@lightspeed-ai/agent-client 0.1.0

package/src/generated/methods.ts

@@ -0,0 +1,2888 @@
+/*
+ * Generated by clients/typescript/scripts/generate.mjs.
+ * Do not edit by hand.
+ */
+import type * as Api from "./types.js";
+
+export const METHODS = [
+  "initialize",
+  "session/start",
+  "session/managed/start",
+  "session/read",
+  "session/list",
+  "session/config/put",
+  "session/rename",
+  "session/close",
+  "session/delete",
+  "session/events/read",
+  "session/context/append",
+  "session/context/remove",
+  "session/context/compact",
+  "session/runs/start",
+  "session/runs/list",
+  "session/runs/read",
+  "session/runs/cancel",
+  "session/runs/approvals/decide",
+  "session/runs/steer",
+  "session/skills/list",
+  "session/skills/active",
+  "session/skills/activate",
+  "session/skills/deactivate",
+  "session/profiles/apply",
+  "session/environments/activate",
+  "session/environments/deactivate",
+  "environments/credentials/bind",
+  "environments/credentials/list",
+  "environments/credentials/unbind",
+  "environments/create",
+  "environments/read",
+  "environments/list",
+  "environments/close",
+  "environments/external/create",
+  "environments/ingress/put",
+  "environments/power/put",
+  "environments/idle-policy/put",
+  "environments/provider-bindings/list",
+  "environments/provider-bindings/read",
+  "environments/templates/list",
+  "environments/templates/read",
+  "environments/jobs/create",
+  "environments/jobs/read",
+  "environments/jobs/cancel",
+  "models/list",
+  "profiles/create",
+  "profiles/read",
+  "profiles/list",
+  "profiles/put",
+  "profiles/delete",
+  "blobs/put",
+  "blobs/read",
+  "blobs/has",
+  "vfs/snapshots/commit",
+  "vfs/snapshots/read",
+  "vfs/workspaces/create",
+  "vfs/workspaces/read",
+  "vfs/workspaces/list",
+  "vfs/workspaces/update",
+  "vfs/workspaces/delete",
+  "mcp/servers/put",
+  "mcp/servers/auth/discover",
+  "mcp/servers/tools/discover",
+  "mcp/servers/read",
+  "mcp/servers/list",
+  "mcp/servers/delete",
+  "auth/grants/import",
+  "auth/grants/lease",
+  "auth/grants/read",
+  "auth/grants/list",
+  "auth/grants/revoke",
+  "auth/clients/create",
+  "auth/clients/read",
+  "auth/clients/list",
+  "auth/clients/delete",
+  "auth/flows/start",
+  "auth/flows/read",
+  "auth/providers/create",
+  "auth/providers/read",
+  "auth/providers/list",
+  "auth/providers/delete",
+  "auth/github/installations/list",
+  "auth/github/installations/grant",
+  "bots/create",
+  "bots/put",
+  "bots/read",
+  "bots/list",
+  "bots/close",
+  "bots/delete",
+  "bots/state/read",
+  "bots/sessions/rotate",
+  "bots/triggers/put",
+  "bots/triggers/read",
+  "bots/triggers/list",
+  "bots/triggers/delete",
+  "bots/events/admit",
+  "bots/events/replay",
+  "bots/events/list",
+  "bots/events/read",
+  "bots/filters/test",
+  "channels/accounts/create",
+  "channels/accounts/put",
+  "channels/accounts/read",
+  "channels/accounts/list",
+  "channels/accounts/delete",
+  "channels/inbound/admit",
+  "channels/pairings/list",
+  "channels/pairings/delete",
+  "channels/conversations/read",
+  "operator/universes/create",
+  "operator/universes/list",
+  "operator/universes/read",
+  "operator/universes/delete",
+  "operator/api-keys/create",
+  "operator/api-keys/list",
+  "operator/api-keys/revoke",
+  "operator/environment-providers/put",
+  "operator/environment-providers/list",
+  "operator/environment-providers/read",
+  "operator/environment-providers/delete",
+  "operator/environment-providers/bindings/put",
+  "operator/environment-providers/bindings/delete",
+  "operator/environments/adopt",
+  "operator/channels/accounts/list",
+] as const;
+
+export const METHOD_INFO = {
+  "initialize": {
+    scope: "universe",
+    summary: "Inspect the Lightspeed protocol",
+    description: "Returns protocol version, server identity, and supported capabilities without changing universe state.",
+  },
+  "session/start": {
+    scope: "universe",
+    summary: "Create or reopen a session",
+    description: "Creates a session with optional config/profile setup. Retrying an existing session id returns that session; creation settings apply only when it is first created.",
+  },
+  "session/managed/start": {
+    scope: "universe",
+    summary: "Create or reopen a managed session",
+    description: "Creates a session with an immutable lifecycle controller and/or workflow tools using explicit bound pull/push dispatch, start targets, and Accepted, Joined, or keyed-Promise completion. Retrying an existing session id requires the same managed-creation declaration; an ordinary session cannot be upgraded to managed.",
+  },
+  "session/read": {
+    scope: "universe",
+    summary: "Read a session",
+    description: "Returns current state plus a bounded newest-first run-summary page. Follow nextRunCursor with session/runs/list when hasOlderRuns is true; use session/events/read for the transcript.",
+  },
+  "session/list": {
+    scope: "universe",
+    summary: "List sessions",
+    description: "Returns a cursor-paginated summary list ordered by most recent update. Pages may shift while sessions are changing.",
+  },
+  "session/config/put": {
+    scope: "universe",
+    summary: "Replace session configuration",
+    description: "Replaces the complete sparse config while the session is idle. Use the current config revision for safe read-modify-write; omitted features are revoked and an identical document is a no-op.",
+  },
+  "session/rename": {
+    scope: "universe",
+    summary: "Rename a session",
+    description: "Sets the display name, or clears it when displayName is omitted.",
+  },
+  "session/close": {
+    scope: "universe",
+    summary: "Close a session",
+    description: "Closes an idle session and detaches its environment bindings. Force mode cancels active work, drops queued runs, and can recover a session whose workflow is unavailable.",
+  },
+  "session/delete": {
+    scope: "universe",
+    summary: "Delete a closed session",
+    description: "Permanently removes session storage after the session has been closed; close active/open sessions first.",
+  },
+  "session/events/read": {
+    scope: "universe",
+    summary: "Read the session event stream",
+    description: "Reads events after a cursor and optionally long-polls when caught up. Continue from nextCursor/headCursor and inspect complete/gap rather than assuming an uninterrupted page.",
+  },
+  "session/context/append": {
+    scope: "universe",
+    summary: "Append keyed session context",
+    description: "Admits a batch of context entries with per-entry results. Stable keys make same-content retries no-ops; media preprocessing can fail one entry without discarding successful entries.",
+  },
+  "session/context/remove": {
+    scope: "universe",
+    summary: "Remove keyed session context",
+    description: "Removes active entries by stable key with per-key results. Missing keys are idempotent no-ops; runtime-reserved run keys cannot be removed.",
+  },
+  "session/context/compact": {
+    scope: "universe",
+    summary: "Compact session context",
+    description: "Runs the configured compaction policy on an open idle session and waits for the resulting context revision.",
+  },
+  "session/runs/start": {
+    scope: "universe",
+    summary: "Start an agent run",
+    description: "Accepts input or existing context keys and returns once the run is accepted — queued behind an active run, or running — not when it finishes. Supply submissionId for retry safety, then follow session events or reread the session.",
+  },
+  "session/runs/list": {
+    scope: "universe",
+    summary: "List session runs",
+    description: "Returns a newest-first keyset page of bounded run summaries projected from current reducer state.",
+  },
+  "session/runs/read": {
+    scope: "universe",
+    summary: "Read one session run",
+    description: "Reads and projects one run from its bounded event interval, paged by event sequence.",
+  },
+  "session/runs/cancel": {
+    scope: "universe",
+    summary: "Cancel a run",
+    description: "Requests cancellation of the named queued or active run and returns its current projected state; observe session events for terminal completion. In-flight model and tool activity is aborted; no grace turn runs.",
+  },
+  "session/runs/approvals/decide": {
+    scope: "universe",
+    summary: "Decide pending run approvals",
+    description: "Approves or rejects pending MCP tool calls on the named active run. Valid decisions apply independently; the run resumes only after every pending approval has a decision.",
+  },
+  "session/runs/steer": {
+    scope: "universe",
+    summary: "Steer the active run",
+    description: "Injects input into the named active run; the model sees it at the next turn boundary without interrupting the in-flight turn. Accepted while the run is running or parked on an await; rejected for queued, cancelling, or finished runs.",
+  },
+  "session/skills/list": {
+    scope: "universe",
+    summary: "List available session skills",
+    description: "Refreshes the session's configured VFS skill catalog and reports which discovered skills are enabled and active. An absent catalog yields an empty result.",
+  },
+  "session/skills/active": {
+    scope: "universe",
+    summary: "List active session skills",
+    description: "Returns skill instructions currently injected into context, including activation scope and source.",
+  },
+  "session/skills/activate": {
+    scope: "universe",
+    summary: "Activate a session skill",
+    description: "Loads an enabled skill from the current catalog and injects its instructions into an open idle session. Run-scoped activation is the default.",
+  },
+  "session/skills/deactivate": {
+    scope: "universe",
+    summary: "Deactivate a session skill",
+    description: "Removes an active skill's injected context from an open idle session; the skill must currently be active.",
+  },
+  "session/profiles/apply": {
+    scope: "universe",
+    summary: "Apply a profile to a session",
+    description: "Applies a named or inline profile's config, instructions, and environment setup to an existing session; mutating profile sections require it to be open and idle. Pass current revisions to guard concurrent changes.",
+  },
+  "session/environments/activate": {
+    scope: "universe",
+    summary: "Activate a session environment",
+    description: "Selects an allowed, live universe environment for environment-targeted tools while the session is idle.",
+  },
+  "session/environments/deactivate": {
+    scope: "universe",
+    summary: "Deactivate the session environment",
+    description: "Clears active environment selection without changing or closing the universe environment.",
+  },
+  "environments/credentials/bind": {
+    scope: "universe",
+    summary: "Bind a credential into an environment",
+    description: "Maps an environment variable name to an existing grant/provider/direct-secret handle for a universe environment. The response exposes only the source handle, never secret material.",
+  },
+  "environments/credentials/list": {
+    scope: "universe",
+    summary: "List environment credential bindings",
+    description: "Returns variable names and credential source handles for a universe environment; resolved secret values are never returned.",
+  },
+  "environments/credentials/unbind": {
+    scope: "universe",
+    summary: "Unbind an environment credential",
+    description: "Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret.",
+  },
+  "environments/create": {
+    scope: "universe",
+    summary: "Create an environment",
+    description: "Records an idempotent provisioning intent against an enabled universe binding. The provider validates its provider-wide template and provisions through its backend asynchronously.",
+  },
+  "environments/read": {
+    scope: "universe",
+    summary: "Read an environment",
+    description: "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.",
+  },
+  "environments/list": {
+    scope: "universe",
+    summary: "List environments",
+    description: "Lists universe-owned environment resources, optionally filtered by provider, binding, or logical lifecycle state.",
+  },
+  "environments/close": {
+    scope: "universe",
+    summary: "Close an environment",
+    description: "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.",
+  },
+  "environments/external/create": {
+    scope: "universe",
+    summary: "Register an external environment",
+    description: "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint. Reachability is checked on demand.",
+  },
+  "environments/ingress/put": {
+    scope: "universe",
+    summary: "Configure environment public ingress",
+    description: "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.",
+  },
+  "environments/power/put": {
+    scope: "universe",
+    summary: "Set environment power intent",
+    description: "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.",
+  },
+  "environments/idle-policy/put": {
+    scope: "universe",
+    summary: "Set environment idle policy",
+    description: "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.",
+  },
+  "environments/provider-bindings/list": {
+    scope: "universe",
+    summary: "List environment provider bindings",
+    description: "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.",
+  },
+  "environments/provider-bindings/read": {
+    scope: "universe",
+    summary: "Read an environment provider binding",
+    description: "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.",
+  },
+  "environments/templates/list": {
+    scope: "universe",
+    summary: "List environment templates",
+    description: "Reads immutable templates directly from the selected bound provider controller.",
+  },
+  "environments/templates/read": {
+    scope: "universe",
+    summary: "Read an environment template",
+    description: "Returns one immutable template version from the selected bound provider controller.",
+  },
+  "environments/jobs/create": {
+    scope: "universe",
+    summary: "Create environment jobs",
+    description: "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.",
+  },
+  "environments/jobs/read": {
+    scope: "universe",
+    summary: "Read environment jobs",
+    description: "Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.",
+  },
+  "environments/jobs/cancel": {
+    scope: "universe",
+    summary: "Cancel environment jobs",
+    description: "Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result.",
+  },
+  "models/list": {
+    scope: "universe",
+    summary: "Discover available models",
+    description: "Queries supported providers directly on every call and returns best-effort selectable routes. One provider failure does not discard successful results from others.",
+  },
+  "profiles/create": {
+    scope: "universe",
+    summary: "Create an agent profile",
+    description: "Creates a new universe-scoped reusable profile document; use profiles/put for create-or-replace revision semantics.",
+  },
+  "profiles/read": {
+    scope: "universe",
+    summary: "Read an agent profile",
+    description: "Returns the complete profile document and current revision.",
+  },
+  "profiles/list": {
+    scope: "universe",
+    summary: "List agent profiles",
+    description: "Returns lightweight summaries of universe-scoped reusable profiles.",
+  },
+  "profiles/put": {
+    scope: "universe",
+    summary: "Create or replace an agent profile",
+    description: "Stores the complete profile document. Use expectedRevision from profiles/read when replacing to prevent lost updates; absence writes unconditionally.",
+  },
+  "profiles/delete": {
+    scope: "universe",
+    summary: "Delete an agent profile",
+    description: "Deletes the catalog document; sessions previously created or configured from it retain their materialized state.",
+  },
+  "blobs/put": {
+    scope: "universe",
+    summary: "Store content-addressed blobs",
+    description: "Decodes and stores a batch of base64 payloads, returning immutable content references in request order. Re-uploading identical bytes is naturally deduplicated.",
+  },
+  "blobs/read": {
+    scope: "universe",
+    summary: "Read a content-addressed blob",
+    description: "Returns the complete immutable blob as base64; large values count against gateway and MCP response limits.",
+  },
+  "blobs/has": {
+    scope: "universe",
+    summary: "Check blob availability",
+    description: "Checks a batch of content references without returning blob bodies, preserving request order.",
+  },
+  "vfs/snapshots/commit": {
+    scope: "universe",
+    summary: "Commit a VFS snapshot",
+    description: "Validates and stores an immutable filesystem manifest. Upload referenced file blobs first; the returned snapshot ref is content-addressed.",
+  },
+  "vfs/snapshots/read": {
+    scope: "universe",
+    summary: "Read a VFS snapshot",
+    description: "Returns an immutable snapshot manifest and aggregate file/byte counts; file bodies remain separate blobs.",
+  },
+  "vfs/workspaces/create": {
+    scope: "universe",
+    summary: "Create a mutable VFS workspace",
+    description: "Creates a universe workspace at an optional seed snapshot; absence starts from a server-created empty snapshot.",
+  },
+  "vfs/workspaces/read": {
+    scope: "universe",
+    summary: "Read a VFS workspace",
+    description: "Returns workspace metadata, current head snapshot, and revision for safe updates.",
+  },
+  "vfs/workspaces/list": {
+    scope: "universe",
+    summary: "List VFS workspaces",
+    description: "Lists mutable universe workspaces with head snapshots, sizes, and revisions.",
+  },
+  "vfs/workspaces/update": {
+    scope: "universe",
+    summary: "Update a VFS workspace",
+    description: "Moves the workspace head to an existing snapshot and updates its display name. Pass expectedRevision from a read to prevent lost updates.",
+  },
+  "vfs/workspaces/delete": {
+    scope: "universe",
+    summary: "Delete a VFS workspace",
+    description: "Deletes the mutable workspace record; immutable snapshots and blobs remain content-addressed resources.",
+  },
+  "mcp/servers/put": {
+    scope: "universe",
+    summary: "Create or replace an MCP server record",
+    description: "Stores the complete universe catalog document, including its optional universe auth-grant credential. Use expectedRevision when replacing; token material is never accepted or returned.",
+  },
+  "mcp/servers/auth/discover": {
+    scope: "universe",
+    summary: "Discover MCP server authentication",
+    description: "Looks for standards-based OAuth protected-resource metadata without creating a server, OAuth client, flow, or grant. An absent OAuth result is inconclusive and callers must allow manual auth selection.",
+  },
+  "mcp/servers/tools/discover": {
+    scope: "universe",
+    summary: "Discover MCP server tools",
+    description: "Connects directly to the configured MCP server with its current universe credential and returns one bounded live tools/list result. The inventory is never persisted or cached and no tool is invoked.",
+  },
+  "mcp/servers/read": {
+    scope: "universe",
+    summary: "Read an MCP server record",
+    description: "Returns one catalog document with defaults, auth policy, non-secret grant binding, status, and revision; no credential value is exposed.",
+  },
+  "mcp/servers/list": {
+    scope: "universe",
+    summary: "List MCP server records",
+    description: "Lists universe catalog entries, optionally filtered by lifecycle/configuration status.",
+  },
+  "mcp/servers/delete": {
+    scope: "universe",
+    summary: "Delete an MCP server record",
+    description: "Deletes the catalog document. Existing session configs that reference it are not silently rewritten and may need explicit reconfiguration.",
+  },
+  "auth/grants/import": {
+    scope: "universe",
+    summary: "Import a static bearer grant",
+    description: "Accepts a plaintext token, encrypts it immediately, and returns only grant metadata/token-presence flags. Brokered is the default; retrievable exposure is immutable and permits service-only leases.",
+  },
+  "auth/grants/lease": {
+    scope: "service",
+    summary: "Lease a retrievable authentication grant",
+    description: "Service callers only. Resolves the current access token through the broker, records the lease, and returns it once. Cache only in memory until expiry minus margin (or at most five minutes without expiry), re-lease after target 401/403, and never persist or place the token in workflow payloads.",
+  },
+  "auth/grants/read": {
+    scope: "universe",
+    summary: "Read authentication grant metadata",
+    description: "Returns principal, provider binding, scopes, audience, expiry, status, and token-presence flags; access and refresh token values are never returned.",
+  },
+  "auth/grants/list": {
+    scope: "universe",
+    summary: "List authentication grants",
+    description: "Lists non-secret grant metadata for the universe, optionally filtered by status.",
+  },
+  "auth/grants/revoke": {
+    scope: "universe",
+    summary: "Revoke an authentication grant",
+    description: "Marks the grant unusable by token consumers while retaining non-secret audit metadata.",
+  },
+  "auth/clients/create": {
+    scope: "universe",
+    summary: "Register an OAuth client",
+    description: "Stores provider endpoints and client identity; an optional plaintext client secret is encrypted and represented thereafter only by hasClientSecret.",
+  },
+  "auth/clients/read": {
+    scope: "universe",
+    summary: "Read OAuth client metadata",
+    description: "Returns endpoints, public client identity, defaults, and secret-presence state; the client secret is never returned.",
+  },
+  "auth/clients/list": {
+    scope: "universe",
+    summary: "List OAuth clients",
+    description: "Lists non-secret OAuth client registrations in the universe.",
+  },
+  "auth/clients/delete": {
+    scope: "universe",
+    summary: "Delete an OAuth client",
+    description: "Deletes the client registration and its stored client secret; grants already created from it remain separate records.",
+  },
+  "auth/flows/start": {
+    scope: "universe",
+    summary: "Start an OAuth authorization flow",
+    description: "Creates a short-lived PKCE flow carrying the immutable grant exposure choice and returns a browser authorization URL containing one-time state. Treat the URL as sensitive and poll auth/flows/read for completion.",
+  },
+  "auth/flows/read": {
+    scope: "universe",
+    summary: "Read OAuth flow status",
+    description: "Polls a flow's pending/completed/failed/expired state and returns the resulting grant id when authorization succeeds; no token value is exposed.",
+  },
+  "auth/providers/create": {
+    scope: "universe",
+    summary: "Register an authentication provider",
+    description: "Creates a model or GitHub credential source. Plaintext API keys/private keys are encrypted on receipt and later represented only by configuration plus hasCredential.",
+  },
+  "auth/providers/read": {
+    scope: "universe",
+    summary: "Read authentication provider metadata",
+    description: "Returns provider kind, non-secret configuration, credential-presence state, and status; stored credentials are never returned.",
+  },
+  "auth/providers/list": {
+    scope: "universe",
+    summary: "List authentication providers",
+    description: "Lists non-secret model/GitHub provider registrations for the universe.",
+  },
+  "auth/providers/delete": {
+    scope: "universe",
+    summary: "Delete an authentication provider",
+    description: "Deletes the provider registration and its directly stored credential; separately stored grants remain independent records.",
+  },
+  "auth/github/installations/list": {
+    scope: "universe",
+    summary: "List GitHub App installations",
+    description: "Uses the registered GitHub App provider credential to query accessible installations and returns account/permission metadata without tokens.",
+  },
+  "auth/github/installations/grant": {
+    scope: "universe",
+    summary: "Grant access to a GitHub App installation",
+    description: "Creates or refreshes a universe auth grant for one accessible installation. The installation token is brokered internally and never returned.",
+  },
+  "bots/create": {
+    scope: "universe",
+    summary: "Create a bot",
+    description: "Creates the bot record, optionally with its triggers, and starts its controller. Fails if the bot id exists; a trigger failure rolls the bot back.",
+  },
+  "bots/put": {
+    scope: "universe",
+    summary: "Create or replace a bot document",
+    description: "Replaces the mutable configuration whole and signals the controller, which applies it at its next idle boundary. Pass expectedRevision when replacing; a closed bot accepts label-only edits.",
+  },
+  "bots/read": {
+    scope: "universe",
+    summary: "Read a bot",
+    description: "Returns the bot record, its current revision, and lifecycle columns.",
+  },
+  "bots/list": {
+    scope: "universe",
+    summary: "List bots",
+    description: "Returns the roster: every bot with its trigger count, pending event count, and latest event.",
+  },
+  "bots/close": {
+    scope: "universe",
+    summary: "Close a bot",
+    description: "Terminal and idempotent: disables every trigger, drops schedules, and tells the controller to archive pending events and force-close its sessions. Returns once signalled; follow bots/state/read for closing to closed.",
+  },
+  "bots/delete": {
+    scope: "universe",
+    summary: "Delete a bot",
+    description: "Closes the bot if needed, waits for its controller to complete, deletes the sessions it closed, and removes the record so the bot id is free again.",
+  },
+  "bots/state/read": {
+    scope: "universe",
+    summary: "Read bot controller state",
+    description: "Queries the controller workflow for its live snapshot (sessions, buffers, active and recent deliveries, budget) and lists sub-agent descendants. The controller is absent until the bot's first event.",
+  },
+  "bots/sessions/rotate": {
+    scope: "universe",
+    summary: "Rotate a bot session",
+    description: "Asks the controller to close one of the bot's sessions at its next idle boundary and continue on a fresh generation; queued deliveries follow.",
+  },
+  "bots/triggers/put": {
+    scope: "universe",
+    summary: "Create or replace a trigger",
+    description: "Validates the trigger document (CEL parses, grants exist, one inbox per bot, chat routes per conversation), reconciles its Temporal Schedule, and stores it. A poll spec edit resets the cursor; a webhook keeps its URL token.",
+  },
+  "bots/triggers/read": {
+    scope: "universe",
+    summary: "Read a trigger",
+    description: "Returns one trigger with its incidents and cursor; the ingest path and pairing code are shown only to managing principals.",
+  },
+  "bots/triggers/list": {
+    scope: "universe",
+    summary: "List a bot's triggers",
+    description: "Returns every trigger of the bot ordered by id, secrets redacted for non-managing principals.",
+  },
+  "bots/triggers/delete": {
+    scope: "universe",
+    summary: "Delete a trigger",
+    description: "Drops the trigger's Temporal Schedule and pairings, then the record; stored events keep their history.",
+  },
+  "bots/events/admit": {
+    scope: "universe",
+    summary: "Admit an event manually",
+    description: "Stores an operator-authored event for the bot's main session and wakes the controller. eventId is the dedupe identity; a duplicate returns the stored row.",
+  },
+  "bots/events/replay": {
+    scope: "universe",
+    summary: "Replay a stored event",
+    description: "Re-admits the stored envelope as a fresh event with the original routing; the replay never coalesces.",
+  },
+  "bots/events/list": {
+    scope: "universe",
+    summary: "List a bot's events",
+    description: "Cursor-paginated event log, newest first, with outcomes; payload documents stay in the CAS.",
+  },
+  "bots/events/read": {
+    scope: "universe",
+    summary: "Read an event by number",
+    description: "Returns the event row and its full stored envelope document.",
+  },
+  "bots/filters/test": {
+    scope: "universe",
+    summary: "Test a CEL filter",
+    description: "Evaluates a filter against one payload or a sample of recent stored events, reporting matches and evaluation errors without changing anything.",
+  },
+  "channels/accounts/create": {
+    scope: "universe",
+    summary: "Create a channel account",
+    description: "Registers a provider account (Telegram, WhatsApp) for this universe. The credential is a retrievable grant reference; no token is accepted here.",
+  },
+  "channels/accounts/put": {
+    scope: "universe",
+    summary: "Create or replace a channel account",
+    description: "Replaces the account document whole; pass expectedRevision when replacing. The connector host picks the change up on its next discovery pass.",
+  },
+  "channels/accounts/read": {
+    scope: "universe",
+    summary: "Read a channel account",
+    description: "Returns the account document and revision.",
+  },
+  "channels/accounts/list": {
+    scope: "universe",
+    summary: "List channel accounts",
+    description: "Lists this universe's provider accounts, optionally by provider.",
+  },
+  "channels/accounts/delete": {
+    scope: "universe",
+    summary: "Delete a channel account",
+    description: "Removes the account and its pairings; chat triggers that reference it stop serving conversations.",
+  },
+  "channels/inbound/admit": {
+    scope: "service",
+    summary: "Admit a provider message",
+    description: "Service callers only. Resolves the chat trigger for the conversation, applies pairing, and signals the conversation workflow. Returns the decision so the connector can send pairing prompts itself; acknowledge the provider only after this returns.",
+  },
+  "channels/pairings/list": {
+    scope: "universe",
+    summary: "List chat pairings",
+    description: "Lists conversations paired to chat triggers, optionally by account or bot.",
+  },
+  "channels/pairings/delete": {
+    scope: "universe",
+    summary: "Unpair a conversation",
+    description: "Removes one pairing; the conversation must present the pairing code again to reconnect.",
+  },
+  "channels/conversations/read": {
+    scope: "universe",
+    summary: "Read a conversation snapshot",
+    description: "Queries the conversation workflow's live state for one chat, for debugging; absent when no workflow exists yet.",
+  },
+  "operator/universes/create": {
+    scope: "operator",
+    summary: "Create a universe",
+    description: "Creates the deployment tenant boundary for an explicit UUID. The operation is idempotent and reports whether a new universe was created.",
+  },
+  "operator/universes/list": {
+    scope: "operator",
+    summary: "List universes",
+    description: "Returns deployment-wide universe summaries with approximate live aggregate counts and last session activity.",
+  },
+  "operator/universes/read": {
+    scope: "operator",
+    summary: "Read a universe",
+    description: "Returns one deployment tenant summary with aggregate session, workspace, profile, and blob usage.",
+  },
+  "operator/universes/delete": {
+    scope: "operator",
+    summary: "Purge a universe",
+    description: "Permanently terminates live session workflows, deletes external blob objects, and cascades universe data. The purge is resumable/idempotent after partial failure.",
+  },
+  "operator/api-keys/create": {
+    scope: "operator",
+    summary: "Create a universe API key",
+    description: "Mints an inbound gateway key for one existing universe. The plaintext secret is returned exactly once and cannot be recovered; persist only the displayed prefix for identification.",
+  },
+  "operator/api-keys/list": {
+    scope: "operator",
+    summary: "List universe API keys",
+    description: "Returns only non-secret key metadata for the requested universe, including revocation and last-use timestamps. Plaintext secrets are never stored or returned.",
+  },
+  "operator/api-keys/revoke": {
+    scope: "operator",
+    summary: "Revoke a universe API key",
+    description: "Immediately and idempotently revokes the matching key only when it belongs to the requested universe. Unknown and foreign-universe prefixes return not found.",
+  },
+  "operator/environment-providers/put": {
+    scope: "operator",
+    summary: "Put an environment provider",
+    description: "Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.",
+  },
+  "operator/environment-providers/list": {
+    scope: "operator",
+    summary: "List environment providers",
+    description: "Returns every operator-registered deployment provider and its controller connection.",
+  },
+  "operator/environment-providers/read": {
+    scope: "operator",
+    summary: "Read an environment provider",
+    description: "Returns one operator-registered deployment provider and its controller connection.",
+  },
+  "operator/environment-providers/delete": {
+    scope: "operator",
+    summary: "Delete an environment provider",
+    description: "Deletes a deployment provider only when no universe binding references it.",
+  },
+  "operator/environment-providers/bindings/put": {
+    scope: "operator",
+    summary: "Put an environment provider binding",
+    description: "Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.",
+  },
+  "operator/environment-providers/bindings/delete": {
+    scope: "operator",
+    summary: "Delete an environment provider binding",
+    description: "Deletes a universe provider binding only after every referencing environment has reached Closed.",
+  },
+  "operator/environments/adopt": {
+    scope: "operator",
+    summary: "Adopt a provider environment",
+    description: "Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.",
+  },
+  "operator/channels/accounts/list": {
+    scope: "operator",
+    summary: "List channel accounts across universes",
+    description: "The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.",
+  },
+} as const;
+
+export const NOTIFICATIONS = [
+  "session/started",
+  "session/status/changed",
+  "session/event",
+  "session/runs/started",
+  "session/runs/completed",
+  "error",
+] as const;
+
+export type Method = (typeof METHODS)[number];
+export type NotificationMethod = (typeof NOTIFICATIONS)[number];
+
+export interface MethodMap {
+  /**
+   * Inspect the Lightspeed protocol
+   *
+   * Returns protocol version, server identity, and supported capabilities without changing universe state.
+   */
+  "initialize": {
+    params: Api.InitializeParams;
+    result: Api.AgentApiOutcomeOfInitializeResponse;
+  };
+  /**
+   * Create or reopen a session
+   *
+   * Creates a session with optional config/profile setup. Retrying an existing session id returns that session; creation settings apply only when it is first created.
+   */
+  "session/start": {
+    params: Api.SessionStartParams;
+    result: Api.AgentApiOutcomeOfSessionStartResponse;
+  };
+  /**
+   * Create or reopen a managed session
+   *
+   * Creates a session with an immutable lifecycle controller and/or workflow tools using explicit bound pull/push dispatch, start targets, and Accepted, Joined, or keyed-Promise completion. Retrying an existing session id requires the same managed-creation declaration; an ordinary session cannot be upgraded to managed.
+   */
+  "session/managed/start": {
+    params: Api.ManagedSessionStartParams;
+    result: Api.AgentApiOutcomeOfSessionStartResponse;
+  };
+  /**
+   * Read a session
+   *
+   * Returns current state plus a bounded newest-first run-summary page. Follow nextRunCursor with session/runs/list when hasOlderRuns is true; use session/events/read for the transcript.
+   */
+  "session/read": {
+    params: Api.SessionReadParams;
+    result: Api.AgentApiOutcomeOfSessionReadResponse;
+  };
+  /**
+   * List sessions
+   *
+   * Returns a cursor-paginated summary list ordered by most recent update. Pages may shift while sessions are changing.
+   */
+  "session/list": {
+    params: Api.SessionListParams;
+    result: Api.AgentApiOutcomeOfSessionListResponse;
+  };
+  /**
+   * Replace session configuration
+   *
+   * Replaces the complete sparse config while the session is idle. Use the current config revision for safe read-modify-write; omitted features are revoked and an identical document is a no-op.
+   */
+  "session/config/put": {
+    params: Api.SessionConfigPutParams;
+    result: Api.AgentApiOutcomeOfSessionConfigPutResponse;
+  };
+  /**
+   * Rename a session
+   *
+   * Sets the display name, or clears it when displayName is omitted.
+   */
+  "session/rename": {
+    params: Api.SessionRenameParams;
+    result: Api.AgentApiOutcomeOfSessionRenameResponse;
+  };
+  /**
+   * Close a session
+   *
+   * Closes an idle session and detaches its environment bindings. Force mode cancels active work, drops queued runs, and can recover a session whose workflow is unavailable.
+   */
+  "session/close": {
+    params: Api.SessionCloseParams;
+    result: Api.AgentApiOutcomeOfSessionCloseResponse;
+  };
+  /**
+   * Delete a closed session
+   *
+   * Permanently removes session storage after the session has been closed; close active/open sessions first.
+   */
+  "session/delete": {
+    params: Api.SessionDeleteParams;
+    result: Api.AgentApiOutcomeOfSessionDeleteResponse;
+  };
+  /**
+   * Read the session event stream
+   *
+   * Reads events after a cursor and optionally long-polls when caught up. Continue from nextCursor/headCursor and inspect complete/gap rather than assuming an uninterrupted page.
+   */
+  "session/events/read": {
+    params: Api.SessionEventsReadParams;
+    result: Api.AgentApiOutcomeOfSessionEventsReadResponse;
+  };
+  /**
+   * Append keyed session context
+   *
+   * Admits a batch of context entries with per-entry results. Stable keys make same-content retries no-ops; media preprocessing can fail one entry without discarding successful entries.
+   */
+  "session/context/append": {
+    params: Api.ContextAppendParams;
+    result: Api.AgentApiOutcomeOfContextAppendResponse;
+  };
+  /**
+   * Remove keyed session context
+   *
+   * Removes active entries by stable key with per-key results. Missing keys are idempotent no-ops; runtime-reserved run keys cannot be removed.
+   */
+  "session/context/remove": {
+    params: Api.ContextRemoveParams;
+    result: Api.AgentApiOutcomeOfContextRemoveResponse;
+  };
+  /**
+   * Compact session context
+   *
+   * Runs the configured compaction policy on an open idle session and waits for the resulting context revision.
+   */
+  "session/context/compact": {
+    params: Api.ContextCompactParams;
+    result: Api.AgentApiOutcomeOfContextCompactResponse;
+  };
+  /**
+   * Start an agent run
+   *
+   * Accepts input or existing context keys and returns once the run is accepted — queued behind an active run, or running — not when it finishes. Supply submissionId for retry safety, then follow session events or reread the session.
+   */
+  "session/runs/start": {
+    params: Api.RunStartParams;
+    result: Api.AgentApiOutcomeOfRunStartResponse;
+  };
+  /**
+   * List session runs
+   *
+   * Returns a newest-first keyset page of bounded run summaries projected from current reducer state.
+   */
+  "session/runs/list": {
+    params: Api.RunListParams;
+    result: Api.AgentApiOutcomeOfRunListResponse;
+  };
+  /**
+   * Read one session run
+   *
+   * Reads and projects one run from its bounded event interval, paged by event sequence.
+   */
+  "session/runs/read": {
+    params: Api.RunReadParams;
+    result: Api.AgentApiOutcomeOfRunReadResponse;
+  };
+  /**
+   * Cancel a run
+   *
+   * Requests cancellation of the named queued or active run and returns its current projected state; observe session events for terminal completion. In-flight model and tool activity is aborted; no grace turn runs.
+   */
+  "session/runs/cancel": {
+    params: Api.RunCancelParams;
+    result: Api.AgentApiOutcomeOfRunCancelResponse;
+  };
+  /**
+   * Decide pending run approvals
+   *
+   * Approves or rejects pending MCP tool calls on the named active run. Valid decisions apply independently; the run resumes only after every pending approval has a decision.
+   */
+  "session/runs/approvals/decide": {
+    params: Api.RunApprovalsDecideParams;
+    result: Api.AgentApiOutcomeOfRunApprovalsDecideResponse;
+  };
+  /**
+   * Steer the active run
+   *
+   * Injects input into the named active run; the model sees it at the next turn boundary without interrupting the in-flight turn. Accepted while the run is running or parked on an await; rejected for queued, cancelling, or finished runs.
+   */
+  "session/runs/steer": {
+    params: Api.RunSteerParams;
+    result: Api.AgentApiOutcomeOfRunSteerResponse;
+  };
+  /**
+   * List available session skills
+   *
+   * Refreshes the session's configured VFS skill catalog and reports which discovered skills are enabled and active. An absent catalog yields an empty result.
+   */
+  "session/skills/list": {
+    params: Api.SkillListParams;
+    result: Api.AgentApiOutcomeOfSkillListResponse;
+  };
+  /**
+   * List active session skills
+   *
+   * Returns skill instructions currently injected into context, including activation scope and source.
+   */
+  "session/skills/active": {
+    params: Api.SkillActiveParams;
+    result: Api.AgentApiOutcomeOfSkillActiveResponse;
+  };
+  /**
+   * Activate a session skill
+   *
+   * Loads an enabled skill from the current catalog and injects its instructions into an open idle session. Run-scoped activation is the default.
+   */
+  "session/skills/activate": {
+    params: Api.SkillActivateParams;
+    result: Api.AgentApiOutcomeOfSkillActivateResponse;
+  };
+  /**
+   * Deactivate a session skill
+   *
+   * Removes an active skill's injected context from an open idle session; the skill must currently be active.
+   */
+  "session/skills/deactivate": {
+    params: Api.SkillDeactivateParams;
+    result: Api.AgentApiOutcomeOfSkillDeactivateResponse;
+  };
+  /**
+   * Apply a profile to a session
+   *
+   * Applies a named or inline profile's config, instructions, and environment setup to an existing session; mutating profile sections require it to be open and idle. Pass current revisions to guard concurrent changes.
+   */
+  "session/profiles/apply": {
+    params: Api.ProfileApplyParams;
+    result: Api.AgentApiOutcomeOfProfileApplyResponse;
+  };
+  /**
+   * Activate a session environment
+   *
+   * Selects an allowed, live universe environment for environment-targeted tools while the session is idle.
+   */
+  "session/environments/activate": {
+    params: Api.SessionEnvironmentActivateParams;
+    result: Api.AgentApiOutcomeOfSessionEnvironmentActivateResponse;
+  };
+  /**
+   * Deactivate the session environment
+   *
+   * Clears active environment selection without changing or closing the universe environment.
+   */
+  "session/environments/deactivate": {
+    params: Api.SessionEnvironmentDeactivateParams;
+    result: Api.AgentApiOutcomeOfSessionEnvironmentDeactivateResponse;
+  };
+  /**
+   * Bind a credential into an environment
+   *
+   * Maps an environment variable name to an existing grant/provider/direct-secret handle for a universe environment. The response exposes only the source handle, never secret material.
+   */
+  "environments/credentials/bind": {
+    params: Api.EnvironmentCredentialBindParams;
+    result: Api.AgentApiOutcomeOfEnvironmentCredentialBindResponse;
+  };
+  /**
+   * List environment credential bindings
+   *
+   * Returns variable names and credential source handles for a universe environment; resolved secret values are never returned.
+   */
+  "environments/credentials/list": {
+    params: Api.EnvironmentCredentialListParams;
+    result: Api.AgentApiOutcomeOfEnvironmentCredentialListResponse;
+  };
+  /**
+   * Unbind an environment credential
+   *
+   * Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret.
+   */
+  "environments/credentials/unbind": {
+    params: Api.EnvironmentCredentialUnbindParams;
+    result: Api.AgentApiOutcomeOfEnvironmentCredentialUnbindResponse;
+  };
+  /**
+   * Create an environment
+   *
+   * Records an idempotent provisioning intent against an enabled universe binding. The provider validates its provider-wide template and provisions through its backend asynchronously.
+   */
+  "environments/create": {
+    params: Api.EnvironmentCreateParams;
+    result: Api.AgentApiOutcomeOfEnvironmentCreateResponse;
+  };
+  /**
+   * Read an environment
+   *
+   * Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+   */
+  "environments/read": {
+    params: Api.EnvironmentReadParams;
+    result: Api.AgentApiOutcomeOfEnvironmentReadResponse;
+  };
+  /**
+   * List environments
+   *
+   * Lists universe-owned environment resources, optionally filtered by provider, binding, or logical lifecycle state.
+   */
+  "environments/list": {
+    params: Api.EnvironmentListParams;
+    result: Api.AgentApiOutcomeOfEnvironmentListResponse;
+  };
+  /**
+   * Close an environment
+   *
+   * Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+   */
+  "environments/close": {
+    params: Api.EnvironmentCloseParams;
+    result: Api.AgentApiOutcomeOfEnvironmentCloseResponse;
+  };
+  /**
+   * Register an external environment
+   *
+   * Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint. Reachability is checked on demand.
+   */
+  "environments/external/create": {
+    params: Api.EnvironmentExternalCreateParams;
+    result: Api.AgentApiOutcomeOfEnvironmentExternalCreateResponse;
+  };
+  /**
+   * Configure environment public ingress
+   *
+   * Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+   */
+  "environments/ingress/put": {
+    params: Api.EnvironmentIngressPutParams;
+    result: Api.AgentApiOutcomeOfEnvironmentIngressPutResponse;
+  };
+  /**
+   * Set environment power intent
+   *
+   * Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+   */
+  "environments/power/put": {
+    params: Api.EnvironmentPowerPutParams;
+    result: Api.AgentApiOutcomeOfEnvironmentPowerPutResponse;
+  };
+  /**
+   * Set environment idle policy
+   *
+   * Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
+   */
+  "environments/idle-policy/put": {
+    params: Api.EnvironmentIdlePolicyPutParams;
+    result: Api.AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse;
+  };
+  /**
+   * List environment provider bindings
+   *
+   * Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+   */
+  "environments/provider-bindings/list": {
+    params: Api.EnvironmentProviderBindingListParams;
+    result: Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse;
+  };
+  /**
+   * Read an environment provider binding
+   *
+   * Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+   */
+  "environments/provider-bindings/read": {
+    params: Api.EnvironmentProviderBindingReadParams;
+    result: Api.AgentApiOutcomeOfEnvironmentProviderBindingReadResponse;
+  };
+  /**
+   * List environment templates
+   *
+   * Reads immutable templates directly from the selected bound provider controller.
+   */
+  "environments/templates/list": {
+    params: Api.EnvironmentTemplateListParams;
+    result: Api.AgentApiOutcomeOfEnvironmentTemplateListResponse;
+  };
+  /**
+   * Read an environment template
+   *
+   * Returns one immutable template version from the selected bound provider controller.
+   */
+  "environments/templates/read": {
+    params: Api.EnvironmentTemplateReadParams;
+    result: Api.AgentApiOutcomeOfEnvironmentTemplateReadResponse;
+  };
+  /**
+   * Create environment jobs
+   *
+   * Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+   */
+  "environments/jobs/create": {
+    params: Api.EnvironmentJobCreateParams;
+    result: Api.AgentApiOutcomeOfEnvironmentJobCreateResponse;
+  };
+  /**
+   * Read environment jobs
+   *
+   * Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+   */
+  "environments/jobs/read": {
+    params: Api.EnvironmentJobReadParams;
+    result: Api.AgentApiOutcomeOfEnvironmentJobReadResponse;
+  };
+  /**
+   * Cancel environment jobs
+   *
+   * Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result.
+   */
+  "environments/jobs/cancel": {
+    params: Api.EnvironmentJobCancelParams;
+    result: Api.AgentApiOutcomeOfEnvironmentJobCancelResponse;
+  };
+  /**
+   * Discover available models
+   *
+   * Queries supported providers directly on every call and returns best-effort selectable routes. One provider failure does not discard successful results from others.
+   */
+  "models/list": {
+    params: Api.ModelListParams;
+    result: Api.AgentApiOutcomeOfModelListResponse;
+  };
+  /**
+   * Create an agent profile
+   *
+   * Creates a new universe-scoped reusable profile document; use profiles/put for create-or-replace revision semantics.
+   */
+  "profiles/create": {
+    params: Api.ProfileCreateParams;
+    result: Api.AgentApiOutcomeOfProfileCreateResponse;
+  };
+  /**
+   * Read an agent profile
+   *
+   * Returns the complete profile document and current revision.
+   */
+  "profiles/read": {
+    params: Api.ProfileReadParams;
+    result: Api.AgentApiOutcomeOfProfileReadResponse;
+  };
+  /**
+   * List agent profiles
+   *
+   * Returns lightweight summaries of universe-scoped reusable profiles.
+   */
+  "profiles/list": {
+    params: Api.ProfileListParams;
+    result: Api.AgentApiOutcomeOfProfileListResponse;
+  };
+  /**
+   * Create or replace an agent profile
+   *
+   * Stores the complete profile document. Use expectedRevision from profiles/read when replacing to prevent lost updates; absence writes unconditionally.
+   */
+  "profiles/put": {
+    params: Api.ProfilePutParams;
+    result: Api.AgentApiOutcomeOfProfilePutResponse;
+  };
+  /**
+   * Delete an agent profile
+   *
+   * Deletes the catalog document; sessions previously created or configured from it retain their materialized state.
+   */
+  "profiles/delete": {
+    params: Api.ProfileDeleteParams;
+    result: Api.AgentApiOutcomeOfProfileDeleteResponse;
+  };
+  /**
+   * Store content-addressed blobs
+   *
+   * Decodes and stores a batch of base64 payloads, returning immutable content references in request order. Re-uploading identical bytes is naturally deduplicated.
+   */
+  "blobs/put": {
+    params: Api.BlobPutParams;
+    result: Api.AgentApiOutcomeOfBlobPutResponse;
+  };
+  /**
+   * Read a content-addressed blob
+   *
+   * Returns the complete immutable blob as base64; large values count against gateway and MCP response limits.
+   */
+  "blobs/read": {
+    params: Api.BlobReadParams;
+    result: Api.AgentApiOutcomeOfBlobReadResponse;
+  };
+  /**
+   * Check blob availability
+   *
+   * Checks a batch of content references without returning blob bodies, preserving request order.
+   */
+  "blobs/has": {
+    params: Api.BlobHasParams;
+    result: Api.AgentApiOutcomeOfBlobHasResponse;
+  };
+  /**
+   * Commit a VFS snapshot
+   *
+   * Validates and stores an immutable filesystem manifest. Upload referenced file blobs first; the returned snapshot ref is content-addressed.
+   */
+  "vfs/snapshots/commit": {
+    params: Api.VfsSnapshotCommitParams;
+    result: Api.AgentApiOutcomeOfVfsSnapshotCommitResponse;
+  };
+  /**
+   * Read a VFS snapshot
+   *
+   * Returns an immutable snapshot manifest and aggregate file/byte counts; file bodies remain separate blobs.
+   */
+  "vfs/snapshots/read": {
+    params: Api.VfsSnapshotReadParams;
+    result: Api.AgentApiOutcomeOfVfsSnapshotReadResponse;
+  };
+  /**
+   * Create a mutable VFS workspace
+   *
+   * Creates a universe workspace at an optional seed snapshot; absence starts from a server-created empty snapshot.
+   */
+  "vfs/workspaces/create": {
+    params: Api.VfsWorkspaceCreateParams;
+    result: Api.AgentApiOutcomeOfVfsWorkspaceCreateResponse;
+  };
+  /**
+   * Read a VFS workspace
+   *
+   * Returns workspace metadata, current head snapshot, and revision for safe updates.
+   */
+  "vfs/workspaces/read": {
+    params: Api.VfsWorkspaceReadParams;
+    result: Api.AgentApiOutcomeOfVfsWorkspaceReadResponse;
+  };
+  /**
+   * List VFS workspaces
+   *
+   * Lists mutable universe workspaces with head snapshots, sizes, and revisions.
+   */
+  "vfs/workspaces/list": {
+    params: Api.VfsWorkspaceListParams;
+    result: Api.AgentApiOutcomeOfVfsWorkspaceListResponse;
+  };
+  /**
+   * Update a VFS workspace
+   *
+   * Moves the workspace head to an existing snapshot and updates its display name. Pass expectedRevision from a read to prevent lost updates.
+   */
+  "vfs/workspaces/update": {
+    params: Api.VfsWorkspaceUpdateParams;
+    result: Api.AgentApiOutcomeOfVfsWorkspaceUpdateResponse;
+  };
+  /**
+   * Delete a VFS workspace
+   *
+   * Deletes the mutable workspace record; immutable snapshots and blobs remain content-addressed resources.
+   */
+  "vfs/workspaces/delete": {
+    params: Api.VfsWorkspaceDeleteParams;
+    result: Api.AgentApiOutcomeOfVfsWorkspaceDeleteResponse;
+  };
+  /**
+   * Create or replace an MCP server record
+   *
+   * Stores the complete universe catalog document, including its optional universe auth-grant credential. Use expectedRevision when replacing; token material is never accepted or returned.
+   */
+  "mcp/servers/put": {
+    params: Api.McpServerPutParams;
+    result: Api.AgentApiOutcomeOfMcpServerPutResponse;
+  };
+  /**
+   * Discover MCP server authentication
+   *
+   * Looks for standards-based OAuth protected-resource metadata without creating a server, OAuth client, flow, or grant. An absent OAuth result is inconclusive and callers must allow manual auth selection.
+   */
+  "mcp/servers/auth/discover": {
+    params: Api.McpServerAuthDiscoverParams;
+    result: Api.AgentApiOutcomeOfMcpServerAuthDiscoverResponse;
+  };
+  /**
+   * Discover MCP server tools
+   *
+   * Connects directly to the configured MCP server with its current universe credential and returns one bounded live tools/list result. The inventory is never persisted or cached and no tool is invoked.
+   */
+  "mcp/servers/tools/discover": {
+    params: Api.McpServerToolsDiscoverParams;
+    result: Api.AgentApiOutcomeOfMcpServerToolsDiscoverResponse;
+  };
+  /**
+   * Read an MCP server record
+   *
+   * Returns one catalog document with defaults, auth policy, non-secret grant binding, status, and revision; no credential value is exposed.
+   */
+  "mcp/servers/read": {
+    params: Api.McpServerReadParams;
+    result: Api.AgentApiOutcomeOfMcpServerReadResponse;
+  };
+  /**
+   * List MCP server records
+   *
+   * Lists universe catalog entries, optionally filtered by lifecycle/configuration status.
+   */
+  "mcp/servers/list": {
+    params: Api.McpServerListParams;
+    result: Api.AgentApiOutcomeOfMcpServerListResponse;
+  };
+  /**
+   * Delete an MCP server record
+   *
+   * Deletes the catalog document. Existing session configs that reference it are not silently rewritten and may need explicit reconfiguration.
+   */
+  "mcp/servers/delete": {
+    params: Api.McpServerDeleteParams;
+    result: Api.AgentApiOutcomeOfMcpServerDeleteResponse;
+  };
+  /**
+   * Import a static bearer grant
+   *
+   * Accepts a plaintext token, encrypts it immediately, and returns only grant metadata/token-presence flags. Brokered is the default; retrievable exposure is immutable and permits service-only leases.
+   */
+  "auth/grants/import": {
+    params: Api.AuthGrantImportParams;
+    result: Api.AgentApiOutcomeOfAuthGrantImportResponse;
+  };
+  /**
+   * Lease a retrievable authentication grant
+   *
+   * Service callers only. Resolves the current access token through the broker, records the lease, and returns it once. Cache only in memory until expiry minus margin (or at most five minutes without expiry), re-lease after target 401/403, and never persist or place the token in workflow payloads.
+   */
+  "auth/grants/lease": {
+    params: Api.AuthGrantLeaseParams;
+    result: Api.AgentApiOutcomeOfAuthGrantLeaseResponse;
+  };
+  /**
+   * Read authentication grant metadata
+   *
+   * Returns principal, provider binding, scopes, audience, expiry, status, and token-presence flags; access and refresh token values are never returned.
+   */
+  "auth/grants/read": {
+    params: Api.AuthGrantReadParams;
+    result: Api.AgentApiOutcomeOfAuthGrantReadResponse;
+  };
+  /**
+   * List authentication grants
+   *
+   * Lists non-secret grant metadata for the universe, optionally filtered by status.
+   */
+  "auth/grants/list": {
+    params: Api.AuthGrantListParams;
+    result: Api.AgentApiOutcomeOfAuthGrantListResponse;
+  };
+  /**
+   * Revoke an authentication grant
+   *
+   * Marks the grant unusable by token consumers while retaining non-secret audit metadata.
+   */
+  "auth/grants/revoke": {
+    params: Api.AuthGrantRevokeParams;
+    result: Api.AgentApiOutcomeOfAuthGrantRevokeResponse;
+  };
+  /**
+   * Register an OAuth client
+   *
+   * Stores provider endpoints and client identity; an optional plaintext client secret is encrypted and represented thereafter only by hasClientSecret.
+   */
+  "auth/clients/create": {
+    params: Api.AuthClientCreateParams;
+    result: Api.AgentApiOutcomeOfAuthClientCreateResponse;
+  };
+  /**
+   * Read OAuth client metadata
+   *
+   * Returns endpoints, public client identity, defaults, and secret-presence state; the client secret is never returned.
+   */
+  "auth/clients/read": {
+    params: Api.AuthClientReadParams;
+    result: Api.AgentApiOutcomeOfAuthClientReadResponse;
+  };
+  /**
+   * List OAuth clients
+   *
+   * Lists non-secret OAuth client registrations in the universe.
+   */
+  "auth/clients/list": {
+    params: Api.AuthClientListParams;
+    result: Api.AgentApiOutcomeOfAuthClientListResponse;
+  };
+  /**
+   * Delete an OAuth client
+   *
+   * Deletes the client registration and its stored client secret; grants already created from it remain separate records.
+   */
+  "auth/clients/delete": {
+    params: Api.AuthClientDeleteParams;
+    result: Api.AgentApiOutcomeOfAuthClientDeleteResponse;
+  };
+  /**
+   * Start an OAuth authorization flow
+   *
+   * Creates a short-lived PKCE flow carrying the immutable grant exposure choice and returns a browser authorization URL containing one-time state. Treat the URL as sensitive and poll auth/flows/read for completion.
+   */
+  "auth/flows/start": {
+    params: Api.AuthFlowStartParams;
+    result: Api.AgentApiOutcomeOfAuthFlowStartResponse;
+  };
+  /**
+   * Read OAuth flow status
+   *
+   * Polls a flow's pending/completed/failed/expired state and returns the resulting grant id when authorization succeeds; no token value is exposed.
+   */
+  "auth/flows/read": {
+    params: Api.AuthFlowStatusParams;
+    result: Api.AgentApiOutcomeOfAuthFlowStatusResponse;
+  };
+  /**
+   * Register an authentication provider
+   *
+   * Creates a model or GitHub credential source. Plaintext API keys/private keys are encrypted on receipt and later represented only by configuration plus hasCredential.
+   */
+  "auth/providers/create": {
+    params: Api.AuthProviderCreateParams;
+    result: Api.AgentApiOutcomeOfAuthProviderCreateResponse;
+  };
+  /**
+   * Read authentication provider metadata
+   *
+   * Returns provider kind, non-secret configuration, credential-presence state, and status; stored credentials are never returned.
+   */
+  "auth/providers/read": {
+    params: Api.AuthProviderReadParams;
+    result: Api.AgentApiOutcomeOfAuthProviderReadResponse;
+  };
+  /**
+   * List authentication providers
+   *
+   * Lists non-secret model/GitHub provider registrations for the universe.
+   */
+  "auth/providers/list": {
+    params: Api.AuthProviderListParams;
+    result: Api.AgentApiOutcomeOfAuthProviderListResponse;
+  };
+  /**
+   * Delete an authentication provider
+   *
+   * Deletes the provider registration and its directly stored credential; separately stored grants remain independent records.
+   */
+  "auth/providers/delete": {
+    params: Api.AuthProviderDeleteParams;
+    result: Api.AgentApiOutcomeOfAuthProviderDeleteResponse;
+  };
+  /**
+   * List GitHub App installations
+   *
+   * Uses the registered GitHub App provider credential to query accessible installations and returns account/permission metadata without tokens.
+   */
+  "auth/github/installations/list": {
+    params: Api.AuthGitHubInstallationListParams;
+    result: Api.AgentApiOutcomeOfAuthGitHubInstallationListResponse;
+  };
+  /**
+   * Grant access to a GitHub App installation
+   *
+   * Creates or refreshes a universe auth grant for one accessible installation. The installation token is brokered internally and never returned.
+   */
+  "auth/github/installations/grant": {
+    params: Api.AuthGitHubInstallationGrantParams;
+    result: Api.AgentApiOutcomeOfAuthGitHubInstallationGrantResponse;
+  };
+  /**
+   * Create a bot
+   *
+   * Creates the bot record, optionally with its triggers, and starts its controller. Fails if the bot id exists; a trigger failure rolls the bot back.
+   */
+  "bots/create": {
+    params: Api.BotCreateParams;
+    result: Api.AgentApiOutcomeOfBotCreateResponse;
+  };
+  /**
+   * Create or replace a bot document
+   *
+   * Replaces the mutable configuration whole and signals the controller, which applies it at its next idle boundary. Pass expectedRevision when replacing; a closed bot accepts label-only edits.
+   */
+  "bots/put": {
+    params: Api.BotPutParams;
+    result: Api.AgentApiOutcomeOfBotPutResponse;
+  };
+  /**
+   * Read a bot
+   *
+   * Returns the bot record, its current revision, and lifecycle columns.
+   */
+  "bots/read": {
+    params: Api.BotReadParams;
+    result: Api.AgentApiOutcomeOfBotReadResponse;
+  };
+  /**
+   * List bots
+   *
+   * Returns the roster: every bot with its trigger count, pending event count, and latest event.
+   */
+  "bots/list": {
+    params: Api.BotListParams;
+    result: Api.AgentApiOutcomeOfBotListResponse;
+  };
+  /**
+   * Close a bot
+   *
+   * Terminal and idempotent: disables every trigger, drops schedules, and tells the controller to archive pending events and force-close its sessions. Returns once signalled; follow bots/state/read for closing to closed.
+   */
+  "bots/close": {
+    params: Api.BotCloseParams;
+    result: Api.AgentApiOutcomeOfBotCloseResponse;
+  };
+  /**
+   * Delete a bot
+   *
+   * Closes the bot if needed, waits for its controller to complete, deletes the sessions it closed, and removes the record so the bot id is free again.
+   */
+  "bots/delete": {
+    params: Api.BotDeleteParams;
+    result: Api.AgentApiOutcomeOfBotDeleteResponse;
+  };
+  /**
+   * Read bot controller state
+   *
+   * Queries the controller workflow for its live snapshot (sessions, buffers, active and recent deliveries, budget) and lists sub-agent descendants. The controller is absent until the bot's first event.
+   */
+  "bots/state/read": {
+    params: Api.BotStateReadParams;
+    result: Api.AgentApiOutcomeOfBotStateReadResponse;
+  };
+  /**
+   * Rotate a bot session
+   *
+   * Asks the controller to close one of the bot's sessions at its next idle boundary and continue on a fresh generation; queued deliveries follow.
+   */
+  "bots/sessions/rotate": {
+    params: Api.BotSessionRotateParams;
+    result: Api.AgentApiOutcomeOfBotSessionRotateResponse;
+  };
+  /**
+   * Create or replace a trigger
+   *
+   * Validates the trigger document (CEL parses, grants exist, one inbox per bot, chat routes per conversation), reconciles its Temporal Schedule, and stores it. A poll spec edit resets the cursor; a webhook keeps its URL token.
+   */
+  "bots/triggers/put": {
+    params: Api.BotTriggerPutParams;
+    result: Api.AgentApiOutcomeOfBotTriggerPutResponse;
+  };
+  /**
+   * Read a trigger
+   *
+   * Returns one trigger with its incidents and cursor; the ingest path and pairing code are shown only to managing principals.
+   */
+  "bots/triggers/read": {
+    params: Api.BotTriggerReadParams;
+    result: Api.AgentApiOutcomeOfBotTriggerReadResponse;
+  };
+  /**
+   * List a bot's triggers
+   *
+   * Returns every trigger of the bot ordered by id, secrets redacted for non-managing principals.
+   */
+  "bots/triggers/list": {
+    params: Api.BotTriggerListParams;
+    result: Api.AgentApiOutcomeOfBotTriggerListResponse;
+  };
+  /**
+   * Delete a trigger
+   *
+   * Drops the trigger's Temporal Schedule and pairings, then the record; stored events keep their history.
+   */
+  "bots/triggers/delete": {
+    params: Api.BotTriggerDeleteParams;
+    result: Api.AgentApiOutcomeOfBotTriggerDeleteResponse;
+  };
+  /**
+   * Admit an event manually
+   *
+   * Stores an operator-authored event for the bot's main session and wakes the controller. eventId is the dedupe identity; a duplicate returns the stored row.
+   */
+  "bots/events/admit": {
+    params: Api.BotEventAdmitParams;
+    result: Api.AgentApiOutcomeOfBotEventAdmitResponse;
+  };
+  /**
+   * Replay a stored event
+   *
+   * Re-admits the stored envelope as a fresh event with the original routing; the replay never coalesces.
+   */
+  "bots/events/replay": {
+    params: Api.BotEventReplayParams;
+    result: Api.AgentApiOutcomeOfBotEventReplayResponse;
+  };
+  /**
+   * List a bot's events
+   *
+   * Cursor-paginated event log, newest first, with outcomes; payload documents stay in the CAS.
+   */
+  "bots/events/list": {
+    params: Api.BotEventListParams;
+    result: Api.AgentApiOutcomeOfBotEventListResponse;
+  };
+  /**
+   * Read an event by number
+   *
+   * Returns the event row and its full stored envelope document.
+   */
+  "bots/events/read": {
+    params: Api.BotEventReadParams;
+    result: Api.AgentApiOutcomeOfBotEventReadResponse;
+  };
+  /**
+   * Test a CEL filter
+   *
+   * Evaluates a filter against one payload or a sample of recent stored events, reporting matches and evaluation errors without changing anything.
+   */
+  "bots/filters/test": {
+    params: Api.BotFilterTestParams;
+    result: Api.AgentApiOutcomeOfBotFilterTestResponse;
+  };
+  /**
+   * Create a channel account
+   *
+   * Registers a provider account (Telegram, WhatsApp) for this universe. The credential is a retrievable grant reference; no token is accepted here.
+   */
+  "channels/accounts/create": {
+    params: Api.ChannelAccountCreateParams;
+    result: Api.AgentApiOutcomeOfChannelAccountCreateResponse;
+  };
+  /**
+   * Create or replace a channel account
+   *
+   * Replaces the account document whole; pass expectedRevision when replacing. The connector host picks the change up on its next discovery pass.
+   */
+  "channels/accounts/put": {
+    params: Api.ChannelAccountPutParams;
+    result: Api.AgentApiOutcomeOfChannelAccountPutResponse;
+  };
+  /**
+   * Read a channel account
+   *
+   * Returns the account document and revision.
+   */
+  "channels/accounts/read": {
+    params: Api.ChannelAccountReadParams;
+    result: Api.AgentApiOutcomeOfChannelAccountReadResponse;
+  };
+  /**
+   * List channel accounts
+   *
+   * Lists this universe's provider accounts, optionally by provider.
+   */
+  "channels/accounts/list": {
+    params: Api.ChannelAccountListParams;
+    result: Api.AgentApiOutcomeOfChannelAccountListResponse;
+  };
+  /**
+   * Delete a channel account
+   *
+   * Removes the account and its pairings; chat triggers that reference it stop serving conversations.
+   */
+  "channels/accounts/delete": {
+    params: Api.ChannelAccountDeleteParams;
+    result: Api.AgentApiOutcomeOfChannelAccountDeleteResponse;
+  };
+  /**
+   * Admit a provider message
+   *
+   * Service callers only. Resolves the chat trigger for the conversation, applies pairing, and signals the conversation workflow. Returns the decision so the connector can send pairing prompts itself; acknowledge the provider only after this returns.
+   */
+  "channels/inbound/admit": {
+    params: Api.ChannelInboundAdmitParams;
+    result: Api.AgentApiOutcomeOfChannelInboundAdmitResponse;
+  };
+  /**
+   * List chat pairings
+   *
+   * Lists conversations paired to chat triggers, optionally by account or bot.
+   */
+  "channels/pairings/list": {
+    params: Api.ChannelPairingListParams;
+    result: Api.AgentApiOutcomeOfChannelPairingListResponse;
+  };
+  /**
+   * Unpair a conversation
+   *
+   * Removes one pairing; the conversation must present the pairing code again to reconnect.
+   */
+  "channels/pairings/delete": {
+    params: Api.ChannelPairingDeleteParams;
+    result: Api.AgentApiOutcomeOfChannelPairingDeleteResponse;
+  };
+  /**
+   * Read a conversation snapshot
+   *
+   * Queries the conversation workflow's live state for one chat, for debugging; absent when no workflow exists yet.
+   */
+  "channels/conversations/read": {
+    params: Api.ChannelConversationReadParams;
+    result: Api.AgentApiOutcomeOfChannelConversationReadResponse;
+  };
+  /**
+   * Create a universe
+   *
+   * Creates the deployment tenant boundary for an explicit UUID. The operation is idempotent and reports whether a new universe was created.
+   */
+  "operator/universes/create": {
+    params: Api.OperatorUniverseCreateParams;
+    result: Api.AgentApiOutcomeOfOperatorUniverseCreateResponse;
+  };
+  /**
+   * List universes
+   *
+   * Returns deployment-wide universe summaries with approximate live aggregate counts and last session activity.
+   */
+  "operator/universes/list": {
+    params: Api.OperatorUniverseListParams;
+    result: Api.AgentApiOutcomeOfOperatorUniverseListResponse;
+  };
+  /**
+   * Read a universe
+   *
+   * Returns one deployment tenant summary with aggregate session, workspace, profile, and blob usage.
+   */
+  "operator/universes/read": {
+    params: Api.OperatorUniverseReadParams;
+    result: Api.AgentApiOutcomeOfOperatorUniverseReadResponse;
+  };
+  /**
+   * Purge a universe
+   *
+   * Permanently terminates live session workflows, deletes external blob objects, and cascades universe data. The purge is resumable/idempotent after partial failure.
+   */
+  "operator/universes/delete": {
+    params: Api.OperatorUniverseDeleteParams;
+    result: Api.AgentApiOutcomeOfOperatorUniverseDeleteResponse;
+  };
+  /**
+   * Create a universe API key
+   *
+   * Mints an inbound gateway key for one existing universe. The plaintext secret is returned exactly once and cannot be recovered; persist only the displayed prefix for identification.
+   */
+  "operator/api-keys/create": {
+    params: Api.OperatorApiKeyCreateParams;
+    result: Api.AgentApiOutcomeOfOperatorApiKeyCreateResponse;
+  };
+  /**
+   * List universe API keys
+   *
+   * Returns only non-secret key metadata for the requested universe, including revocation and last-use timestamps. Plaintext secrets are never stored or returned.
+   */
+  "operator/api-keys/list": {
+    params: Api.OperatorApiKeyListParams;
+    result: Api.AgentApiOutcomeOfOperatorApiKeyListResponse;
+  };
+  /**
+   * Revoke a universe API key
+   *
+   * Immediately and idempotently revokes the matching key only when it belongs to the requested universe. Unknown and foreign-universe prefixes return not found.
+   */
+  "operator/api-keys/revoke": {
+    params: Api.OperatorApiKeyRevokeParams;
+    result: Api.AgentApiOutcomeOfOperatorApiKeyRevokeResponse;
+  };
+  /**
+   * Put an environment provider
+   *
+   * Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+   */
+  "operator/environment-providers/put": {
+    params: Api.OperatorEnvironmentProviderPutParams;
+    result: Api.AgentApiOutcomeOfOperatorEnvironmentProviderPutResponse;
+  };
+  /**
+   * List environment providers
+   *
+   * Returns every operator-registered deployment provider and its controller connection.
+   */
+  "operator/environment-providers/list": {
+    params: Api.OperatorEnvironmentProviderListParams;
+    result: Api.AgentApiOutcomeOfOperatorEnvironmentProviderListResponse;
+  };
+  /**
+   * Read an environment provider
+   *
+   * Returns one operator-registered deployment provider and its controller connection.
+   */
+  "operator/environment-providers/read": {
+    params: Api.OperatorEnvironmentProviderReadParams;
+    result: Api.AgentApiOutcomeOfOperatorEnvironmentProviderReadResponse;
+  };
+  /**
+   * Delete an environment provider
+   *
+   * Deletes a deployment provider only when no universe binding references it.
+   */
+  "operator/environment-providers/delete": {
+    params: Api.OperatorEnvironmentProviderDeleteParams;
+    result: Api.AgentApiOutcomeOfOperatorEnvironmentProviderDeleteResponse;
+  };
+  /**
+   * Put an environment provider binding
+   *
+   * Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+   */
+  "operator/environment-providers/bindings/put": {
+    params: Api.OperatorProviderBindingPutParams;
+    result: Api.AgentApiOutcomeOfOperatorProviderBindingPutResponse;
+  };
+  /**
+   * Delete an environment provider binding
+   *
+   * Deletes a universe provider binding only after every referencing environment has reached Closed.
+   */
+  "operator/environment-providers/bindings/delete": {
+    params: Api.OperatorProviderBindingDeleteParams;
+    result: Api.AgentApiOutcomeOfOperatorProviderBindingDeleteResponse;
+  };
+  /**
+   * Adopt a provider environment
+   *
+   * Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
+   */
+  "operator/environments/adopt": {
+    params: Api.OperatorEnvironmentAdoptParams;
+    result: Api.AgentApiOutcomeOfOperatorEnvironmentAdoptResponse;
+  };
+  /**
+   * List channel accounts across universes
+   *
+   * The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.
+   */
+  "operator/channels/accounts/list": {
+    params: Api.OperatorChannelAccountListParams;
+    result: Api.AgentApiOutcomeOfOperatorChannelAccountListResponse;
+  };
+}
+
+export type MethodParams<M extends Method> = MethodMap[M]["params"];
+export type MethodResult<M extends Method> = MethodMap[M]["result"];
+
+export interface RpcCaller {
+  call<M extends Method>(method: M, params: MethodParams<M>): Promise<MethodResult<M>>;
+}
+
+export const rpc = {
+  /**
+   * Inspect the Lightspeed protocol
+   *
+   * Returns protocol version, server identity, and supported capabilities without changing universe state.
+   */
+  initialize(client: RpcCaller, params: Api.InitializeParams): Promise<Api.AgentApiOutcomeOfInitializeResponse> {
+    return client.call("initialize", params);
+  },
+  /**
+   * Create or reopen a session
+   *
+   * Creates a session with optional config/profile setup. Retrying an existing session id returns that session; creation settings apply only when it is first created.
+   */
+  sessionStart(client: RpcCaller, params: Api.SessionStartParams): Promise<Api.AgentApiOutcomeOfSessionStartResponse> {
+    return client.call("session/start", params);
+  },
+  /**
+   * Create or reopen a managed session
+   *
+   * Creates a session with an immutable lifecycle controller and/or workflow tools using explicit bound pull/push dispatch, start targets, and Accepted, Joined, or keyed-Promise completion. Retrying an existing session id requires the same managed-creation declaration; an ordinary session cannot be upgraded to managed.
+   */
+  sessionManagedStart(client: RpcCaller, params: Api.ManagedSessionStartParams): Promise<Api.AgentApiOutcomeOfSessionStartResponse> {
+    return client.call("session/managed/start", params);
+  },
+  /**
+   * Read a session
+   *
+   * Returns current state plus a bounded newest-first run-summary page. Follow nextRunCursor with session/runs/list when hasOlderRuns is true; use session/events/read for the transcript.
+   */
+  sessionRead(client: RpcCaller, params: Api.SessionReadParams): Promise<Api.AgentApiOutcomeOfSessionReadResponse> {
+    return client.call("session/read", params);
+  },
+  /**
+   * List sessions
+   *
+   * Returns a cursor-paginated summary list ordered by most recent update. Pages may shift while sessions are changing.
+   */
+  sessionList(client: RpcCaller, params: Api.SessionListParams): Promise<Api.AgentApiOutcomeOfSessionListResponse> {
+    return client.call("session/list", params);
+  },
+  /**
+   * Replace session configuration
+   *
+   * Replaces the complete sparse config while the session is idle. Use the current config revision for safe read-modify-write; omitted features are revoked and an identical document is a no-op.
+   */
+  sessionConfigPut(client: RpcCaller, params: Api.SessionConfigPutParams): Promise<Api.AgentApiOutcomeOfSessionConfigPutResponse> {
+    return client.call("session/config/put", params);
+  },
+  /**
+   * Rename a session
+   *
+   * Sets the display name, or clears it when displayName is omitted.
+   */
+  sessionRename(client: RpcCaller, params: Api.SessionRenameParams): Promise<Api.AgentApiOutcomeOfSessionRenameResponse> {
+    return client.call("session/rename", params);
+  },
+  /**
+   * Close a session
+   *
+   * Closes an idle session and detaches its environment bindings. Force mode cancels active work, drops queued runs, and can recover a session whose workflow is unavailable.
+   */
+  sessionClose(client: RpcCaller, params: Api.SessionCloseParams): Promise<Api.AgentApiOutcomeOfSessionCloseResponse> {
+    return client.call("session/close", params);
+  },
+  /**
+   * Delete a closed session
+   *
+   * Permanently removes session storage after the session has been closed; close active/open sessions first.
+   */
+  sessionDelete(client: RpcCaller, params: Api.SessionDeleteParams): Promise<Api.AgentApiOutcomeOfSessionDeleteResponse> {
+    return client.call("session/delete", params);
+  },
+  /**
+   * Read the session event stream
+   *
+   * Reads events after a cursor and optionally long-polls when caught up. Continue from nextCursor/headCursor and inspect complete/gap rather than assuming an uninterrupted page.
+   */
+  sessionEventsRead(client: RpcCaller, params: Api.SessionEventsReadParams): Promise<Api.AgentApiOutcomeOfSessionEventsReadResponse> {
+    return client.call("session/events/read", params);
+  },
+  /**
+   * Append keyed session context
+   *
+   * Admits a batch of context entries with per-entry results. Stable keys make same-content retries no-ops; media preprocessing can fail one entry without discarding successful entries.
+   */
+  sessionContextAppend(client: RpcCaller, params: Api.ContextAppendParams): Promise<Api.AgentApiOutcomeOfContextAppendResponse> {
+    return client.call("session/context/append", params);
+  },
+  /**
+   * Remove keyed session context
+   *
+   * Removes active entries by stable key with per-key results. Missing keys are idempotent no-ops; runtime-reserved run keys cannot be removed.
+   */
+  sessionContextRemove(client: RpcCaller, params: Api.ContextRemoveParams): Promise<Api.AgentApiOutcomeOfContextRemoveResponse> {
+    return client.call("session/context/remove", params);
+  },
+  /**
+   * Compact session context
+   *
+   * Runs the configured compaction policy on an open idle session and waits for the resulting context revision.
+   */
+  sessionContextCompact(client: RpcCaller, params: Api.ContextCompactParams): Promise<Api.AgentApiOutcomeOfContextCompactResponse> {
+    return client.call("session/context/compact", params);
+  },
+  /**
+   * Start an agent run
+   *
+   * Accepts input or existing context keys and returns once the run is accepted — queued behind an active run, or running — not when it finishes. Supply submissionId for retry safety, then follow session events or reread the session.
+   */
+  sessionRunsStart(client: RpcCaller, params: Api.RunStartParams): Promise<Api.AgentApiOutcomeOfRunStartResponse> {
+    return client.call("session/runs/start", params);
+  },
+  /**
+   * List session runs
+   *
+   * Returns a newest-first keyset page of bounded run summaries projected from current reducer state.
+   */
+  sessionRunsList(client: RpcCaller, params: Api.RunListParams): Promise<Api.AgentApiOutcomeOfRunListResponse> {
+    return client.call("session/runs/list", params);
+  },
+  /**
+   * Read one session run
+   *
+   * Reads and projects one run from its bounded event interval, paged by event sequence.
+   */
+  sessionRunsRead(client: RpcCaller, params: Api.RunReadParams): Promise<Api.AgentApiOutcomeOfRunReadResponse> {
+    return client.call("session/runs/read", params);
+  },
+  /**
+   * Cancel a run
+   *
+   * Requests cancellation of the named queued or active run and returns its current projected state; observe session events for terminal completion. In-flight model and tool activity is aborted; no grace turn runs.
+   */
+  sessionRunsCancel(client: RpcCaller, params: Api.RunCancelParams): Promise<Api.AgentApiOutcomeOfRunCancelResponse> {
+    return client.call("session/runs/cancel", params);
+  },
+  /**
+   * Decide pending run approvals
+   *
+   * Approves or rejects pending MCP tool calls on the named active run. Valid decisions apply independently; the run resumes only after every pending approval has a decision.
+   */
+  sessionRunsApprovalsDecide(client: RpcCaller, params: Api.RunApprovalsDecideParams): Promise<Api.AgentApiOutcomeOfRunApprovalsDecideResponse> {
+    return client.call("session/runs/approvals/decide", params);
+  },
+  /**
+   * Steer the active run
+   *
+   * Injects input into the named active run; the model sees it at the next turn boundary without interrupting the in-flight turn. Accepted while the run is running or parked on an await; rejected for queued, cancelling, or finished runs.
+   */
+  sessionRunsSteer(client: RpcCaller, params: Api.RunSteerParams): Promise<Api.AgentApiOutcomeOfRunSteerResponse> {
+    return client.call("session/runs/steer", params);
+  },
+  /**
+   * List available session skills
+   *
+   * Refreshes the session's configured VFS skill catalog and reports which discovered skills are enabled and active. An absent catalog yields an empty result.
+   */
+  sessionSkillsList(client: RpcCaller, params: Api.SkillListParams): Promise<Api.AgentApiOutcomeOfSkillListResponse> {
+    return client.call("session/skills/list", params);
+  },
+  /**
+   * List active session skills
+   *
+   * Returns skill instructions currently injected into context, including activation scope and source.
+   */
+  sessionSkillsActive(client: RpcCaller, params: Api.SkillActiveParams): Promise<Api.AgentApiOutcomeOfSkillActiveResponse> {
+    return client.call("session/skills/active", params);
+  },
+  /**
+   * Activate a session skill
+   *
+   * Loads an enabled skill from the current catalog and injects its instructions into an open idle session. Run-scoped activation is the default.
+   */
+  sessionSkillsActivate(client: RpcCaller, params: Api.SkillActivateParams): Promise<Api.AgentApiOutcomeOfSkillActivateResponse> {
+    return client.call("session/skills/activate", params);
+  },
+  /**
+   * Deactivate a session skill
+   *
+   * Removes an active skill's injected context from an open idle session; the skill must currently be active.
+   */
+  sessionSkillsDeactivate(client: RpcCaller, params: Api.SkillDeactivateParams): Promise<Api.AgentApiOutcomeOfSkillDeactivateResponse> {
+    return client.call("session/skills/deactivate", params);
+  },
+  /**
+   * Apply a profile to a session
+   *
+   * Applies a named or inline profile's config, instructions, and environment setup to an existing session; mutating profile sections require it to be open and idle. Pass current revisions to guard concurrent changes.
+   */
+  sessionProfilesApply(client: RpcCaller, params: Api.ProfileApplyParams): Promise<Api.AgentApiOutcomeOfProfileApplyResponse> {
+    return client.call("session/profiles/apply", params);
+  },
+  /**
+   * Activate a session environment
+   *
+   * Selects an allowed, live universe environment for environment-targeted tools while the session is idle.
+   */
+  sessionEnvironmentsActivate(client: RpcCaller, params: Api.SessionEnvironmentActivateParams): Promise<Api.AgentApiOutcomeOfSessionEnvironmentActivateResponse> {
+    return client.call("session/environments/activate", params);
+  },
+  /**
+   * Deactivate the session environment
+   *
+   * Clears active environment selection without changing or closing the universe environment.
+   */
+  sessionEnvironmentsDeactivate(client: RpcCaller, params: Api.SessionEnvironmentDeactivateParams): Promise<Api.AgentApiOutcomeOfSessionEnvironmentDeactivateResponse> {
+    return client.call("session/environments/deactivate", params);
+  },
+  /**
+   * Bind a credential into an environment
+   *
+   * Maps an environment variable name to an existing grant/provider/direct-secret handle for a universe environment. The response exposes only the source handle, never secret material.
+   */
+  environmentsCredentialsBind(client: RpcCaller, params: Api.EnvironmentCredentialBindParams): Promise<Api.AgentApiOutcomeOfEnvironmentCredentialBindResponse> {
+    return client.call("environments/credentials/bind", params);
+  },
+  /**
+   * List environment credential bindings
+   *
+   * Returns variable names and credential source handles for a universe environment; resolved secret values are never returned.
+   */
+  environmentsCredentialsList(client: RpcCaller, params: Api.EnvironmentCredentialListParams): Promise<Api.AgentApiOutcomeOfEnvironmentCredentialListResponse> {
+    return client.call("environments/credentials/list", params);
+  },
+  /**
+   * Unbind an environment credential
+   *
+   * Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret.
+   */
+  environmentsCredentialsUnbind(client: RpcCaller, params: Api.EnvironmentCredentialUnbindParams): Promise<Api.AgentApiOutcomeOfEnvironmentCredentialUnbindResponse> {
+    return client.call("environments/credentials/unbind", params);
+  },
+  /**
+   * Create an environment
+   *
+   * Records an idempotent provisioning intent against an enabled universe binding. The provider validates its provider-wide template and provisions through its backend asynchronously.
+   */
+  environmentsCreate(client: RpcCaller, params: Api.EnvironmentCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentCreateResponse> {
+    return client.call("environments/create", params);
+  },
+  /**
+   * Read an environment
+   *
+   * Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+   */
+  environmentsRead(client: RpcCaller, params: Api.EnvironmentReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentReadResponse> {
+    return client.call("environments/read", params);
+  },
+  /**
+   * List environments
+   *
+   * Lists universe-owned environment resources, optionally filtered by provider, binding, or logical lifecycle state.
+   */
+  environmentsList(client: RpcCaller, params: Api.EnvironmentListParams): Promise<Api.AgentApiOutcomeOfEnvironmentListResponse> {
+    return client.call("environments/list", params);
+  },
+  /**
+   * Close an environment
+   *
+   * Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+   */
+  environmentsClose(client: RpcCaller, params: Api.EnvironmentCloseParams): Promise<Api.AgentApiOutcomeOfEnvironmentCloseResponse> {
+    return client.call("environments/close", params);
+  },
+  /**
+   * Register an external environment
+   *
+   * Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint. Reachability is checked on demand.
+   */
+  environmentsExternalCreate(client: RpcCaller, params: Api.EnvironmentExternalCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentExternalCreateResponse> {
+    return client.call("environments/external/create", params);
+  },
+  /**
+   * Configure environment public ingress
+   *
+   * Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+   */
+  environmentsIngressPut(client: RpcCaller, params: Api.EnvironmentIngressPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentIngressPutResponse> {
+    return client.call("environments/ingress/put", params);
+  },
+  /**
+   * Set environment power intent
+   *
+   * Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+   */
+  environmentsPowerPut(client: RpcCaller, params: Api.EnvironmentPowerPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentPowerPutResponse> {
+    return client.call("environments/power/put", params);
+  },
+  /**
+   * Set environment idle policy
+   *
+   * Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
+   */
+  environmentsIdlePolicyPut(client: RpcCaller, params: Api.EnvironmentIdlePolicyPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse> {
+    return client.call("environments/idle-policy/put", params);
+  },
+  /**
+   * List environment provider bindings
+   *
+   * Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+   */
+  environmentsProviderBindingsList(client: RpcCaller, params: Api.EnvironmentProviderBindingListParams): Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse> {
+    return client.call("environments/provider-bindings/list", params);
+  },
+  /**
+   * Read an environment provider binding
+   *
+   * Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+   */
+  environmentsProviderBindingsRead(client: RpcCaller, params: Api.EnvironmentProviderBindingReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingReadResponse> {
+    return client.call("environments/provider-bindings/read", params);
+  },
+  /**
+   * List environment templates
+   *
+   * Reads immutable templates directly from the selected bound provider controller.
+   */
+  environmentsTemplatesList(client: RpcCaller, params: Api.EnvironmentTemplateListParams): Promise<Api.AgentApiOutcomeOfEnvironmentTemplateListResponse> {
+    return client.call("environments/templates/list", params);
+  },
+  /**
+   * Read an environment template
+   *
+   * Returns one immutable template version from the selected bound provider controller.
+   */
+  environmentsTemplatesRead(client: RpcCaller, params: Api.EnvironmentTemplateReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentTemplateReadResponse> {
+    return client.call("environments/templates/read", params);
+  },
+  /**
+   * Create environment jobs
+   *
+   * Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+   */
+  environmentsJobsCreate(client: RpcCaller, params: Api.EnvironmentJobCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentJobCreateResponse> {
+    return client.call("environments/jobs/create", params);
+  },
+  /**
+   * Read environment jobs
+   *
+   * Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+   */
+  environmentsJobsRead(client: RpcCaller, params: Api.EnvironmentJobReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentJobReadResponse> {
+    return client.call("environments/jobs/read", params);
+  },
+  /**
+   * Cancel environment jobs
+   *
+   * Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result.
+   */
+  environmentsJobsCancel(client: RpcCaller, params: Api.EnvironmentJobCancelParams): Promise<Api.AgentApiOutcomeOfEnvironmentJobCancelResponse> {
+    return client.call("environments/jobs/cancel", params);
+  },
+  /**
+   * Discover available models
+   *
+   * Queries supported providers directly on every call and returns best-effort selectable routes. One provider failure does not discard successful results from others.
+   */
+  modelsList(client: RpcCaller, params: Api.ModelListParams): Promise<Api.AgentApiOutcomeOfModelListResponse> {
+    return client.call("models/list", params);
+  },
+  /**
+   * Create an agent profile
+   *
+   * Creates a new universe-scoped reusable profile document; use profiles/put for create-or-replace revision semantics.
+   */
+  profilesCreate(client: RpcCaller, params: Api.ProfileCreateParams): Promise<Api.AgentApiOutcomeOfProfileCreateResponse> {
+    return client.call("profiles/create", params);
+  },
+  /**
+   * Read an agent profile
+   *
+   * Returns the complete profile document and current revision.
+   */
+  profilesRead(client: RpcCaller, params: Api.ProfileReadParams): Promise<Api.AgentApiOutcomeOfProfileReadResponse> {
+    return client.call("profiles/read", params);
+  },
+  /**
+   * List agent profiles
+   *
+   * Returns lightweight summaries of universe-scoped reusable profiles.
+   */
+  profilesList(client: RpcCaller, params: Api.ProfileListParams): Promise<Api.AgentApiOutcomeOfProfileListResponse> {
+    return client.call("profiles/list", params);
+  },
+  /**
+   * Create or replace an agent profile
+   *
+   * Stores the complete profile document. Use expectedRevision from profiles/read when replacing to prevent lost updates; absence writes unconditionally.
+   */
+  profilesPut(client: RpcCaller, params: Api.ProfilePutParams): Promise<Api.AgentApiOutcomeOfProfilePutResponse> {
+    return client.call("profiles/put", params);
+  },
+  /**
+   * Delete an agent profile
+   *
+   * Deletes the catalog document; sessions previously created or configured from it retain their materialized state.
+   */
+  profilesDelete(client: RpcCaller, params: Api.ProfileDeleteParams): Promise<Api.AgentApiOutcomeOfProfileDeleteResponse> {
+    return client.call("profiles/delete", params);
+  },
+  /**
+   * Store content-addressed blobs
+   *
+   * Decodes and stores a batch of base64 payloads, returning immutable content references in request order. Re-uploading identical bytes is naturally deduplicated.
+   */
+  blobsPut(client: RpcCaller, params: Api.BlobPutParams): Promise<Api.AgentApiOutcomeOfBlobPutResponse> {
+    return client.call("blobs/put", params);
+  },
+  /**
+   * Read a content-addressed blob
+   *
+   * Returns the complete immutable blob as base64; large values count against gateway and MCP response limits.
+   */
+  blobsRead(client: RpcCaller, params: Api.BlobReadParams): Promise<Api.AgentApiOutcomeOfBlobReadResponse> {
+    return client.call("blobs/read", params);
+  },
+  /**
+   * Check blob availability
+   *
+   * Checks a batch of content references without returning blob bodies, preserving request order.
+   */
+  blobsHas(client: RpcCaller, params: Api.BlobHasParams): Promise<Api.AgentApiOutcomeOfBlobHasResponse> {
+    return client.call("blobs/has", params);
+  },
+  /**
+   * Commit a VFS snapshot
+   *
+   * Validates and stores an immutable filesystem manifest. Upload referenced file blobs first; the returned snapshot ref is content-addressed.
+   */
+  vfsSnapshotsCommit(client: RpcCaller, params: Api.VfsSnapshotCommitParams): Promise<Api.AgentApiOutcomeOfVfsSnapshotCommitResponse> {
+    return client.call("vfs/snapshots/commit", params);
+  },
+  /**
+   * Read a VFS snapshot
+   *
+   * Returns an immutable snapshot manifest and aggregate file/byte counts; file bodies remain separate blobs.
+   */
+  vfsSnapshotsRead(client: RpcCaller, params: Api.VfsSnapshotReadParams): Promise<Api.AgentApiOutcomeOfVfsSnapshotReadResponse> {
+    return client.call("vfs/snapshots/read", params);
+  },
+  /**
+   * Create a mutable VFS workspace
+   *
+   * Creates a universe workspace at an optional seed snapshot; absence starts from a server-created empty snapshot.
+   */
+  vfsWorkspacesCreate(client: RpcCaller, params: Api.VfsWorkspaceCreateParams): Promise<Api.AgentApiOutcomeOfVfsWorkspaceCreateResponse> {
+    return client.call("vfs/workspaces/create", params);
+  },
+  /**
+   * Read a VFS workspace
+   *
+   * Returns workspace metadata, current head snapshot, and revision for safe updates.
+   */
+  vfsWorkspacesRead(client: RpcCaller, params: Api.VfsWorkspaceReadParams): Promise<Api.AgentApiOutcomeOfVfsWorkspaceReadResponse> {
+    return client.call("vfs/workspaces/read", params);
+  },
+  /**
+   * List VFS workspaces
+   *
+   * Lists mutable universe workspaces with head snapshots, sizes, and revisions.
+   */
+  vfsWorkspacesList(client: RpcCaller, params: Api.VfsWorkspaceListParams): Promise<Api.AgentApiOutcomeOfVfsWorkspaceListResponse> {
+    return client.call("vfs/workspaces/list", params);
+  },
+  /**
+   * Update a VFS workspace
+   *
+   * Moves the workspace head to an existing snapshot and updates its display name. Pass expectedRevision from a read to prevent lost updates.
+   */
+  vfsWorkspacesUpdate(client: RpcCaller, params: Api.VfsWorkspaceUpdateParams): Promise<Api.AgentApiOutcomeOfVfsWorkspaceUpdateResponse> {
+    return client.call("vfs/workspaces/update", params);
+  },
+  /**
+   * Delete a VFS workspace
+   *
+   * Deletes the mutable workspace record; immutable snapshots and blobs remain content-addressed resources.
+   */
+  vfsWorkspacesDelete(client: RpcCaller, params: Api.VfsWorkspaceDeleteParams): Promise<Api.AgentApiOutcomeOfVfsWorkspaceDeleteResponse> {
+    return client.call("vfs/workspaces/delete", params);
+  },
+  /**
+   * Create or replace an MCP server record
+   *
+   * Stores the complete universe catalog document, including its optional universe auth-grant credential. Use expectedRevision when replacing; token material is never accepted or returned.
+   */
+  mcpServersPut(client: RpcCaller, params: Api.McpServerPutParams): Promise<Api.AgentApiOutcomeOfMcpServerPutResponse> {
+    return client.call("mcp/servers/put", params);
+  },
+  /**
+   * Discover MCP server authentication
+   *
+   * Looks for standards-based OAuth protected-resource metadata without creating a server, OAuth client, flow, or grant. An absent OAuth result is inconclusive and callers must allow manual auth selection.
+   */
+  mcpServersAuthDiscover(client: RpcCaller, params: Api.McpServerAuthDiscoverParams): Promise<Api.AgentApiOutcomeOfMcpServerAuthDiscoverResponse> {
+    return client.call("mcp/servers/auth/discover", params);
+  },
+  /**
+   * Discover MCP server tools
+   *
+   * Connects directly to the configured MCP server with its current universe credential and returns one bounded live tools/list result. The inventory is never persisted or cached and no tool is invoked.
+   */
+  mcpServersToolsDiscover(client: RpcCaller, params: Api.McpServerToolsDiscoverParams): Promise<Api.AgentApiOutcomeOfMcpServerToolsDiscoverResponse> {
+    return client.call("mcp/servers/tools/discover", params);
+  },
+  /**
+   * Read an MCP server record
+   *
+   * Returns one catalog document with defaults, auth policy, non-secret grant binding, status, and revision; no credential value is exposed.
+   */
+  mcpServersRead(client: RpcCaller, params: Api.McpServerReadParams): Promise<Api.AgentApiOutcomeOfMcpServerReadResponse> {
+    return client.call("mcp/servers/read", params);
+  },
+  /**
+   * List MCP server records
+   *
+   * Lists universe catalog entries, optionally filtered by lifecycle/configuration status.
+   */
+  mcpServersList(client: RpcCaller, params: Api.McpServerListParams): Promise<Api.AgentApiOutcomeOfMcpServerListResponse> {
+    return client.call("mcp/servers/list", params);
+  },
+  /**
+   * Delete an MCP server record
+   *
+   * Deletes the catalog document. Existing session configs that reference it are not silently rewritten and may need explicit reconfiguration.
+   */
+  mcpServersDelete(client: RpcCaller, params: Api.McpServerDeleteParams): Promise<Api.AgentApiOutcomeOfMcpServerDeleteResponse> {
+    return client.call("mcp/servers/delete", params);
+  },
+  /**
+   * Import a static bearer grant
+   *
+   * Accepts a plaintext token, encrypts it immediately, and returns only grant metadata/token-presence flags. Brokered is the default; retrievable exposure is immutable and permits service-only leases.
+   */
+  authGrantsImport(client: RpcCaller, params: Api.AuthGrantImportParams): Promise<Api.AgentApiOutcomeOfAuthGrantImportResponse> {
+    return client.call("auth/grants/import", params);
+  },
+  /**
+   * Lease a retrievable authentication grant
+   *
+   * Service callers only. Resolves the current access token through the broker, records the lease, and returns it once. Cache only in memory until expiry minus margin (or at most five minutes without expiry), re-lease after target 401/403, and never persist or place the token in workflow payloads.
+   */
+  authGrantsLease(client: RpcCaller, params: Api.AuthGrantLeaseParams): Promise<Api.AgentApiOutcomeOfAuthGrantLeaseResponse> {
+    return client.call("auth/grants/lease", params);
+  },
+  /**
+   * Read authentication grant metadata
+   *
+   * Returns principal, provider binding, scopes, audience, expiry, status, and token-presence flags; access and refresh token values are never returned.
+   */
+  authGrantsRead(client: RpcCaller, params: Api.AuthGrantReadParams): Promise<Api.AgentApiOutcomeOfAuthGrantReadResponse> {
+    return client.call("auth/grants/read", params);
+  },
+  /**
+   * List authentication grants
+   *
+   * Lists non-secret grant metadata for the universe, optionally filtered by status.
+   */
+  authGrantsList(client: RpcCaller, params: Api.AuthGrantListParams): Promise<Api.AgentApiOutcomeOfAuthGrantListResponse> {
+    return client.call("auth/grants/list", params);
+  },
+  /**
+   * Revoke an authentication grant
+   *
+   * Marks the grant unusable by token consumers while retaining non-secret audit metadata.
+   */
+  authGrantsRevoke(client: RpcCaller, params: Api.AuthGrantRevokeParams): Promise<Api.AgentApiOutcomeOfAuthGrantRevokeResponse> {
+    return client.call("auth/grants/revoke", params);
+  },
+  /**
+   * Register an OAuth client
+   *
+   * Stores provider endpoints and client identity; an optional plaintext client secret is encrypted and represented thereafter only by hasClientSecret.
+   */
+  authClientsCreate(client: RpcCaller, params: Api.AuthClientCreateParams): Promise<Api.AgentApiOutcomeOfAuthClientCreateResponse> {
+    return client.call("auth/clients/create", params);
+  },
+  /**
+   * Read OAuth client metadata
+   *
+   * Returns endpoints, public client identity, defaults, and secret-presence state; the client secret is never returned.
+   */
+  authClientsRead(client: RpcCaller, params: Api.AuthClientReadParams): Promise<Api.AgentApiOutcomeOfAuthClientReadResponse> {
+    return client.call("auth/clients/read", params);
+  },
+  /**
+   * List OAuth clients
+   *
+   * Lists non-secret OAuth client registrations in the universe.
+   */
+  authClientsList(client: RpcCaller, params: Api.AuthClientListParams): Promise<Api.AgentApiOutcomeOfAuthClientListResponse> {
+    return client.call("auth/clients/list", params);
+  },
+  /**
+   * Delete an OAuth client
+   *
+   * Deletes the client registration and its stored client secret; grants already created from it remain separate records.
+   */
+  authClientsDelete(client: RpcCaller, params: Api.AuthClientDeleteParams): Promise<Api.AgentApiOutcomeOfAuthClientDeleteResponse> {
+    return client.call("auth/clients/delete", params);
+  },
+  /**
+   * Start an OAuth authorization flow
+   *
+   * Creates a short-lived PKCE flow carrying the immutable grant exposure choice and returns a browser authorization URL containing one-time state. Treat the URL as sensitive and poll auth/flows/read for completion.
+   */
+  authFlowsStart(client: RpcCaller, params: Api.AuthFlowStartParams): Promise<Api.AgentApiOutcomeOfAuthFlowStartResponse> {
+    return client.call("auth/flows/start", params);
+  },
+  /**
+   * Read OAuth flow status
+   *
+   * Polls a flow's pending/completed/failed/expired state and returns the resulting grant id when authorization succeeds; no token value is exposed.
+   */
+  authFlowsRead(client: RpcCaller, params: Api.AuthFlowStatusParams): Promise<Api.AgentApiOutcomeOfAuthFlowStatusResponse> {
+    return client.call("auth/flows/read", params);
+  },
+  /**
+   * Register an authentication provider
+   *
+   * Creates a model or GitHub credential source. Plaintext API keys/private keys are encrypted on receipt and later represented only by configuration plus hasCredential.
+   */
+  authProvidersCreate(client: RpcCaller, params: Api.AuthProviderCreateParams): Promise<Api.AgentApiOutcomeOfAuthProviderCreateResponse> {
+    return client.call("auth/providers/create", params);
+  },
+  /**
+   * Read authentication provider metadata
+   *
+   * Returns provider kind, non-secret configuration, credential-presence state, and status; stored credentials are never returned.
+   */
+  authProvidersRead(client: RpcCaller, params: Api.AuthProviderReadParams): Promise<Api.AgentApiOutcomeOfAuthProviderReadResponse> {
+    return client.call("auth/providers/read", params);
+  },
+  /**
+   * List authentication providers
+   *
+   * Lists non-secret model/GitHub provider registrations for the universe.
+   */
+  authProvidersList(client: RpcCaller, params: Api.AuthProviderListParams): Promise<Api.AgentApiOutcomeOfAuthProviderListResponse> {
+    return client.call("auth/providers/list", params);
+  },
+  /**
+   * Delete an authentication provider
+   *
+   * Deletes the provider registration and its directly stored credential; separately stored grants remain independent records.
+   */
+  authProvidersDelete(client: RpcCaller, params: Api.AuthProviderDeleteParams): Promise<Api.AgentApiOutcomeOfAuthProviderDeleteResponse> {
+    return client.call("auth/providers/delete", params);
+  },
+  /**
+   * List GitHub App installations
+   *
+   * Uses the registered GitHub App provider credential to query accessible installations and returns account/permission metadata without tokens.
+   */
+  authGithubInstallationsList(client: RpcCaller, params: Api.AuthGitHubInstallationListParams): Promise<Api.AgentApiOutcomeOfAuthGitHubInstallationListResponse> {
+    return client.call("auth/github/installations/list", params);
+  },
+  /**
+   * Grant access to a GitHub App installation
+   *
+   * Creates or refreshes a universe auth grant for one accessible installation. The installation token is brokered internally and never returned.
+   */
+  authGithubInstallationsGrant(client: RpcCaller, params: Api.AuthGitHubInstallationGrantParams): Promise<Api.AgentApiOutcomeOfAuthGitHubInstallationGrantResponse> {
+    return client.call("auth/github/installations/grant", params);
+  },
+  /**
+   * Create a bot
+   *
+   * Creates the bot record, optionally with its triggers, and starts its controller. Fails if the bot id exists; a trigger failure rolls the bot back.
+   */
+  botsCreate(client: RpcCaller, params: Api.BotCreateParams): Promise<Api.AgentApiOutcomeOfBotCreateResponse> {
+    return client.call("bots/create", params);
+  },
+  /**
+   * Create or replace a bot document
+   *
+   * Replaces the mutable configuration whole and signals the controller, which applies it at its next idle boundary. Pass expectedRevision when replacing; a closed bot accepts label-only edits.
+   */
+  botsPut(client: RpcCaller, params: Api.BotPutParams): Promise<Api.AgentApiOutcomeOfBotPutResponse> {
+    return client.call("bots/put", params);
+  },
+  /**
+   * Read a bot
+   *
+   * Returns the bot record, its current revision, and lifecycle columns.
+   */
+  botsRead(client: RpcCaller, params: Api.BotReadParams): Promise<Api.AgentApiOutcomeOfBotReadResponse> {
+    return client.call("bots/read", params);
+  },
+  /**
+   * List bots
+   *
+   * Returns the roster: every bot with its trigger count, pending event count, and latest event.
+   */
+  botsList(client: RpcCaller, params: Api.BotListParams): Promise<Api.AgentApiOutcomeOfBotListResponse> {
+    return client.call("bots/list", params);
+  },
+  /**
+   * Close a bot
+   *
+   * Terminal and idempotent: disables every trigger, drops schedules, and tells the controller to archive pending events and force-close its sessions. Returns once signalled; follow bots/state/read for closing to closed.
+   */
+  botsClose(client: RpcCaller, params: Api.BotCloseParams): Promise<Api.AgentApiOutcomeOfBotCloseResponse> {
+    return client.call("bots/close", params);
+  },
+  /**
+   * Delete a bot
+   *
+   * Closes the bot if needed, waits for its controller to complete, deletes the sessions it closed, and removes the record so the bot id is free again.
+   */
+  botsDelete(client: RpcCaller, params: Api.BotDeleteParams): Promise<Api.AgentApiOutcomeOfBotDeleteResponse> {
+    return client.call("bots/delete", params);
+  },
+  /**
+   * Read bot controller state
+   *
+   * Queries the controller workflow for its live snapshot (sessions, buffers, active and recent deliveries, budget) and lists sub-agent descendants. The controller is absent until the bot's first event.
+   */
+  botsStateRead(client: RpcCaller, params: Api.BotStateReadParams): Promise<Api.AgentApiOutcomeOfBotStateReadResponse> {
+    return client.call("bots/state/read", params);
+  },
+  /**
+   * Rotate a bot session
+   *
+   * Asks the controller to close one of the bot's sessions at its next idle boundary and continue on a fresh generation; queued deliveries follow.
+   */
+  botsSessionsRotate(client: RpcCaller, params: Api.BotSessionRotateParams): Promise<Api.AgentApiOutcomeOfBotSessionRotateResponse> {
+    return client.call("bots/sessions/rotate", params);
+  },
+  /**
+   * Create or replace a trigger
+   *
+   * Validates the trigger document (CEL parses, grants exist, one inbox per bot, chat routes per conversation), reconciles its Temporal Schedule, and stores it. A poll spec edit resets the cursor; a webhook keeps its URL token.
+   */
+  botsTriggersPut(client: RpcCaller, params: Api.BotTriggerPutParams): Promise<Api.AgentApiOutcomeOfBotTriggerPutResponse> {
+    return client.call("bots/triggers/put", params);
+  },
+  /**
+   * Read a trigger
+   *
+   * Returns one trigger with its incidents and cursor; the ingest path and pairing code are shown only to managing principals.
+   */
+  botsTriggersRead(client: RpcCaller, params: Api.BotTriggerReadParams): Promise<Api.AgentApiOutcomeOfBotTriggerReadResponse> {
+    return client.call("bots/triggers/read", params);
+  },
+  /**
+   * List a bot's triggers
+   *
+   * Returns every trigger of the bot ordered by id, secrets redacted for non-managing principals.
+   */
+  botsTriggersList(client: RpcCaller, params: Api.BotTriggerListParams): Promise<Api.AgentApiOutcomeOfBotTriggerListResponse> {
+    return client.call("bots/triggers/list", params);
+  },
+  /**
+   * Delete a trigger
+   *
+   * Drops the trigger's Temporal Schedule and pairings, then the record; stored events keep their history.
+   */
+  botsTriggersDelete(client: RpcCaller, params: Api.BotTriggerDeleteParams): Promise<Api.AgentApiOutcomeOfBotTriggerDeleteResponse> {
+    return client.call("bots/triggers/delete", params);
+  },
+  /**
+   * Admit an event manually
+   *
+   * Stores an operator-authored event for the bot's main session and wakes the controller. eventId is the dedupe identity; a duplicate returns the stored row.
+   */
+  botsEventsAdmit(client: RpcCaller, params: Api.BotEventAdmitParams): Promise<Api.AgentApiOutcomeOfBotEventAdmitResponse> {
+    return client.call("bots/events/admit", params);
+  },
+  /**
+   * Replay a stored event
+   *
+   * Re-admits the stored envelope as a fresh event with the original routing; the replay never coalesces.
+   */
+  botsEventsReplay(client: RpcCaller, params: Api.BotEventReplayParams): Promise<Api.AgentApiOutcomeOfBotEventReplayResponse> {
+    return client.call("bots/events/replay", params);
+  },
+  /**
+   * List a bot's events
+   *
+   * Cursor-paginated event log, newest first, with outcomes; payload documents stay in the CAS.
+   */
+  botsEventsList(client: RpcCaller, params: Api.BotEventListParams): Promise<Api.AgentApiOutcomeOfBotEventListResponse> {
+    return client.call("bots/events/list", params);
+  },
+  /**
+   * Read an event by number
+   *
+   * Returns the event row and its full stored envelope document.
+   */
+  botsEventsRead(client: RpcCaller, params: Api.BotEventReadParams): Promise<Api.AgentApiOutcomeOfBotEventReadResponse> {
+    return client.call("bots/events/read", params);
+  },
+  /**
+   * Test a CEL filter
+   *
+   * Evaluates a filter against one payload or a sample of recent stored events, reporting matches and evaluation errors without changing anything.
+   */
+  botsFiltersTest(client: RpcCaller, params: Api.BotFilterTestParams): Promise<Api.AgentApiOutcomeOfBotFilterTestResponse> {
+    return client.call("bots/filters/test", params);
+  },
+  /**
+   * Create a channel account
+   *
+   * Registers a provider account (Telegram, WhatsApp) for this universe. The credential is a retrievable grant reference; no token is accepted here.
+   */
+  channelsAccountsCreate(client: RpcCaller, params: Api.ChannelAccountCreateParams): Promise<Api.AgentApiOutcomeOfChannelAccountCreateResponse> {
+    return client.call("channels/accounts/create", params);
+  },
+  /**
+   * Create or replace a channel account
+   *
+   * Replaces the account document whole; pass expectedRevision when replacing. The connector host picks the change up on its next discovery pass.
+   */
+  channelsAccountsPut(client: RpcCaller, params: Api.ChannelAccountPutParams): Promise<Api.AgentApiOutcomeOfChannelAccountPutResponse> {
+    return client.call("channels/accounts/put", params);
+  },
+  /**
+   * Read a channel account
+   *
+   * Returns the account document and revision.
+   */
+  channelsAccountsRead(client: RpcCaller, params: Api.ChannelAccountReadParams): Promise<Api.AgentApiOutcomeOfChannelAccountReadResponse> {
+    return client.call("channels/accounts/read", params);
+  },
+  /**
+   * List channel accounts
+   *
+   * Lists this universe's provider accounts, optionally by provider.
+   */
+  channelsAccountsList(client: RpcCaller, params: Api.ChannelAccountListParams): Promise<Api.AgentApiOutcomeOfChannelAccountListResponse> {
+    return client.call("channels/accounts/list", params);
+  },
+  /**
+   * Delete a channel account
+   *
+   * Removes the account and its pairings; chat triggers that reference it stop serving conversations.
+   */
+  channelsAccountsDelete(client: RpcCaller, params: Api.ChannelAccountDeleteParams): Promise<Api.AgentApiOutcomeOfChannelAccountDeleteResponse> {
+    return client.call("channels/accounts/delete", params);
+  },
+  /**
+   * Admit a provider message
+   *
+   * Service callers only. Resolves the chat trigger for the conversation, applies pairing, and signals the conversation workflow. Returns the decision so the connector can send pairing prompts itself; acknowledge the provider only after this returns.
+   */
+  channelsInboundAdmit(client: RpcCaller, params: Api.ChannelInboundAdmitParams): Promise<Api.AgentApiOutcomeOfChannelInboundAdmitResponse> {
+    return client.call("channels/inbound/admit", params);
+  },
+  /**
+   * List chat pairings
+   *
+   * Lists conversations paired to chat triggers, optionally by account or bot.
+   */
+  channelsPairingsList(client: RpcCaller, params: Api.ChannelPairingListParams): Promise<Api.AgentApiOutcomeOfChannelPairingListResponse> {
+    return client.call("channels/pairings/list", params);
+  },
+  /**
+   * Unpair a conversation
+   *
+   * Removes one pairing; the conversation must present the pairing code again to reconnect.
+   */
+  channelsPairingsDelete(client: RpcCaller, params: Api.ChannelPairingDeleteParams): Promise<Api.AgentApiOutcomeOfChannelPairingDeleteResponse> {
+    return client.call("channels/pairings/delete", params);
+  },
+  /**
+   * Read a conversation snapshot
+   *
+   * Queries the conversation workflow's live state for one chat, for debugging; absent when no workflow exists yet.
+   */
+  channelsConversationsRead(client: RpcCaller, params: Api.ChannelConversationReadParams): Promise<Api.AgentApiOutcomeOfChannelConversationReadResponse> {
+    return client.call("channels/conversations/read", params);
+  },
+  /**
+   * Create a universe
+   *
+   * Creates the deployment tenant boundary for an explicit UUID. The operation is idempotent and reports whether a new universe was created.
+   */
+  operatorUniversesCreate(client: RpcCaller, params: Api.OperatorUniverseCreateParams): Promise<Api.AgentApiOutcomeOfOperatorUniverseCreateResponse> {
+    return client.call("operator/universes/create", params);
+  },
+  /**
+   * List universes
+   *
+   * Returns deployment-wide universe summaries with approximate live aggregate counts and last session activity.
+   */
+  operatorUniversesList(client: RpcCaller, params: Api.OperatorUniverseListParams): Promise<Api.AgentApiOutcomeOfOperatorUniverseListResponse> {
+    return client.call("operator/universes/list", params);
+  },
+  /**
+   * Read a universe
+   *
+   * Returns one deployment tenant summary with aggregate session, workspace, profile, and blob usage.
+   */
+  operatorUniversesRead(client: RpcCaller, params: Api.OperatorUniverseReadParams): Promise<Api.AgentApiOutcomeOfOperatorUniverseReadResponse> {
+    return client.call("operator/universes/read", params);
+  },
+  /**
+   * Purge a universe
+   *
+   * Permanently terminates live session workflows, deletes external blob objects, and cascades universe data. The purge is resumable/idempotent after partial failure.
+   */
+  operatorUniversesDelete(client: RpcCaller, params: Api.OperatorUniverseDeleteParams): Promise<Api.AgentApiOutcomeOfOperatorUniverseDeleteResponse> {
+    return client.call("operator/universes/delete", params);
+  },
+  /**
+   * Create a universe API key
+   *
+   * Mints an inbound gateway key for one existing universe. The plaintext secret is returned exactly once and cannot be recovered; persist only the displayed prefix for identification.
+   */
+  operatorApiKeysCreate(client: RpcCaller, params: Api.OperatorApiKeyCreateParams): Promise<Api.AgentApiOutcomeOfOperatorApiKeyCreateResponse> {
+    return client.call("operator/api-keys/create", params);
+  },
+  /**
+   * List universe API keys
+   *
+   * Returns only non-secret key metadata for the requested universe, including revocation and last-use timestamps. Plaintext secrets are never stored or returned.
+   */
+  operatorApiKeysList(client: RpcCaller, params: Api.OperatorApiKeyListParams): Promise<Api.AgentApiOutcomeOfOperatorApiKeyListResponse> {
+    return client.call("operator/api-keys/list", params);
+  },
+  /**
+   * Revoke a universe API key
+   *
+   * Immediately and idempotently revokes the matching key only when it belongs to the requested universe. Unknown and foreign-universe prefixes return not found.
+   */
+  operatorApiKeysRevoke(client: RpcCaller, params: Api.OperatorApiKeyRevokeParams): Promise<Api.AgentApiOutcomeOfOperatorApiKeyRevokeResponse> {
+    return client.call("operator/api-keys/revoke", params);
+  },
+  /**
+   * Put an environment provider
+   *
+   * Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+   */
+  operatorEnvironmentProvidersPut(client: RpcCaller, params: Api.OperatorEnvironmentProviderPutParams): Promise<Api.AgentApiOutcomeOfOperatorEnvironmentProviderPutResponse> {
+    return client.call("operator/environment-providers/put", params);
+  },
+  /**
+   * List environment providers
+   *
+   * Returns every operator-registered deployment provider and its controller connection.
+   */
+  operatorEnvironmentProvidersList(client: RpcCaller, params: Api.OperatorEnvironmentProviderListParams): Promise<Api.AgentApiOutcomeOfOperatorEnvironmentProviderListResponse> {
+    return client.call("operator/environment-providers/list", params);
+  },
+  /**
+   * Read an environment provider
+   *
+   * Returns one operator-registered deployment provider and its controller connection.
+   */
+  operatorEnvironmentProvidersRead(client: RpcCaller, params: Api.OperatorEnvironmentProviderReadParams): Promise<Api.AgentApiOutcomeOfOperatorEnvironmentProviderReadResponse> {
+    return client.call("operator/environment-providers/read", params);
+  },
+  /**
+   * Delete an environment provider
+   *
+   * Deletes a deployment provider only when no universe binding references it.
+   */
+  operatorEnvironmentProvidersDelete(client: RpcCaller, params: Api.OperatorEnvironmentProviderDeleteParams): Promise<Api.AgentApiOutcomeOfOperatorEnvironmentProviderDeleteResponse> {
+    return client.call("operator/environment-providers/delete", params);
+  },
+  /**
+   * Put an environment provider binding
+   *
+   * Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+   */
+  operatorEnvironmentProvidersBindingsPut(client: RpcCaller, params: Api.OperatorProviderBindingPutParams): Promise<Api.AgentApiOutcomeOfOperatorProviderBindingPutResponse> {
+    return client.call("operator/environment-providers/bindings/put", params);
+  },
+  /**
+   * Delete an environment provider binding
+   *
+   * Deletes a universe provider binding only after every referencing environment has reached Closed.
+   */
+  operatorEnvironmentProvidersBindingsDelete(client: RpcCaller, params: Api.OperatorProviderBindingDeleteParams): Promise<Api.AgentApiOutcomeOfOperatorProviderBindingDeleteResponse> {
+    return client.call("operator/environment-providers/bindings/delete", params);
+  },
+  /**
+   * Adopt a provider environment
+   *
+   * Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
+   */
+  operatorEnvironmentsAdopt(client: RpcCaller, params: Api.OperatorEnvironmentAdoptParams): Promise<Api.AgentApiOutcomeOfOperatorEnvironmentAdoptResponse> {
+    return client.call("operator/environments/adopt", params);
+  },
+  /**
+   * List channel accounts across universes
+   *
+   * The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.
+   */
+  operatorChannelsAccountsList(client: RpcCaller, params: Api.OperatorChannelAccountListParams): Promise<Api.AgentApiOutcomeOfOperatorChannelAccountListResponse> {
+    return client.call("operator/channels/accounts/list", params);
+  },
+} as const;