@deepraxis/cli 0.1.1-dev.c64b603 → 0.1.1-dev.d775f1e

package/COMMANDS.md

@@ -2,7 +2,7 @@
 
 Generated by `bun run commands`. DO NOT EDIT.
 
-434 HTTP operations; 436 commands including aliases.
+421 HTTP operations; 423 commands including aliases.
 
 Environment: `PRAXIS_ENV=develop|production` (dev package defaults to `develop`; stable package defaults to `production`). No `--env` option.
 
@@ -53,19 +53,6 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis agent deployment update <deployment_id>` | `agent.deployments.update` | POST `/agent/v1/deployments/{deployment_id}` | `--description`, `--environment-id`, `--name`, `--vault-ids` |
 | `praxis agent deployment-run get <deployment_run_id>` | `agent.deploymentRuns.retrieve` | GET `/agent/v1/deployment_runs/{deployment_run_id}` |  |
 | `praxis agent deployment-run list` | `agent.deploymentRuns.list` | GET `/agent/v1/deployment_runs` | `--created-at-gt`, `--created-at-gte`, `--created-at-lt`, `--created-at-lte`, `--deployment-id`, `--has-error`, `--trigger-type`, `--param-limit`, `--page` |
-| `praxis agent embed exchange create` | `agent.embed.exchange.create` | POST `/agent/v1/embed/exchange` | `--code` |
-| `praxis agent embed get-appearance` | `agent.embed.retrieveAppearance` | GET `/agent/v1/embed/appearance` |  |
-| `praxis agent embed-token anonymous create` | `agent.embedTokens.anonymous.create` | POST `/agent/v1/embed_tokens/anonymous` | `--publishable-key`, `--visitor-secret` |
-| `praxis agent embed-token create` | `agent.embedTokens.create` | POST `/agent/v1/embed_tokens` | `--hosted`, `--agent`, `--param-version`, `--external-user-id`, `--ttl-seconds`, `--budget-cents`, `--allowed-origins` |
-| `praxis agent embed-token list` | `agent.embedTokens.list` | GET `/agent/v1/embed_tokens` | `--agent-id`, `--external-user-id`, `--param-limit`, `--page` |
-| `praxis agent embed-token revoke create` | `agent.embedTokens.revoke.create` | POST `/agent/v1/embed_tokens/{id}/revoke` | `--embed-token` |
-| `praxis agent end-user block create` | `agent.agents.endUsers.block.create` | POST `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block` | `--agent`, `--end-user` |
-| `praxis agent end-user delete <external_user_id>` | `agent.agents.endUsers.delete` | DELETE `/agent/v1/agents/{agent_id}/end_users/{external_user_id}` | `--agent`, `--confirm` |
-| `praxis agent end-user get <external_user_id>` | `agent.agents.endUsers.retrieve` | GET `/agent/v1/agents/{agent_id}/end_users/{external_user_id}` | `--agent` |
-| `praxis agent end-user get-deletion <external_user_id>` | `agent.agents.endUsers.retrieveDeletion` | GET `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion` | `--agent` |
-| `praxis agent end-user list` | `agent.agents.endUsers.list` | GET `/agent/v1/agents/{agent_id}/end_users` | `--agent`, `--param-limit`, `--page`, `--q` |
-| `praxis agent end-user revoke-token create` | `agent.agents.endUsers.revokeTokens.create` | POST `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens` | `--agent`, `--end-user` |
-| `praxis agent end-user unblock create` | `agent.agents.endUsers.unblock.create` | POST `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock` | `--agent`, `--end-user` |
 | `praxis agent environment archive <environment_id>` | `agent.environments.archive` | POST `/agent/v1/environments/{environment_id}/archive` |  |
 | `praxis agent environment create` | `agent.environments.create` | POST `/agent/v1/environments` | `--name`, `--description` |
 | `praxis agent environment get <environment_id>` | `agent.environments.retrieve` | GET `/agent/v1/environments/{environment_id}` |  |

package/dist/praxis.js

@@ -113,7 +113,7 @@ var operations = [
           name: "multiagent",
           type: "object",
           required: false,
-          description: "A coordinator topology: the session's primary thread orchestrates\nwork by spawning session threads, each running an agent drawn from the `agents`\nroster."
+          description: `Coordinator roster. A bare string agent id is equivalent to {type: "agent", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: "self"} refers to this agent. Specify a concrete version to pin it explicitly.`
         },
         {
           name: "skills",
@@ -234,7 +234,7 @@ across all toolsets allowed.`
     resource: "agent.agents",
     method: "retrieve",
     summary: "Get agent",
-    description: "Read one agent by id. The top level is the latest saved version, the editable head whose version you send back for optimistic concurrency; after a save with apply false it differs from active_version, and new sessions use active_version, which you read with version=active. With version, read a specific saved version. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so it can be sent back unchanged to agents.update. Use agents.versions.list to enumerate versions.",
+    description: "Read the agent configuration currently effective for new sessions. By default, version equals active_version and latest_version identifies the newest saved version, including an unapplied save. Use latest_version for optimistic concurrency when updating. Pass version as a positive integer to read that saved version; version=active is equivalent to omission. The response lists every native tool with its resolved configuration in one agent_toolset_20260401 entry, so tools can be sent back unchanged to agents.update. Use agents.versions.list to enumerate saved versions.",
     http: "GET",
     path: "/agent/v1/agents/{agent_id}",
     streaming: "no",
@@ -251,7 +251,7 @@ across all toolsets allowed.`
         name: "version",
         type: "number",
         required: false,
-        description: "Agent version to read; omit for the latest saved version. An integer of at least 1 (versions are listed by agents.versions.list), or the string active for the version new sessions use."
+        description: "Agent version to read. Omit, or send active, for the currently effective version used by new sessions. Send an integer of at least 1 from agents.versions.list to read that saved version. The default response also includes latest_version, the newest saved version number."
       }
     ]
   },
@@ -259,7 +259,7 @@ across all toolsets allowed.`
     resource: "agent.agents",
     method: "update",
     summary: "Update agent",
-    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version. apply defaults to true and moves active_version to the new version, or to the latest when configuration is unchanged; apply false saves without applying. version_note optionally records up to 280 characters on a newly created version; null means no note, and a note sent when the request changes nothing else returns 400 because a note is stored only with a new version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400.",
+    description: "Save configuration changes as a new immutable version. Send latest_version from a default retrieve or update response as the request version for optimistic concurrency; a stale value returns 409. apply defaults to true and makes the new version effective; apply false saves without changing active_version. The response contains the effective configuration, with version equal to active_version and latest_version naming the newest saved version. An unchanged configuration, including a note-only update, is a no-op returning 200 and the current effective version without creating or activating a version. version_note records up to 280 characters only when a configuration change creates a new version; null is equivalent to omission. Use agents.versions.apply to activate an existing saved version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. tools: [] removes every tool, while tools: null returns 400 (tools cannot be null; send [] to remove every tool). On update, omit skills to keep them, send an array to replace them, or send [] or null to clear them. skills attaches uploaded custom skills as [{type: \"custom\", skill_id, version?}] (skill_id from skills.create or skills.list; at most 20, no repeated skill_id). Omit version, or send \"latest\", to use the skill's newest version when a session starts. type anthropic returns 400.",
     http: "POST",
     path: "/agent/v1/agents/{agent_id}",
     streaming: "no",
@@ -306,7 +306,7 @@ to 64 chars each) with values up to 512 chars.`
           name: "multiagent",
           type: "object",
           required: false,
-          description: "A coordinator topology: the session's primary thread orchestrates\nwork by spawning session threads, each running an agent drawn from the `agents`\nroster."
+          description: `Coordinator roster. A bare string agent id is equivalent to {type: "agent", id}; omitting its version pins the referenced agent's current saved version when this roster is saved. {type: "self"} refers to this agent. Specify a concrete version to pin it explicitly.`
         },
         {
           name: "name",
@@ -340,22 +340,19 @@ toolsets allowed.`
           name: "version",
           type: "number",
           required: false,
-          description: `The agent's current version, used to prevent concurrent overwrites.
-Obtain this value from a create or retrieve response. Must be at least 1 if
-specified. When supplied, the request fails if it does not match the server's
-current version; omit to apply the update unconditionally.`
+          description: "Newest saved version used for optimistic concurrency. Obtain latest_version from the default retrieve or update response, or version from versions.list. A stale value returns 409; omit for an unconditional update."
         },
         {
           name: "apply",
           type: "boolean",
           required: false,
-          description: "Defaults to true: apply the newly saved version, or the latest version when configuration is unchanged. Set false to save without changing active_version. Unlike Managed Agents, saving and applying can be separate."
+          description: "Defaults to true: apply a newly saved configuration version. Set false to save without changing active_version. An unchanged configuration is a no-op, including note-only updates; use versions.apply to activate a saved version."
         },
         {
           name: "version_note",
           type: "string",
           required: false,
-          description: "Optional change explanation stored as note on the new immutable version, up to 280 characters. Omission or null stores no note. A note sent when nothing else changes returns 400 (nothing to save), because a note is stored only with a new version."
+          description: "Optional change explanation, at most 280 characters. Recorded only when a configuration change creates a new immutable version. A note-only update is a no-op returning 200 and the current effective version. Null is equivalent to omission."
         },
         {
           name: "bindings",
@@ -857,202 +854,6 @@ Idempotent. Access tokens revoked while the customer was blocked stay revoked; s
     ],
     query: []
   },
-  {
-    resource: "agent.agents.endUsers",
-    method: "list",
-    summary: "List End Users",
-    description: `List users who have sessions or token issuance history on a service agent.
-
-Ordered by last_active_at and external_user_id descending. q is a case-sensitive literal prefix, including underscores. limit is 1–100, default 20. Reuse next_page with the same organization, agent, q and limit. Preemptively blocked users without history do not appear. End-user credentials and inaccessible or personal agents return 404.`,
-    http: "GET",
-    path: "/agent/v1/agents/{agent_id}/end_users",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      }
-    ],
-    query: [
-      {
-        name: "limit",
-        type: "integer",
-        required: false,
-        description: "Maximum users per page; defaults to 20."
-      },
-      {
-        name: "page",
-        type: "string",
-        required: false,
-        description: "next_page from the previous response with the same agent, q and limit."
-      },
-      {
-        name: "q",
-        type: "string",
-        required: false,
-        description: "Case-sensitive literal prefix of external_user_id; omit or use an empty string for all users."
-      }
-    ]
-  },
-  {
-    resource: "agent.agents.endUsers",
-    method: "delete",
-    summary: "Delete end-user data",
-    description: `Delete a host application's end-user data from one service agent after explicit confirmation.
-
-Develop only. Set confirm to the exact external_user_id; missing or mismatched confirmation returns 400. Returns 202 with a pending task id, not completion. Poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the user is blocked before a seven-day recovery snapshot is verified. Sessions including child sessions, conversation data, grants and feedback are then removed. A pre-existing block remains; a temporary block is removed on success. Attachment metadata is recorded and File attachments are retained. No charge is introduced by this operation. Example: DELETE /agent/v1/agents/agent_example/end_users/customer_123?confirm=customer_123.`,
-    http: "DELETE",
-    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      },
-      {
-        name: "external_user_id",
-        sdkName: "external_user_id",
-        description: "Host user identifier supplied at issuance or from end-user listing."
-      }
-    ],
-    query: [
-      {
-        name: "confirm",
-        type: "string",
-        required: true,
-        description: "Must exactly equal the external_user_id path parameter to confirm destructive deletion."
-      }
-    ]
-  },
-  {
-    resource: "agent.agents.endUsers",
-    method: "retrieve",
-    summary: "Get End User",
-    description: `Inspect one end user and their twenty most recently updated sessions.
-
-Use external_user_id from listing or your host application. Users without session or issuance history return 404, including preemptively blocked users. End-user credentials and inaccessible or personal agents return 404.`,
-    http: "GET",
-    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      },
-      {
-        name: "external_user_id",
-        sdkName: "external_user_id",
-        description: "Host user identifier supplied at issuance or from end-user listing."
-      }
-    ],
-    query: []
-  },
-  {
-    resource: "agent.agents.endUsers.block",
-    method: "create",
-    summary: "Block End User",
-    description: `Block token issuance and session creation, then revoke existing tokens for an end user.
-
-May block a user before any history exists; timestamps are then null and counts and cost are zero. Requires an embed policy, otherwise returns 409 with setup guidance. Deduplicates the policy blocklist and retains its 1000-user maximum. If revocation returns 502, the user remains blocked; retry to finish revocation. Repeats keep the user blocked and revoke any remaining grants. End-user credentials and inaccessible or personal agents return 404.`,
-    http: "POST",
-    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      },
-      {
-        name: "external_user_id",
-        sdkName: "external_user_id",
-        description: "Host user identifier supplied at issuance or from end-user listing."
-      }
-    ],
-    query: []
-  },
-  {
-    resource: "agent.agents.endUsers",
-    method: "retrieveDeletion",
-    summary: "Get end-user deletion",
-    description: `Poll the latest deletion task for an end user, including after the user data has been removed.
-
-Use the same agent_id and external_user_id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. A failed task remains blocked and resumes when DELETE is retried with matching confirmation. snapshot_key is an operator recovery reference retained for seven days, not a public download URL. End-user credentials, inaccessible or personal agents, and missing tasks return 404. This read does not create a task or charge usage.`,
-    http: "GET",
-    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      },
-      {
-        name: "external_user_id",
-        sdkName: "external_user_id",
-        description: "Host user identifier supplied at issuance or from end-user listing."
-      }
-    ],
-    query: []
-  },
-  {
-    resource: "agent.agents.endUsers.revokeTokens",
-    method: "create",
-    summary: "Revoke End User Tokens",
-    description: `Revoke all issued tokens for an end user and terminate their open embed streams.
-
-Revokes credentials before marking grants revoked. Upstream failure returns 502 without changing grant revocation timestamps. Returns the count of newly revoked grants; a repeat without new grants returns zero. Does not block future issuance. End-user credentials and inaccessible or personal agents return 404.`,
-    http: "POST",
-    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      },
-      {
-        name: "external_user_id",
-        sdkName: "external_user_id",
-        description: "Host user identifier supplied at issuance or from end-user listing."
-      }
-    ],
-    query: []
-  },
-  {
-    resource: "agent.agents.endUsers.unblock",
-    method: "create",
-    summary: "Unblock End User",
-    description: `Allow an end user to receive new tokens and create new sessions again.
-
-Removes the user from the blocklist; previously revoked tokens stay revoked. Idempotent. Requires an embed policy, otherwise returns 409 with setup guidance. Returns null timestamps and zero counts and cost when no session or issuance history exists. End-user credentials and inaccessible or personal agents return 404.`,
-    http: "POST",
-    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "agent_id",
-        sdkName: "agent_id",
-        description: "Active service agent identifier from agent creation or listing."
-      },
-      {
-        name: "external_user_id",
-        sdkName: "external_user_id",
-        description: "Host user identifier supplied at issuance or from end-user listing."
-      }
-    ],
-    query: []
-  },
   {
     resource: "agent.agents.unarchive",
     method: "create",
@@ -1075,7 +876,7 @@ Removes the user from the blocklist; previously revoked tokens stay revoked. Ide
     resource: "agent.agents.versions",
     method: "list",
     summary: "List agent versions",
-    description: "List the saved versions of one agent, in pages of at most 100 (default 20). Each item is the full agent definition at that version, so you can compare what changed between versions. active is true only for the item that new sessions use; active_version on each item is the agent-level value, kept for compatibility. Use agents.retrieve with version to read a single one; agent_id comes from agents.list or agents.create.",
+    description: "List the saved versions of one agent in ascending version number, oldest first, in pages of at most 100 (default 20). Each item is the full agent definition at that saved version, so you can compare configurations. active is true only for the item new sessions use. active_version on every item is the same agent-level currently effective version; it is not that item's version. Use agents.retrieve with version to read a single saved version; agent_id comes from agents.list or agents.create. Pass next_page as page to continue.",
     http: "GET",
     path: "/agent/v1/agents/{agent_id}/versions",
     streaming: "no",
@@ -1106,7 +907,7 @@ Removes the user from the blocklist; previously revoked tokens stay revoked. Ide
     resource: "agent.agents.versions",
     method: "apply",
     summary: "Apply Agent Version",
-    description: "Apply a version from agents.versions.list by its version number. This idempotent operation changes active_version without creating a version; existing sessions and tokens keep their version. The response is the latest saved agent with its current active_version. Missing versions return 404 Agent version not found; archived agents return 409 Agent is archived. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.",
+    description: "Apply a saved version from agents.versions.list for new sessions and newly issued tokens, without creating a version. Existing sessions and tokens retain their version. The response contains the effective configuration with version equal to active_version and latest_version naming the newest saved version. Missing versions return 404; archived agents return 409. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.",
     http: "POST",
     path: "/agent/v1/agents/{agent_id}/versions/{version}/apply",
     streaming: "no",
@@ -1883,214 +1684,6 @@ null to clear. Maximum 50.`
     ],
     query: []
   },
-  {
-    resource: "agent.embed",
-    method: "retrieveAppearance",
-    summary: "Read chat appearance",
-    description: "Load saved appearance for an iframe or Hosted chat page. Supply an end-user embed token as Bearer authorization, or a console-issued publishable key in Praxis-Publishable-Key before anonymous token issuance. The credential selects the agent; identity_number and agent_id query parameters are rejected with 400. Missing appearance returns an empty object. Kit option names retain camelCase. Responses are private and cacheable for 60 seconds. Component hosts configure Kit in their own code instead.",
-    http: "GET",
-    path: "/agent/v1/embed/appearance",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: []
-  },
-  {
-    resource: "agent.embed.exchange",
-    method: "create",
-    summary: "Exchange Hosted Code",
-    description: `Redeem a single-use hosted link credential for an end-user token.
-
-Read code from the c fragment parameter of hosted_url returned by embed token creation with hosted true, then remove the fragment before exchanging. No Authorization header is required; the code authenticates this request. The code expires after 60 seconds and is consumed atomically on exchange, so concurrent attempts have only one winner. Expired, used and unknown codes return the same 404 body. Keep the token in memory and return to the host website for a fresh link when it expires; exchange cannot refresh it. Requests are IP limited per minute using the anonymous entrypoint budget (default 20). Example body is {"code":"<code from hosted_url>"}.`,
-    http: "POST",
-    path: "/agent/v1/embed/exchange",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: [],
-    body: {
-      required: true,
-      fields: [
-        {
-          name: "code",
-          type: "string",
-          required: true,
-          description: "Single-use credential from the c fragment parameter of hosted_url returned by embed token creation. Valid for 60 seconds."
-        }
-      ]
-    }
-  },
-  {
-    resource: "agent.embedTokens",
-    method: "list",
-    summary: "List Embed Tokens",
-    description: `List embed token issuance records in your organization.
-
-Includes expired and revoked grants; returns neither token nor token_id. Sorts by created_at, then grant id, both descending. agent_id accepts agent_ or agt_; external_user_id matches exactly. limit is 1–100 (default 20). Reuse next_page as page with the same filters and organization; a mismatch returns 400. End-user credentials return 404.`,
-    http: "GET",
-    path: "/agent/v1/embed_tokens",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: [
-      {
-        name: "agent_id",
-        type: "string",
-        required: false,
-        description: "Filter by service agent identifier (agent_ or agt_ prefix)."
-      },
-      {
-        name: "external_user_id",
-        type: "string",
-        required: false,
-        description: "Exact host user identifier supplied at issuance."
-      },
-      {
-        name: "limit",
-        type: "integer",
-        required: false,
-        description: "Maximum records per page; defaults to 20."
-      },
-      {
-        name: "page",
-        type: "string",
-        required: false,
-        description: "next_page from a previous response with the same filters."
-      }
-    ]
-  },
-  {
-    resource: "agent.embedTokens",
-    method: "create",
-    summary: "Create Embed Token",
-    description: `Issue a short-lived credential on your backend for an end user of a service agent.
-
-Requires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. Set hosted to true to also receive hosted_url; redirect the user there within 60 seconds. The agent must have an identity_number. The URL fragment contains a single-use exchange credential, not the token. Omit hosted or set false for ordinary token issuance.`,
-    http: "POST",
-    path: "/agent/v1/embed_tokens",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: [],
-    body: {
-      required: true,
-      fields: [
-        {
-          name: "hosted",
-          type: "boolean",
-          required: false,
-          description: "Set true to also return a hosted chat URL with a single-use credential valid for 60 seconds. Defaults to false; the agent must have an identity_number."
-        },
-        {
-          name: "agent",
-          type: "string",
-          required: true,
-          description: "Service agent ID or identity_number from agent retrieval; it must belong to your organization and be active."
-        },
-        {
-          name: "version",
-          type: "integer",
-          required: false,
-          description: "Existing agent version to pin. Omit to pin the latest version at issuance."
-        },
-        {
-          name: "external_user_id",
-          type: "string",
-          required: true,
-          description: "Your application's stable end-user identifier, scoped to this organization and agent."
-        },
-        {
-          name: "ttl_seconds",
-          type: "integer",
-          required: false,
-          description: "Token lifetime in seconds. Defaults to the embed policy TTL and cannot exceed its maximum or 3600 seconds."
-        },
-        {
-          name: "budget_cents",
-          type: "integer",
-          required: false,
-          description: "Session budget in cents. Defaults to the embed policy session budget and cannot exceed its maximum."
-        },
-        {
-          name: "system_message",
-          type: "array",
-          itemType: "object",
-          required: false,
-          description: "Optional host context as text blocks, limited to 8192 UTF-8 bytes in total."
-        },
-        {
-          name: "agent_override",
-          type: "object",
-          required: false,
-          description: "Optional system prompt override, accepted only when the embed policy allows agent overrides."
-        },
-        {
-          name: "allowed_origins",
-          type: "array",
-          itemType: "string",
-          required: false,
-          description: "Optional subset of the policy origin entries, compared exactly. Omit to snapshot every policy origin."
-        },
-        {
-          name: "metadata",
-          type: "object",
-          required: false,
-          description: "Host metadata preserved verbatim; at most 16 keys of 1–64 characters and string values of at most 512 characters. Defaults to an empty object."
-        }
-      ]
-    }
-  },
-  {
-    resource: "agent.embedTokens.anonymous",
-    method: "create",
-    summary: "Issue anonymous visitor token",
-    description: `Obtain a short-lived embedding token for a visitor without an account using the agent owner's publishable key.
-
-No Authorization header is required. Send the browser Origin allowed by the agent policy. Save a returned visitor_secret and reuse it for refreshes; only new visitors receive one. Unknown secrets create new visitors, and extra fields including visitor_id return 400. Issuance uses the key creator's organization membership, the key session budget and the smaller of the policy TTL maximum and 3600 seconds. IP requests are limited per minute (default 20); UTC daily session and spending caps are checked across the key's primary sessions created that day. Token issuance itself does not create a session or charge usage; subsequent sessions bill the host organization. Example body: {"publishable_key":"pk_praxis_example"}.`,
-    http: "POST",
-    path: "/agent/v1/embed_tokens/anonymous",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: [],
-    body: {
-      required: true,
-      fields: [
-        {
-          name: "publishable_key",
-          type: "string",
-          required: true,
-          description: "Public key created by the service agent owner; safe to include in browser code."
-        },
-        {
-          name: "visitor_secret",
-          type: "string",
-          required: false,
-          description: "Secret returned by a previous anonymous issuance for this key. Omit for a new visitor; an unknown secret creates a new visitor."
-        }
-      ]
-    }
-  },
-  {
-    resource: "agent.embedTokens.revoke",
-    method: "create",
-    summary: "Revoke Embed Token",
-    description: `Revoke an embed token and close its open event streams.
-
-Use an id from issuance or listing. Revokes the credential before setting revoked_at; upstream failure leaves it unset. Streams receive session.error (EMBED_TOKEN_REVOKED), then close immediately; other credentials are unaffected. Idempotent; repeats return the original revoked record without another revocation or audit. Missing or foreign grants and end-user credentials return 404.`,
-    http: "POST",
-    path: "/agent/v1/embed_tokens/{id}/revoke",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
-      {
-        name: "id",
-        sdkName: "id",
-        description: "Grant id returned by issuance or listing."
-      }
-    ],
-    query: []
-  },
   {
     resource: "agent.environments",
     method: "list",
@@ -18551,97 +18144,6 @@ var setRunFeedback = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
-var listEndUsers = (options) => (options.client ?? client).get({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users",
-  ...options
-});
-var deleteEndUser = (options) => (options.client ?? client).delete({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
-  ...options
-});
-var getEndUser = (options) => (options.client ?? client).get({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
-  ...options
-});
-var getEndUserDeletion = (options) => (options.client ?? client).get({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
-  ...options
-});
-var revokeEndUserTokens = (options) => (options.client ?? client).post({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
-  ...options
-});
-var blockEndUser = (options) => (options.client ?? client).post({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
-  ...options
-});
-var unblockEndUser = (options) => (options.client ?? client).post({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
-  ...options
-});
 var listCustomers = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
@@ -18797,65 +18299,6 @@ var deleteCurrentCustomerAccessToken = (options) => (options.client ?? client).d
   url: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens/current",
   ...options
 });
-var exchangeEmbedCode = (options) => (options.client ?? client).post({
-  url: "/agent/v1/embed/exchange",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
-});
-var createAnonymousEmbedToken = (options) => (options.client ?? client).post({
-  url: "/agent/v1/embed_tokens/anonymous",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
-});
-var listEmbedTokens = (options) => (options?.client ?? client).get({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/embed_tokens",
-  ...options
-});
-var createEmbedToken = (options) => (options.client ?? client).post({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/embed_tokens",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
-});
-var revokeEmbedToken = (options) => (options.client ?? client).post({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, {
-    key: "ApiKeyAuth",
-    name: "X-API-Key",
-    type: "apiKey"
-  }],
-  url: "/agent/v1/embed_tokens/{id}/revoke",
-  ...options
-});
 var computersList = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
@@ -19154,15 +18597,6 @@ var listSessionCompactions = (options) => (options.client ?? client).get({
   url: "/agent/v1/sessions/{session_id}/compactions",
   ...options
 });
-var getEmbedAppearance = (options) => (options?.client ?? client).get({
-  security: [{
-    key: "BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }, { name: "Praxis-Publishable-Key", type: "apiKey" }],
-  url: "/agent/v1/embed/appearance",
-  ...options
-});
 var createAudioSpeech = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
@@ -24540,21 +23974,6 @@ function createAgent(transport) {
           create: bind(transport, unblockCustomer)
         }
       },
-      endUsers: {
-        block: {
-          create: bind(transport, blockEndUser)
-        },
-        delete: bind(transport, deleteEndUser),
-        list: bind(transport, listEndUsers),
-        retrieve: bind(transport, getEndUser),
-        retrieveDeletion: bind(transport, getEndUserDeletion),
-        revokeTokens: {
-          create: bind(transport, revokeEndUserTokens)
-        },
-        unblock: {
-          create: bind(transport, unblockEndUser)
-        }
-      },
       list: bind(transport, agentsList),
       retrieve: bind(transport, agentsRetrieve),
       retrieveAppearance: bind(transport, getAgentAppearance),
@@ -24607,22 +24026,6 @@ function createAgent(transport) {
       },
       update: bind(transport, deploymentsUpdate)
     },
-    embed: {
-      exchange: {
-        create: bind(transport, exchangeEmbedCode)
-      },
-      retrieveAppearance: bind(transport, getEmbedAppearance)
-    },
-    embedTokens: {
-      anonymous: {
-        create: bind(transport, createAnonymousEmbedToken)
-      },
-      create: bind(transport, createEmbedToken),
-      list: bind(transport, listEmbedTokens),
-      revoke: {
-        create: bind(transport, revokeEmbedToken)
-      }
-    },
     environments: {
       archive: bind(transport, environmentsArchive),
       create: bind(transport, environmentsCreate),
@@ -27391,7 +26794,7 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.1.1-dev.c64b603";
+var version = "0.1.1-dev.d775f1e";
 var commands = commandTree(operations);
 var manual = [["login"], ["logout"], ["whoami"], ["org", "list"], ["org", "switch"], ["api"], ["skill"]];
 function route(argv) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepraxis/cli",
-  "version": "0.1.1-dev.c64b603",
+  "version": "0.1.1-dev.d775f1e",
   "type": "module",
   "bin": {
     "praxis": "dist/praxis.js"