so a server-side addition reaches you before the types catch up. On the way out `undefined` is omitted, while `null`, `false`, empty strings and empty arrays are sent as-is.
 
+## Environment startup scripts
+
+Both Forward and Managed accept `config.startup_script`. For cloud environments,
+it runs after `setup_script` on the first sandbox start and again on every resume,
+before the first tool call. The server enforces a 64 KB limit and a 5-minute
+timeout. Scripts must exit; start long-lived services in the background and wait
+for readiness when needed.
+
+Failure emits a `session.error` event whose `error.type` is
+`environment_startup_failed_error`; the session and sandbox remain usable.
+The script is not retried during the same start. For self-hosted environments,
+the API stores and returns the script; execution depends on the external worker.
+See the official [Forward](https://docs.qoder.com/cloud-agents/api/forward/environments/schemas#environment-startup-script)
+and [Managed](https://docs.qoder.com/cloud-agents/api/environments/schemas#environment-startup-script)
+contracts.
+
 ## Streaming
 
 Streaming responses are consumed incrementally. Close the stream when finished and handle interruption explicitly; closing a local stream does not cancel server-side work.

docs/api/forward/README.md

@@ -196,6 +196,7 @@
 - [ServiceAccountTokenRevokeResponse](interfaces/ServiceAccountTokenRevokeResponse.md)
 - [Session](interfaces/Session.md)
 - [SessionArchiveParams](interfaces/SessionArchiveParams.md)
+- [SessionBudget](interfaces/SessionBudget.md)
 - [SessionCancelParams](interfaces/SessionCancelParams.md)
 - [SessionConfig](interfaces/SessionConfig.md)
 - [SessionEvent](interfaces/SessionEvent.md)
@@ -248,6 +249,8 @@
 - [TemplateUpdateParams](interfaces/TemplateUpdateParams.md)
 - [TemplateUsage](interfaces/TemplateUsage.md)
 - [Tool](interfaces/Tool.md)
+- [ToolApprovalDecision](interfaces/ToolApprovalDecision.md)
+- [ToolApprovalEvaluation](interfaces/ToolApprovalEvaluation.md)
 - [ToolConfig](interfaces/ToolConfig.md)
 - [ToolConfigParam](interfaces/ToolConfigParam.md)
 - [ToolOverride](interfaces/ToolOverride.md)

docs/api/forward/interfaces/EnvironmentConfig.md

@@ -26,6 +26,14 @@ Additional fields are preserved verbatim by the SDK.
 
 ***
 
+### startup\_script?
+
+> `optional` **startup\_script?**: `string`
+
+Runs on sandbox start/resume; self-hosted execution depends on the worker.
+
+***
+
 ### type
 
 > **type**: `string`

docs/api/forward/interfaces/ModelConfigObject.md

@@ -14,18 +14,26 @@ Additional fields are preserved verbatim by the SDK.
 
 ## Properties
 
-### context\_window
+### context\_window?
 
-> **context\_window**: `number`
+> `optional` **context\_window?**: `number`
 
 ***
 
-### effort
+### effort?
 
-> **effort**: `string`
+> `optional` **effort?**: `string`
 
 ***
 
 ### id
 
 > **id**: `string`
+
+***
+
+### speed?
+
+> `optional` **speed?**: `string`
+
+Inference speed; consult the model capabilities.

docs/api/forward/interfaces/ModelConfigParam.md

@@ -29,3 +29,11 @@ Additional fields are preserved verbatim by the SDK.
 ### id
 
 > **id**: `string`
+
+***
+
+### speed?
+
+> `optional` **speed?**: `string` \| `null`
+
+Inference speed: standard or high.

docs/api/forward/interfaces/Session.md

@@ -20,6 +20,12 @@ Additional fields are preserved verbatim by the SDK.
 
 ***
 
+### budget?
+
+> `optional` **budget?**: [`SessionBudget`](SessionBudget.md) \| `null`
+
+***
+
 ### config
 
 > **config**: [`SessionConfig`](SessionConfig.md)

docs/api/forward/interfaces/SessionBudget.md

@@ -0,0 +1,27 @@
+[**qca-sdk**](../../README.md)
+
+***
+
+[qca-sdk](../../README.md) / [forward](../README.md) / SessionBudget
+
+# Interface: SessionBudget
+
+Cumulative model and sandbox Credits limit. An active turn may finish after the limit.
+
+## Indexable
+
+> \[`key`: `string`\]: `unknown`
+
+## Properties
+
+### max\_credit\_cost
+
+> **max\_credit\_cost**: `string`
+
+Positive decimal string with at most 12 integer and 2 fractional digits.
+
+***
+
+### type
+
+> **type**: `"limit"`

docs/api/forward/interfaces/SessionConfig.md

@@ -17,3 +17,9 @@ Additional fields are preserved verbatim by the SDK.
 ### environment\_variables
 
 > **environment\_variables**: `Record`\<`string`, `string`\>
+
+***
+
+### model?
+
+> `optional` **model?**: [`ModelConfig`](../type-aliases/ModelConfig.md)