@lightspeed-ai/sdk 0.4.0

package/dist/generated/methods.d.ts

@@ -0,0 +1,3308 @@
+import type * as Api from "./types.js";
+export declare const METHODS: readonly ["vfs/workspaces/files/read", "initialize", "session/start", "session/managed/start", "session/read", "session/list", "session/config/put", "session/rename", "session/metadata/put", "session/retention/put", "session/close", "session/delete", "session/share", "session/events/read", "session/context/append", "session/context/remove", "session/context/replace", "session/context/compact", "session/runs/start", "session/runs/list", "session/runs/read", "session/runs/cancel", "session/runs/approvals/decide", "session/runs/steer", "session/skills/list", "session/profiles/apply", "session/environments/activate", "session/environments/deactivate", "environments/credentials/bind", "environments/credentials/list", "environments/credentials/unbind", "environments/create", "environments/read", "environments/list", "environments/close", "environments/external/create", "environments/ingress/put", "environments/power/put", "environments/idle-policy/put", "environments/provider-bindings/list", "environments/provider-bindings/read", "environments/templates/list", "environments/templates/read", "environments/jobs/create", "environments/jobs/read", "environments/jobs/cancel", "environments/registration-keys/create", "environments/registration-keys/read", "environments/registration-keys/list", "environments/registration-keys/revoke", "transcriptions/start", "transcriptions/read", "transcriptions/cancel", "models/defaults/read", "models/defaults/put", "models/list", "profiles/create", "profiles/read", "profiles/list", "profiles/put", "profiles/delete", "blobs/put", "blobs/read", "blobs/has", "vfs/snapshots/commit", "vfs/snapshots/read", "vfs/workspaces/create", "vfs/workspaces/read", "vfs/workspaces/list", "vfs/workspaces/update", "vfs/workspaces/delete", "mcp/servers/put", "mcp/servers/auth/discover", "mcp/servers/tools/discover", "mcp/servers/read", "mcp/servers/list", "mcp/servers/delete", "auth/grants/import", "auth/grants/lease", "auth/grants/read", "auth/grants/list", "auth/grants/revoke", "auth/clients/create", "auth/clients/read", "auth/clients/list", "auth/clients/delete", "auth/flows/start", "auth/flows/read", "auth/providers/create", "auth/providers/read", "auth/providers/list", "auth/providers/delete", "auth/github/installations/list", "auth/github/installations/grant", "bots/create", "bots/put", "bots/read", "bots/list", "bots/close", "bots/delete", "bots/state/read", "bots/sessions/rotate", "bots/triggers/put", "bots/triggers/read", "bots/triggers/list", "bots/triggers/delete", "bots/events/admit", "bots/events/replay", "bots/events/list", "bots/events/read", "bots/filters/test", "channels/accounts/create", "channels/accounts/put", "channels/accounts/read", "channels/accounts/list", "channels/accounts/delete", "channels/inbound/admit", "channels/pairings/list", "channels/pairings/delete", "channels/conversations/read", "deployment/environment-provider-bindings/list", "deployment/universes/create", "deployment/universes/list", "deployment/universes/read", "deployment/universes/slug/put", "deployment/universes/delete", "deployment/api-keys/create", "deployment/api-keys/list", "deployment/api-keys/rotate", "deployment/api-keys/revoke", "deployment/environment-providers/put", "deployment/environment-providers/list", "deployment/environment-providers/read", "deployment/environment-providers/delete", "deployment/environment-providers/bindings/put", "deployment/environment-providers/bindings/delete", "deployment/environments/adopt", "deployment/channels/accounts/list"];
+export declare const METHOD_INFO: {
+    readonly "vfs/workspaces/files/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a workspace file";
+        readonly description: "Reads bytes at a path in the current workspace head.";
+    };
+    readonly initialize: {
+        readonly scope: "connection";
+        readonly access: {
+            readonly kind: "connection";
+        };
+        readonly summary: "Inspect the Lightspeed protocol";
+        readonly description: "Returns protocol version, server identity, credential scope and allowed groups before universe selection. Requires authentication in authenticated mode; no universe header is accepted.";
+    };
+    readonly "session/start": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "create_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or reopen a session";
+        readonly description: "Creates a session, unshared unless access says universe, with optional config/profile setup. Profile metadata and retention supply defaults that explicit values override; the config's default environment attachment becomes active. Retrying an existing id returns that session and keeps its audience.";
+    };
+    readonly "session/managed/start": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "create_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or reopen a managed session";
+        readonly description: "Creates a session with immutable lifecycle and workflow-tool declarations using explicit bound dispatch. Profile metadata, retention, and default environment attachment selection follow session/start semantics. Retrying an id requires the same managed declaration; an ordinary session cannot be upgraded.";
+    };
+    readonly "session/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a session";
+        readonly description: "Returns current state plus a bounded newest-first run-summary page. Follow nextRunCursor with session/runs/list when hasOlderRuns is true; use session/events/read for the transcript.";
+    };
+    readonly "session/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List sessions";
+        readonly description: "Returns a cursor-paginated summary list ordered by most recent update, optionally narrowed by the audience of each session's root: createdBy, visibility, or visibleTo (shared with the universe or created by that actor). Pages may shift while sessions are changing.";
+    };
+    readonly "session/config/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Replace session configuration";
+        readonly description: "Replaces the complete sparse config while the session is idle. Use the current config revision for safe read-modify-write; omitted features are revoked, an omitted model preserves the current model, and an identical document is a no-op.";
+    };
+    readonly "session/rename": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Rename a session";
+        readonly description: "Sets the display name, or clears it when displayName is omitted.";
+    };
+    readonly "session/metadata/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Replace session metadata";
+        readonly description: "Replaces the complete descriptive key/value map (bounded like session/start); an omitted or empty map clears it. Record-only: the event log and updatedAtMs are untouched.";
+    };
+    readonly "session/retention/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Replace session retention";
+        readonly description: "Sets the positive close-relative automatic-deletion duration on a retention root, or clears it with null. Forks and delegated children inherit the root policy and cannot override it.";
+    };
+    readonly "session/close": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "stop_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Close a session";
+        readonly description: "Closes an idle session and detaches its environment bindings. Force mode cancels active work, drops queued runs, and can recover a session whose workflow is unavailable.";
+    };
+    readonly "session/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "delete_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete closed sessions";
+        readonly description: "Permanently removes a closed retention-tree leaf, or its closed history-fork and delegated-child subtree when cascade is true. Config-only clones are never included.";
+    };
+    readonly "session/share": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "share_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Share a session with the universe";
+        readonly description: "Moves an unshared root session to universe visibility, one way; its delegated children follow it. Refused on a bot's session, a delegated child, and a session already shared. Core applies it for any caller of the method; who may share is the caller's gate's decision.";
+    };
+    readonly "session/events/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read the session event stream";
+        readonly description: "Returns chronological events. Forward (default) follows after and supports long-polling. Backward reads the latest window below before (or the head); pass nextCursor as before until complete. Follow live events after the initial backward headCursor. Windows may split runs/tool batches; keep historical reconstruction separate from live controls.";
+    };
+    readonly "session/context/append": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Append keyed session context";
+        readonly description: "Admits a batch of context entries with per-entry results. Stable keys make same-content retries no-ops; invalid input can fail one entry without discarding successful entries.";
+    };
+    readonly "session/context/remove": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Remove keyed session context";
+        readonly description: "Removes active entries by stable key with per-key results. Missing keys are idempotent no-ops; runtime-reserved run keys cannot be removed.";
+    };
+    readonly "session/context/replace": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Replace session context entries";
+        readonly description: "Replaces active tool results and user messages in place by entry id, with per-entry results, e.g. to withdraw content the provider rejects. Entries keep their ids, positions, and kinds, so a tool result takes only text and its call stays answered. Refused while a run is active; ids no longer in context report absent.";
+    };
+    readonly "session/context/compact": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Compact session context";
+        readonly description: "Performs one standalone compaction in any automatic mode, including Disabled, and waits for completion. Active work queues the operation until a safe turn boundary; automatic policy remains unchanged.";
+    };
+    readonly "session/runs/start": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Start an agent run";
+        readonly description: "Accepts input or existing context keys and returns once the run is accepted — queued behind an active run, or running — not when it finishes. Supply submissionId for retry safety, then follow session events or reread the session.";
+    };
+    readonly "session/runs/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List session runs";
+        readonly description: "Returns a newest-first keyset page of bounded run summaries projected from current reducer state.";
+    };
+    readonly "session/runs/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read one session run";
+        readonly description: "Reads and projects one run from its bounded event interval, paged by event sequence.";
+    };
+    readonly "session/runs/cancel": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "stop_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Cancel a run";
+        readonly description: "Requests cancellation of the named queued or active run and returns its current projected state; observe session events for terminal completion. In-flight model and tool activity is aborted; no grace turn runs.";
+    };
+    readonly "session/runs/approvals/decide": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Decide pending run approvals";
+        readonly description: "Approves or rejects pending MCP tool calls on the named active run. Valid decisions apply independently; the run resumes only after every pending approval has a decision.";
+    };
+    readonly "session/runs/steer": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Steer the active run";
+        readonly description: "Injects input into the named active run; the model sees it at the next turn boundary without interrupting the in-flight turn. Accepted while the run is running or parked on an await; rejected for queued, cancelling, or finished runs.";
+    };
+    readonly "session/skills/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List available session skills";
+        readonly description: "Returns separate VFS and environment catalogs with source, reference, availability, readable skill paths, and warnings. Refreshes only when open with no active or queued run, without waking environments. Absent catalogs are omitted.";
+    };
+    readonly "session/profiles/apply": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Apply a profile to a session";
+        readonly description: "Applies a named or inline profile's config, instructions, and environment setup to an existing session; mutating profile sections require it to be open and idle. Pass current revisions to guard concurrent changes.";
+    };
+    readonly "session/environments/activate": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Activate a session environment";
+        readonly description: "Selects an attached, live universe environment for environment-targeted tools while the session is idle.";
+    };
+    readonly "session/environments/deactivate": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "control_session";
+            readonly kind: "universe";
+        };
+        readonly summary: "Deactivate the session environment";
+        readonly description: "Clears active environment selection without changing or closing the universe environment.";
+    };
+    readonly "environments/credentials/bind": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Bind a credential into an environment";
+        readonly description: "Maps an environment variable name to an existing grant/provider/direct-secret handle for a universe environment. Requires configuring the environment and configuring resources in the universe. The response exposes only the source handle, never secret material.";
+    };
+    readonly "environments/credentials/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "List environment credential bindings";
+        readonly description: "Returns variable names and credential source handles for a universe environment; resolved secret values are never returned.";
+    };
+    readonly "environments/credentials/unbind": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Unbind an environment credential";
+        readonly description: "Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret.";
+    };
+    readonly "environments/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create an environment";
+        readonly description: "Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.";
+    };
+    readonly "environments/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an environment";
+        readonly description: "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.";
+    };
+    readonly "environments/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List environments";
+        readonly description: "Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.";
+    };
+    readonly "environments/close": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Close an environment";
+        readonly description: "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.";
+    };
+    readonly "environments/external/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Register an external environment";
+        readonly description: "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.";
+    };
+    readonly "environments/ingress/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Configure environment public ingress";
+        readonly description: "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.";
+    };
+    readonly "environments/power/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Set environment power intent";
+        readonly description: "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.";
+    };
+    readonly "environments/idle-policy/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Set environment idle policy";
+        readonly description: "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.";
+    };
+    readonly "environments/provider-bindings/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List environment provider bindings";
+        readonly description: "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.";
+    };
+    readonly "environments/provider-bindings/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an environment provider binding";
+        readonly description: "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.";
+    };
+    readonly "environments/templates/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List environment templates";
+        readonly description: "Reads immutable templates directly from the selected bound provider controller.";
+    };
+    readonly "environments/templates/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an environment template";
+        readonly description: "Returns one immutable template version from the selected bound provider controller.";
+    };
+    readonly "environments/jobs/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create environment jobs";
+        readonly description: "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.";
+    };
+    readonly "environments/jobs/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read environment jobs";
+        readonly description: "Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.";
+    };
+    readonly "environments/jobs/cancel": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Cancel environment jobs";
+        readonly description: "Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result.";
+    };
+    readonly "environments/registration-keys/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Mint an environment registration key";
+        readonly description: "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.";
+    };
+    readonly "environments/registration-keys/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an environment registration key";
+        readonly description: "Returns the key's display prefix, policy, status, and derived environment counts; never the secret or its hash.";
+    };
+    readonly "environments/registration-keys/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "List environment registration keys";
+        readonly description: "Lists this universe's registration keys with policy, status, and derived counts. Each key is the group of the environments it admitted.";
+    };
+    readonly "environments/registration-keys/revoke": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Revoke an environment registration key";
+        readonly description: "Stops the key from admitting new daemon identities; already registered daemons keep reconnecting. With closeEnvironments, also closes every non-closed environment the key admitted. Idempotent.";
+    };
+    readonly "transcriptions/start": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Start transcription";
+        readonly description: "Admit or rejoin a requester-scoped audio transcription. The resolved model is immutable. No session or run is created.";
+    };
+    readonly "transcriptions/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read transcription";
+        readonly description: "Read status and transcript text. An asserted actor may only read their own drafts; direct universe keys retain method-group authority. Unsubmitted CAS results may expire.";
+    };
+    readonly "transcriptions/cancel": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Cancel transcription";
+        readonly description: "Cancel unfinished transcription. Repeated cancellation is safe; completed results remain unchanged. An asserted actor may only cancel their own drafts; direct universe keys retain method-group authority.";
+    };
+    readonly "models/defaults/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read universe model defaults";
+        readonly description: "Returns the revision and independent agentRun and speechToText selections. Revision zero means no update has been made. Does not contact model providers.";
+    };
+    readonly "models/defaults/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Set a universe model default";
+        readonly description: "Sets or explicitly clears one purpose slot using its current expected revision. Existing sessions and admitted work keep their model. Validates the purpose and protocol without contacting provider discovery.";
+    };
+    readonly "models/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Discover available models";
+        readonly description: "Queries supported providers directly, with a brief process-local burst cache, and returns best-effort selectable routes. One provider failure does not discard successful results from others.";
+    };
+    readonly "profiles/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "create_profile";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create an agent profile";
+        readonly description: "Creates a new universe-scoped reusable profile document; use profiles/put for create-or-replace revision semantics.";
+    };
+    readonly "profiles/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an agent profile";
+        readonly description: "Returns the complete profile document and current revision.";
+    };
+    readonly "profiles/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List agent profiles";
+        readonly description: "Returns lightweight summaries of universe-scoped reusable profiles.";
+    };
+    readonly "profiles/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_profile";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or replace an agent profile";
+        readonly description: "Stores the complete profile document. Use expectedRevision from profiles/read when replacing to prevent lost updates; absence writes unconditionally.";
+    };
+    readonly "profiles/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_profile";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete an agent profile";
+        readonly description: "Deletes the catalog document; sessions previously created or configured from it retain their materialized state.";
+    };
+    readonly "blobs/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Store content-addressed blobs";
+        readonly description: "Decodes and stores a batch of base64 payloads, returning immutable content references in request order. Re-uploading identical bytes is naturally deduplicated.";
+    };
+    readonly "blobs/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a content-addressed blob";
+        readonly description: "Returns the complete immutable blob of this universe as base64; large values count against gateway and MCP response limits.";
+    };
+    readonly "blobs/has": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Check blob availability";
+        readonly description: "Checks a batch of content references without returning blob bodies, preserving request order.";
+    };
+    readonly "vfs/snapshots/commit": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Commit a VFS snapshot";
+        readonly description: "Validates and stores an immutable filesystem manifest. Upload referenced file blobs first; the returned snapshot ref is content-addressed.";
+    };
+    readonly "vfs/snapshots/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a VFS snapshot";
+        readonly description: "Returns an immutable snapshot manifest and aggregate file/byte counts; file bodies remain separate blobs.";
+    };
+    readonly "vfs/workspaces/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "create_workspace";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create a mutable VFS workspace";
+        readonly description: "Creates a universe workspace attributed to the caller at an optional seed snapshot; absence starts from a server-created empty snapshot.";
+    };
+    readonly "vfs/workspaces/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a VFS workspace";
+        readonly description: "Returns workspace metadata, current head snapshot, and revision for safe updates.";
+    };
+    readonly "vfs/workspaces/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List VFS workspaces";
+        readonly description: "Lists the mutable universe workspaces with head snapshots, sizes, and revisions.";
+    };
+    readonly "vfs/workspaces/update": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "use_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Update a VFS workspace";
+        readonly description: "Moves the workspace head to an existing snapshot, which requires use of the workspace, and updates its display name, which requires configuring it. Pass expectedRevision from a read to prevent lost updates.";
+    };
+    readonly "vfs/workspaces/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete a VFS workspace";
+        readonly description: "Deletes the mutable workspace record; immutable snapshots and blobs remain content-addressed resources.";
+    };
+    readonly "mcp/servers/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or replace an MCP server record";
+        readonly description: "Stores the complete catalog document with its optional auth-grant credential. A new server is attributed to the caller. Use expectedRevision when replacing; token material is never accepted or returned.";
+    };
+    readonly "mcp/servers/auth/discover": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Discover MCP server authentication";
+        readonly description: "Looks for standards-based OAuth protected-resource metadata without creating a server, OAuth client, flow, or grant. An absent OAuth result is inconclusive and callers must allow manual auth selection.";
+    };
+    readonly "mcp/servers/tools/discover": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Discover MCP server tools";
+        readonly description: "Connects directly to the configured MCP server with its current universe credential and returns one bounded live tools/list result. The inventory is never persisted or cached and no tool is invoked.";
+    };
+    readonly "mcp/servers/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an MCP server record";
+        readonly description: "Returns one catalog document with defaults, auth policy, non-secret grant binding, status, and revision; no credential value is exposed.";
+    };
+    readonly "mcp/servers/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List MCP server records";
+        readonly description: "Lists the universe catalog entries, optionally filtered by lifecycle/configuration status.";
+    };
+    readonly "mcp/servers/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete an MCP server record";
+        readonly description: "Deletes the catalog document. Existing session configs that reference it are not silently rewritten and may need explicit reconfiguration.";
+    };
+    readonly "auth/grants/import": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Import a static bearer grant";
+        readonly description: "Accepts a plaintext token, encrypts it immediately, and returns only grant metadata/token-presence flags. Brokered is the default; retrievable exposure is immutable and permits service-only leases.";
+    };
+    readonly "auth/grants/lease": {
+        readonly scope: "service";
+        readonly access: {
+            readonly kind: "service";
+        };
+        readonly summary: "Lease a retrievable authentication grant";
+        readonly description: "Service callers only. Resolves the current access token through the broker, records the lease, and returns it once. Cache only in memory until expiry minus margin (or at most five minutes without expiry), re-lease after target 401/403, and never persist or place the token in workflow payloads.";
+    };
+    readonly "auth/grants/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read authentication grant metadata";
+        readonly description: "Returns creator attribution, provider binding, scopes, audience, expiry, status, and token-presence flags; access and refresh token values are never returned.";
+    };
+    readonly "auth/grants/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List authentication grants";
+        readonly description: "Lists non-secret grant metadata for the universe, optionally filtered by status.";
+    };
+    readonly "auth/grants/revoke": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Revoke an authentication grant";
+        readonly description: "Marks the grant unusable by token consumers while retaining non-secret audit metadata.";
+    };
+    readonly "auth/clients/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Register an OAuth client";
+        readonly description: "Stores provider endpoints and client identity; an optional plaintext client secret is encrypted and represented thereafter only by hasClientSecret.";
+    };
+    readonly "auth/clients/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read OAuth client metadata";
+        readonly description: "Returns endpoints, public client identity, defaults, and secret-presence state; the client secret is never returned.";
+    };
+    readonly "auth/clients/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List OAuth clients";
+        readonly description: "Lists non-secret OAuth client registrations in the universe.";
+    };
+    readonly "auth/clients/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete an OAuth client";
+        readonly description: "Deletes the client registration and its stored client secret; grants already created from it remain separate records.";
+    };
+    readonly "auth/flows/start": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Start an OAuth authorization flow";
+        readonly description: "Creates a short-lived PKCE flow carrying the immutable grant exposure choice and returns a browser authorization URL containing one-time state. Treat the URL as sensitive and poll auth/flows/read for completion.";
+    };
+    readonly "auth/flows/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read OAuth flow status";
+        readonly description: "Polls a flow's pending/completed/failed/expired state and returns the resulting grant id when authorization succeeds; no token value is exposed.";
+    };
+    readonly "auth/providers/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Register an authentication provider";
+        readonly description: "Creates a model or GitHub credential source. Plaintext API keys/private keys are encrypted on receipt and later represented only by configuration plus hasCredential.";
+    };
+    readonly "auth/providers/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read authentication provider metadata";
+        readonly description: "Returns provider kind, non-secret configuration, credential-presence state, and status; stored credentials are never returned.";
+    };
+    readonly "auth/providers/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List authentication providers";
+        readonly description: "Lists non-secret model/GitHub provider registrations for the universe.";
+    };
+    readonly "auth/providers/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete an authentication provider";
+        readonly description: "Deletes the provider registration and its directly stored credential; separately stored grants remain independent records.";
+    };
+    readonly "auth/github/installations/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "List GitHub App installations";
+        readonly description: "Uses the registered GitHub App provider credential to query accessible installations and returns account/permission metadata without tokens.";
+    };
+    readonly "auth/github/installations/grant": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Grant access to a GitHub App installation";
+        readonly description: "Creates or refreshes a universe auth grant for one accessible installation. The installation token is brokered internally and never returned.";
+    };
+    readonly "bots/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "create_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create a bot";
+        readonly description: "Creates the bot record, optionally with its triggers, and starts its controller. Fails if the bot id exists; a trigger failure rolls the bot back.";
+    };
+    readonly "bots/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or replace a bot document";
+        readonly description: "Replaces the mutable configuration whole and signals the controller, which applies it at its next idle boundary. Pass expectedRevision when replacing; a closed bot accepts label-only edits.";
+    };
+    readonly "bots/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a bot";
+        readonly description: "Returns the bot record, its current revision, and lifecycle columns.";
+    };
+    readonly "bots/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List bots";
+        readonly description: "Returns the roster: every bot with its trigger count, pending event count, and latest event, optionally narrowed by createdBy.";
+    };
+    readonly "bots/close": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Close a bot";
+        readonly description: "Terminal and idempotent: disables every trigger, drops schedules, and tells the controller to archive pending events and force-close its sessions. Returns once signalled; follow bots/state/read for closing to closed.";
+    };
+    readonly "bots/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete a bot";
+        readonly description: "Closes the bot if needed, waits for its controller to complete, deletes the sessions it closed, and removes the record so the bot id is free again.";
+    };
+    readonly "bots/state/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read bot controller state";
+        readonly description: "Queries the controller workflow for its live snapshot (sessions, buffers, active and recent deliveries, budget) and lists sub-agent descendants. The controller is absent until the bot's first event.";
+    };
+    readonly "bots/sessions/rotate": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Rotate a bot session";
+        readonly description: "Asks the controller to close one of the bot's sessions at its next idle boundary and continue on a fresh generation; queued deliveries follow.";
+    };
+    readonly "bots/triggers/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or replace a trigger";
+        readonly description: "Validates the trigger document (CEL parses, grants exist, one inbox per bot, chat routes per conversation), reconciles its Temporal Schedule, and stores it. A poll spec edit resets the cursor; a webhook keeps its URL token.";
+    };
+    readonly "bots/triggers/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a trigger";
+        readonly description: "Returns one trigger with its incidents and cursor; the ingest path and pairing code are included for bot-management callers.";
+    };
+    readonly "bots/triggers/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List a bot's triggers";
+        readonly description: "Returns every trigger of the bot ordered by id, secrets included for bot-management callers.";
+    };
+    readonly "bots/triggers/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete a trigger";
+        readonly description: "Drops the trigger's Temporal Schedule and pairings, then the record; stored events keep their history.";
+    };
+    readonly "bots/events/admit": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "invoke_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Admit an event manually";
+        readonly description: "Stores an operator-authored event for the bot's main session and wakes the controller. eventId is the dedupe identity; a duplicate returns the stored row.";
+    };
+    readonly "bots/events/replay": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Replay a stored event";
+        readonly description: "Re-admits the stored envelope as a fresh event with the original routing; the replay never coalesces.";
+    };
+    readonly "bots/events/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List a bot's events";
+        readonly description: "Cursor-paginated event log, newest first, with outcomes; payload documents stay in the CAS.";
+    };
+    readonly "bots/events/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read an event by number";
+        readonly description: "Returns the event row and its full stored envelope document.";
+    };
+    readonly "bots/filters/test": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "manage_bot";
+            readonly kind: "universe";
+        };
+        readonly summary: "Test a CEL filter";
+        readonly description: "Evaluates a filter against one payload or a sample of recent stored events, reporting matches and evaluation errors without changing anything.";
+    };
+    readonly "channels/accounts/create": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create a channel account";
+        readonly description: "Registers a provider account (Telegram, WhatsApp) for this universe. The credential is a retrievable grant reference; no token is accepted here.";
+    };
+    readonly "channels/accounts/put": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Create or replace a channel account";
+        readonly description: "Replaces the account document whole; pass expectedRevision when replacing. The connector host picks the change up on its next discovery pass.";
+    };
+    readonly "channels/accounts/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a channel account";
+        readonly description: "Returns the account document and revision.";
+    };
+    readonly "channels/accounts/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List channel accounts";
+        readonly description: "Lists this universe's provider accounts, optionally by provider.";
+    };
+    readonly "channels/accounts/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Delete a channel account";
+        readonly description: "Removes the account and its pairings; chat triggers that reference it stop serving conversations.";
+    };
+    readonly "channels/inbound/admit": {
+        readonly scope: "service";
+        readonly access: {
+            readonly kind: "service";
+        };
+        readonly summary: "Admit a provider message";
+        readonly description: "Service callers only. Resolves the chat trigger for the conversation, applies pairing, and signals the conversation workflow. Returns the decision so the connector can send pairing prompts itself; acknowledge the provider only after this returns.";
+    };
+    readonly "channels/pairings/list": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "List chat pairings";
+        readonly description: "Lists conversations paired to chat triggers, optionally by account or bot.";
+    };
+    readonly "channels/pairings/delete": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "configure_resource";
+            readonly kind: "universe";
+        };
+        readonly summary: "Unpair a conversation";
+        readonly description: "Removes one pairing; the conversation must present the pairing code again to reconnect.";
+    };
+    readonly "channels/conversations/read": {
+        readonly scope: "universe";
+        readonly access: {
+            readonly action: "read";
+            readonly kind: "universe";
+        };
+        readonly summary: "Read a conversation snapshot";
+        readonly description: "Queries the conversation workflow's live state for one chat, for debugging; absent when no workflow exists yet.";
+    };
+    readonly "deployment/environment-provider-bindings/list": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "List a universe's deployment provider bindings";
+        readonly description: "Deployment configuration inventory of one universe's provider bindings.";
+    };
+    readonly "deployment/universes/create": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Create a universe";
+        readonly description: "Creates the deployment tenant boundary for an explicit UUID. The operation is idempotent and reports whether a new universe was created.";
+    };
+    readonly "deployment/universes/list": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "List universes";
+        readonly description: "Returns deployment-wide universe summaries with approximate live aggregate counts and last session activity.";
+    };
+    readonly "deployment/universes/read": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Read a universe";
+        readonly description: "Returns one deployment tenant summary with aggregate session, workspace, profile, and blob usage.";
+    };
+    readonly "deployment/universes/slug/put": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Set a universe slug";
+        readonly description: "Sets or changes a deployment-unique slug without changing the universe UUID or resources. The previous slug is released and old URLs may stop working. With onlyIfUnset, a different existing slug is a conflict. Claiming another universe's slug also returns a conflict. Does not create a universe.";
+    };
+    readonly "deployment/universes/delete": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Purge a universe";
+        readonly description: "Permanently terminates live session workflows, deletes external blob objects, and cascades universe data. The purge is resumable/idempotent after partial failure.";
+    };
+    readonly "deployment/api-keys/create": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Create a scoped API key";
+        readonly description: "Mints a key for a universe or the deployment with the method groups it may call and whether it may assert actors. The plaintext secret is returned exactly once and cannot be recovered; persist only the displayed prefix for identification. Key authority is immutable: revoke and mint to change what one may do.";
+    };
+    readonly "deployment/api-keys/list": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "List scoped API keys";
+        readonly description: "Returns non-secret key metadata, all keys or those of one scope, including groups, revocation and last-use timestamps. Plaintext secrets are never stored or returned.";
+    };
+    readonly "deployment/api-keys/rotate": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Rotate a scoped API key";
+        readonly description: "Atomically replaces an active key secret and display prefix, immediately rejecting the old secret on subsequent requests. Preserves scope, groups, actor authority, name, creator and creation time; clears last use. Returns the new secret once. Unknown or revoked prefixes are not found. Already admitted work continues.";
+    };
+    readonly "deployment/api-keys/revoke": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Revoke a scoped API key";
+        readonly description: "Revokes the key with this display prefix; revoking a revoked key keeps its first revocation time. An unknown prefix is not found.";
+    };
+    readonly "deployment/environment-providers/put": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Put an environment provider";
+        readonly description: "Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.";
+    };
+    readonly "deployment/environment-providers/list": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "List environment providers";
+        readonly description: "Returns every deployment-registered deployment provider and its controller connection.";
+    };
+    readonly "deployment/environment-providers/read": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Read an environment provider";
+        readonly description: "Returns one deployment-registered deployment provider and its controller connection.";
+    };
+    readonly "deployment/environment-providers/delete": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Delete an environment provider";
+        readonly description: "Deletes a deployment provider only when no universe binding references it.";
+    };
+    readonly "deployment/environment-providers/bindings/put": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Put an environment provider binding";
+        readonly description: "Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.";
+    };
+    readonly "deployment/environment-providers/bindings/delete": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Delete an environment provider binding";
+        readonly description: "Deletes a universe provider binding only after every referencing environment has reached Closed.";
+    };
+    readonly "deployment/environments/adopt": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "Adopt a provider environment";
+        readonly description: "Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.";
+    };
+    readonly "deployment/channels/accounts/list": {
+        readonly scope: "deployment";
+        readonly access: {
+            readonly kind: "deployment";
+        };
+        readonly summary: "List channel accounts across universes";
+        readonly description: "The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.";
+    };
+};
+export declare const NOTIFICATIONS: readonly ["session/started", "session/status/changed", "session/event", "session/runs/started", "session/runs/completed", "error"];
+export type Method = (typeof METHODS)[number];
+export type NotificationMethod = (typeof NOTIFICATIONS)[number];
+export interface MethodMap {
+    /**
+     * Read a workspace file
+     *
+     * Reads bytes at a path in the current workspace head.
+     */
+    "vfs/workspaces/files/read": {
+        params: Api.VfsWorkspaceFileReadParams;
+        result: Api.AgentApiOutcomeOfBlobReadResponse;
+    };
+    /**
+     * Inspect the Lightspeed protocol
+     *
+     * Returns protocol version, server identity, credential scope and allowed groups before universe selection. Requires authentication in authenticated mode; no universe header is accepted.
+     */
+    "initialize": {
+        params: Api.InitializeParams;
+        result: Api.AgentApiOutcomeOfInitializeResponse;
+    };
+    /**
+     * Create or reopen a session
+     *
+     * Creates a session, unshared unless access says universe, with optional config/profile setup. Profile metadata and retention supply defaults that explicit values override; the config's default environment attachment becomes active. Retrying an existing id returns that session and keeps its audience.
+     */
+    "session/start": {
+        params: Api.SessionStartParams;
+        result: Api.AgentApiOutcomeOfSessionStartResponse;
+    };
+    /**
+     * Create or reopen a managed session
+     *
+     * Creates a session with immutable lifecycle and workflow-tool declarations using explicit bound dispatch. Profile metadata, retention, and default environment attachment selection follow session/start semantics. Retrying an id requires the same managed declaration; an ordinary session cannot be upgraded.
+     */
+    "session/managed/start": {
+        params: Api.ManagedSessionStartParams;
+        result: Api.AgentApiOutcomeOfSessionStartResponse;
+    };
+    /**
+     * Read a session
+     *
+     * Returns current state plus a bounded newest-first run-summary page. Follow nextRunCursor with session/runs/list when hasOlderRuns is true; use session/events/read for the transcript.
+     */
+    "session/read": {
+        params: Api.SessionReadParams;
+        result: Api.AgentApiOutcomeOfSessionReadResponse;
+    };
+    /**
+     * List sessions
+     *
+     * Returns a cursor-paginated summary list ordered by most recent update, optionally narrowed by the audience of each session's root: createdBy, visibility, or visibleTo (shared with the universe or created by that actor). Pages may shift while sessions are changing.
+     */
+    "session/list": {
+        params: Api.SessionListParams;
+        result: Api.AgentApiOutcomeOfSessionListResponse;
+    };
+    /**
+     * Replace session configuration
+     *
+     * Replaces the complete sparse config while the session is idle. Use the current config revision for safe read-modify-write; omitted features are revoked, an omitted model preserves the current model, and an identical document is a no-op.
+     */
+    "session/config/put": {
+        params: Api.SessionConfigPutParams;
+        result: Api.AgentApiOutcomeOfSessionConfigPutResponse;
+    };
+    /**
+     * Rename a session
+     *
+     * Sets the display name, or clears it when displayName is omitted.
+     */
+    "session/rename": {
+        params: Api.SessionRenameParams;
+        result: Api.AgentApiOutcomeOfSessionRenameResponse;
+    };
+    /**
+     * Replace session metadata
+     *
+     * Replaces the complete descriptive key/value map (bounded like session/start); an omitted or empty map clears it. Record-only: the event log and updatedAtMs are untouched.
+     */
+    "session/metadata/put": {
+        params: Api.SessionMetadataPutParams;
+        result: Api.AgentApiOutcomeOfSessionMetadataPutResponse;
+    };
+    /**
+     * Replace session retention
+     *
+     * Sets the positive close-relative automatic-deletion duration on a retention root, or clears it with null. Forks and delegated children inherit the root policy and cannot override it.
+     */
+    "session/retention/put": {
+        params: Api.SessionRetentionPutParams;
+        result: Api.AgentApiOutcomeOfSessionRetentionPutResponse;
+    };
+    /**
+     * Close a session
+     *
+     * Closes an idle session and detaches its environment bindings. Force mode cancels active work, drops queued runs, and can recover a session whose workflow is unavailable.
+     */
+    "session/close": {
+        params: Api.SessionCloseParams;
+        result: Api.AgentApiOutcomeOfSessionCloseResponse;
+    };
+    /**
+     * Delete closed sessions
+     *
+     * Permanently removes a closed retention-tree leaf, or its closed history-fork and delegated-child subtree when cascade is true. Config-only clones are never included.
+     */
+    "session/delete": {
+        params: Api.SessionDeleteParams;
+        result: Api.AgentApiOutcomeOfSessionDeleteResponse;
+    };
+    /**
+     * Share a session with the universe
+     *
+     * Moves an unshared root session to universe visibility, one way; its delegated children follow it. Refused on a bot's session, a delegated child, and a session already shared. Core applies it for any caller of the method; who may share is the caller's gate's decision.
+     */
+    "session/share": {
+        params: Api.SessionShareParams;
+        result: Api.AgentApiOutcomeOfSessionShareResponse;
+    };
+    /**
+     * Read the session event stream
+     *
+     * Returns chronological events. Forward (default) follows after and supports long-polling. Backward reads the latest window below before (or the head); pass nextCursor as before until complete. Follow live events after the initial backward headCursor. Windows may split runs/tool batches; keep historical reconstruction separate from live controls.
+     */
+    "session/events/read": {
+        params: Api.SessionEventsReadParams;
+        result: Api.AgentApiOutcomeOfSessionEventsReadResponse;
+    };
+    /**
+     * Append keyed session context
+     *
+     * Admits a batch of context entries with per-entry results. Stable keys make same-content retries no-ops; invalid input can fail one entry without discarding successful entries.
+     */
+    "session/context/append": {
+        params: Api.ContextAppendParams;
+        result: Api.AgentApiOutcomeOfContextAppendResponse;
+    };
+    /**
+     * Remove keyed session context
+     *
+     * Removes active entries by stable key with per-key results. Missing keys are idempotent no-ops; runtime-reserved run keys cannot be removed.
+     */
+    "session/context/remove": {
+        params: Api.ContextRemoveParams;
+        result: Api.AgentApiOutcomeOfContextRemoveResponse;
+    };
+    /**
+     * Replace session context entries
+     *
+     * Replaces active tool results and user messages in place by entry id, with per-entry results, e.g. to withdraw content the provider rejects. Entries keep their ids, positions, and kinds, so a tool result takes only text and its call stays answered. Refused while a run is active; ids no longer in context report absent.
+     */
+    "session/context/replace": {
+        params: Api.ContextReplaceParams;
+        result: Api.AgentApiOutcomeOfContextReplaceResponse;
+    };
+    /**
+     * Compact session context
+     *
+     * Performs one standalone compaction in any automatic mode, including Disabled, and waits for completion. Active work queues the operation until a safe turn boundary; automatic policy remains unchanged.
+     */
+    "session/context/compact": {
+        params: Api.ContextCompactParams;
+        result: Api.AgentApiOutcomeOfContextCompactResponse;
+    };
+    /**
+     * Start an agent run
+     *
+     * Accepts input or existing context keys and returns once the run is accepted — queued behind an active run, or running — not when it finishes. Supply submissionId for retry safety, then follow session events or reread the session.
+     */
+    "session/runs/start": {
+        params: Api.RunStartParams;
+        result: Api.AgentApiOutcomeOfRunStartResponse;
+    };
+    /**
+     * List session runs
+     *
+     * Returns a newest-first keyset page of bounded run summaries projected from current reducer state.
+     */
+    "session/runs/list": {
+        params: Api.RunListParams;
+        result: Api.AgentApiOutcomeOfRunListResponse;
+    };
+    /**
+     * Read one session run
+     *
+     * Reads and projects one run from its bounded event interval, paged by event sequence.
+     */
+    "session/runs/read": {
+        params: Api.RunReadParams;
+        result: Api.AgentApiOutcomeOfRunReadResponse;
+    };
+    /**
+     * Cancel a run
+     *
+     * Requests cancellation of the named queued or active run and returns its current projected state; observe session events for terminal completion. In-flight model and tool activity is aborted; no grace turn runs.
+     */
+    "session/runs/cancel": {
+        params: Api.RunCancelParams;
+        result: Api.AgentApiOutcomeOfRunCancelResponse;
+    };
+    /**
+     * Decide pending run approvals
+     *
+     * Approves or rejects pending MCP tool calls on the named active run. Valid decisions apply independently; the run resumes only after every pending approval has a decision.
+     */
+    "session/runs/approvals/decide": {
+        params: Api.RunApprovalsDecideParams;
+        result: Api.AgentApiOutcomeOfRunApprovalsDecideResponse;
+    };
+    /**
+     * Steer the active run
+     *
+     * Injects input into the named active run; the model sees it at the next turn boundary without interrupting the in-flight turn. Accepted while the run is running or parked on an await; rejected for queued, cancelling, or finished runs.
+     */
+    "session/runs/steer": {
+        params: Api.RunSteerParams;
+        result: Api.AgentApiOutcomeOfRunSteerResponse;
+    };
+    /**
+     * List available session skills
+     *
+     * Returns separate VFS and environment catalogs with source, reference, availability, readable skill paths, and warnings. Refreshes only when open with no active or queued run, without waking environments. Absent catalogs are omitted.
+     */
+    "session/skills/list": {
+        params: Api.SkillListParams;
+        result: Api.AgentApiOutcomeOfSkillListResponse;
+    };
+    /**
+     * Apply a profile to a session
+     *
+     * Applies a named or inline profile's config, instructions, and environment setup to an existing session; mutating profile sections require it to be open and idle. Pass current revisions to guard concurrent changes.
+     */
+    "session/profiles/apply": {
+        params: Api.ProfileApplyParams;
+        result: Api.AgentApiOutcomeOfProfileApplyResponse;
+    };
+    /**
+     * Activate a session environment
+     *
+     * Selects an attached, live universe environment for environment-targeted tools while the session is idle.
+     */
+    "session/environments/activate": {
+        params: Api.SessionEnvironmentActivateParams;
+        result: Api.AgentApiOutcomeOfSessionEnvironmentActivateResponse;
+    };
+    /**
+     * Deactivate the session environment
+     *
+     * Clears active environment selection without changing or closing the universe environment.
+     */
+    "session/environments/deactivate": {
+        params: Api.SessionEnvironmentDeactivateParams;
+        result: Api.AgentApiOutcomeOfSessionEnvironmentDeactivateResponse;
+    };
+    /**
+     * Bind a credential into an environment
+     *
+     * Maps an environment variable name to an existing grant/provider/direct-secret handle for a universe environment. Requires configuring the environment and configuring resources in the universe. The response exposes only the source handle, never secret material.
+     */
+    "environments/credentials/bind": {
+        params: Api.EnvironmentCredentialBindParams;
+        result: Api.AgentApiOutcomeOfEnvironmentCredentialBindResponse;
+    };
+    /**
+     * List environment credential bindings
+     *
+     * Returns variable names and credential source handles for a universe environment; resolved secret values are never returned.
+     */
+    "environments/credentials/list": {
+        params: Api.EnvironmentCredentialListParams;
+        result: Api.AgentApiOutcomeOfEnvironmentCredentialListResponse;
+    };
+    /**
+     * Unbind an environment credential
+     *
+     * Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret.
+     */
+    "environments/credentials/unbind": {
+        params: Api.EnvironmentCredentialUnbindParams;
+        result: Api.AgentApiOutcomeOfEnvironmentCredentialUnbindResponse;
+    };
+    /**
+     * Create an environment
+     *
+     * Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.
+     */
+    "environments/create": {
+        params: Api.EnvironmentCreateParams;
+        result: Api.AgentApiOutcomeOfEnvironmentCreateResponse;
+    };
+    /**
+     * Read an environment
+     *
+     * Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+     */
+    "environments/read": {
+        params: Api.EnvironmentReadParams;
+        result: Api.AgentApiOutcomeOfEnvironmentReadResponse;
+    };
+    /**
+     * List environments
+     *
+     * Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.
+     */
+    "environments/list": {
+        params: Api.EnvironmentListParams;
+        result: Api.AgentApiOutcomeOfEnvironmentListResponse;
+    };
+    /**
+     * Close an environment
+     *
+     * Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+     */
+    "environments/close": {
+        params: Api.EnvironmentCloseParams;
+        result: Api.AgentApiOutcomeOfEnvironmentCloseResponse;
+    };
+    /**
+     * Register an external environment
+     *
+     * Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.
+     */
+    "environments/external/create": {
+        params: Api.EnvironmentExternalCreateParams;
+        result: Api.AgentApiOutcomeOfEnvironmentExternalCreateResponse;
+    };
+    /**
+     * Configure environment public ingress
+     *
+     * Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+     */
+    "environments/ingress/put": {
+        params: Api.EnvironmentIngressPutParams;
+        result: Api.AgentApiOutcomeOfEnvironmentIngressPutResponse;
+    };
+    /**
+     * Set environment power intent
+     *
+     * Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+     */
+    "environments/power/put": {
+        params: Api.EnvironmentPowerPutParams;
+        result: Api.AgentApiOutcomeOfEnvironmentPowerPutResponse;
+    };
+    /**
+     * Set environment idle policy
+     *
+     * Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
+     */
+    "environments/idle-policy/put": {
+        params: Api.EnvironmentIdlePolicyPutParams;
+        result: Api.AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse;
+    };
+    /**
+     * List environment provider bindings
+     *
+     * Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+     */
+    "environments/provider-bindings/list": {
+        params: Api.EnvironmentProviderBindingListParams;
+        result: Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse;
+    };
+    /**
+     * Read an environment provider binding
+     *
+     * Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+     */
+    "environments/provider-bindings/read": {
+        params: Api.EnvironmentProviderBindingReadParams;
+        result: Api.AgentApiOutcomeOfEnvironmentProviderBindingReadResponse;
+    };
+    /**
+     * List environment templates
+     *
+     * Reads immutable templates directly from the selected bound provider controller.
+     */
+    "environments/templates/list": {
+        params: Api.EnvironmentTemplateListParams;
+        result: Api.AgentApiOutcomeOfEnvironmentTemplateListResponse;
+    };
+    /**
+     * Read an environment template
+     *
+     * Returns one immutable template version from the selected bound provider controller.
+     */
+    "environments/templates/read": {
+        params: Api.EnvironmentTemplateReadParams;
+        result: Api.AgentApiOutcomeOfEnvironmentTemplateReadResponse;
+    };
+    /**
+     * Create environment jobs
+     *
+     * Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+     */
+    "environments/jobs/create": {
+        params: Api.EnvironmentJobCreateParams;
+        result: Api.AgentApiOutcomeOfEnvironmentJobCreateResponse;
+    };
+    /**
+     * Read environment jobs
+     *
+     * Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+     */
+    "environments/jobs/read": {
+        params: Api.EnvironmentJobReadParams;
+        result: Api.AgentApiOutcomeOfEnvironmentJobReadResponse;
+    };
+    /**
+     * Cancel environment jobs
+     *
+     * Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result.
+     */
+    "environments/jobs/cancel": {
+        params: Api.EnvironmentJobCancelParams;
+        result: Api.AgentApiOutcomeOfEnvironmentJobCancelResponse;
+    };
+    /**
+     * Mint an environment registration key
+     *
+     * Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.
+     */
+    "environments/registration-keys/create": {
+        params: Api.EnvironmentRegistrationKeyCreateParams;
+        result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyCreateResponse;
+    };
+    /**
+     * Read an environment registration key
+     *
+     * Returns the key's display prefix, policy, status, and derived environment counts; never the secret or its hash.
+     */
+    "environments/registration-keys/read": {
+        params: Api.EnvironmentRegistrationKeyReadParams;
+        result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyReadResponse;
+    };
+    /**
+     * List environment registration keys
+     *
+     * Lists this universe's registration keys with policy, status, and derived counts. Each key is the group of the environments it admitted.
+     */
+    "environments/registration-keys/list": {
+        params: Api.EnvironmentRegistrationKeyListParams;
+        result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyListResponse;
+    };
+    /**
+     * Revoke an environment registration key
+     *
+     * Stops the key from admitting new daemon identities; already registered daemons keep reconnecting. With closeEnvironments, also closes every non-closed environment the key admitted. Idempotent.
+     */
+    "environments/registration-keys/revoke": {
+        params: Api.EnvironmentRegistrationKeyRevokeParams;
+        result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyRevokeResponse;
+    };
+    /**
+     * Start transcription
+     *
+     * Admit or rejoin a requester-scoped audio transcription. The resolved model is immutable. No session or run is created.
+     */
+    "transcriptions/start": {
+        params: Api.TranscriptionStartParams;
+        result: Api.AgentApiOutcomeOfTranscriptionResponse;
+    };
+    /**
+     * Read transcription
+     *
+     * Read status and transcript text. An asserted actor may only read their own drafts; direct universe keys retain method-group authority. Unsubmitted CAS results may expire.
+     */
+    "transcriptions/read": {
+        params: Api.TranscriptionReadParams;
+        result: Api.AgentApiOutcomeOfTranscriptionResponse;
+    };
+    /**
+     * Cancel transcription
+     *
+     * Cancel unfinished transcription. Repeated cancellation is safe; completed results remain unchanged. An asserted actor may only cancel their own drafts; direct universe keys retain method-group authority.
+     */
+    "transcriptions/cancel": {
+        params: Api.TranscriptionCancelParams;
+        result: Api.AgentApiOutcomeOfTranscriptionResponse;
+    };
+    /**
+     * Read universe model defaults
+     *
+     * Returns the revision and independent agentRun and speechToText selections. Revision zero means no update has been made. Does not contact model providers.
+     */
+    "models/defaults/read": {
+        params: Api.ModelDefaultsReadParams;
+        result: Api.AgentApiOutcomeOfModelDefaultsResponse;
+    };
+    /**
+     * Set a universe model default
+     *
+     * Sets or explicitly clears one purpose slot using its current expected revision. Existing sessions and admitted work keep their model. Validates the purpose and protocol without contacting provider discovery.
+     */
+    "models/defaults/put": {
+        params: Api.ModelDefaultsPutParams;
+        result: Api.AgentApiOutcomeOfModelDefaultsResponse;
+    };
+    /**
+     * Discover available models
+     *
+     * Queries supported providers directly, with a brief process-local burst cache, and returns best-effort selectable routes. One provider failure does not discard successful results from others.
+     */
+    "models/list": {
+        params: Api.ModelListParams;
+        result: Api.AgentApiOutcomeOfModelListResponse;
+    };
+    /**
+     * Create an agent profile
+     *
+     * Creates a new universe-scoped reusable profile document; use profiles/put for create-or-replace revision semantics.
+     */
+    "profiles/create": {
+        params: Api.ProfileCreateParams;
+        result: Api.AgentApiOutcomeOfProfileCreateResponse;
+    };
+    /**
+     * Read an agent profile
+     *
+     * Returns the complete profile document and current revision.
+     */
+    "profiles/read": {
+        params: Api.ProfileReadParams;
+        result: Api.AgentApiOutcomeOfProfileReadResponse;
+    };
+    /**
+     * List agent profiles
+     *
+     * Returns lightweight summaries of universe-scoped reusable profiles.
+     */
+    "profiles/list": {
+        params: Api.ProfileListParams;
+        result: Api.AgentApiOutcomeOfProfileListResponse;
+    };
+    /**
+     * Create or replace an agent profile
+     *
+     * Stores the complete profile document. Use expectedRevision from profiles/read when replacing to prevent lost updates; absence writes unconditionally.
+     */
+    "profiles/put": {
+        params: Api.ProfilePutParams;
+        result: Api.AgentApiOutcomeOfProfilePutResponse;
+    };
+    /**
+     * Delete an agent profile
+     *
+     * Deletes the catalog document; sessions previously created or configured from it retain their materialized state.
+     */
+    "profiles/delete": {
+        params: Api.ProfileDeleteParams;
+        result: Api.AgentApiOutcomeOfProfileDeleteResponse;
+    };
+    /**
+     * Store content-addressed blobs
+     *
+     * Decodes and stores a batch of base64 payloads, returning immutable content references in request order. Re-uploading identical bytes is naturally deduplicated.
+     */
+    "blobs/put": {
+        params: Api.BlobPutParams;
+        result: Api.AgentApiOutcomeOfBlobPutResponse;
+    };
+    /**
+     * Read a content-addressed blob
+     *
+     * Returns the complete immutable blob of this universe as base64; large values count against gateway and MCP response limits.
+     */
+    "blobs/read": {
+        params: Api.BlobReadParams;
+        result: Api.AgentApiOutcomeOfBlobReadResponse;
+    };
+    /**
+     * Check blob availability
+     *
+     * Checks a batch of content references without returning blob bodies, preserving request order.
+     */
+    "blobs/has": {
+        params: Api.BlobHasParams;
+        result: Api.AgentApiOutcomeOfBlobHasResponse;
+    };
+    /**
+     * Commit a VFS snapshot
+     *
+     * Validates and stores an immutable filesystem manifest. Upload referenced file blobs first; the returned snapshot ref is content-addressed.
+     */
+    "vfs/snapshots/commit": {
+        params: Api.VfsSnapshotCommitParams;
+        result: Api.AgentApiOutcomeOfVfsSnapshotCommitResponse;
+    };
+    /**
+     * Read a VFS snapshot
+     *
+     * Returns an immutable snapshot manifest and aggregate file/byte counts; file bodies remain separate blobs.
+     */
+    "vfs/snapshots/read": {
+        params: Api.VfsSnapshotReadParams;
+        result: Api.AgentApiOutcomeOfVfsSnapshotReadResponse;
+    };
+    /**
+     * Create a mutable VFS workspace
+     *
+     * Creates a universe workspace attributed to the caller at an optional seed snapshot; absence starts from a server-created empty snapshot.
+     */
+    "vfs/workspaces/create": {
+        params: Api.VfsWorkspaceCreateParams;
+        result: Api.AgentApiOutcomeOfVfsWorkspaceCreateResponse;
+    };
+    /**
+     * Read a VFS workspace
+     *
+     * Returns workspace metadata, current head snapshot, and revision for safe updates.
+     */
+    "vfs/workspaces/read": {
+        params: Api.VfsWorkspaceReadParams;
+        result: Api.AgentApiOutcomeOfVfsWorkspaceReadResponse;
+    };
+    /**
+     * List VFS workspaces
+     *
+     * Lists the mutable universe workspaces with head snapshots, sizes, and revisions.
+     */
+    "vfs/workspaces/list": {
+        params: Api.VfsWorkspaceListParams;
+        result: Api.AgentApiOutcomeOfVfsWorkspaceListResponse;
+    };
+    /**
+     * Update a VFS workspace
+     *
+     * Moves the workspace head to an existing snapshot, which requires use of the workspace, and updates its display name, which requires configuring it. Pass expectedRevision from a read to prevent lost updates.
+     */
+    "vfs/workspaces/update": {
+        params: Api.VfsWorkspaceUpdateParams;
+        result: Api.AgentApiOutcomeOfVfsWorkspaceUpdateResponse;
+    };
+    /**
+     * Delete a VFS workspace
+     *
+     * Deletes the mutable workspace record; immutable snapshots and blobs remain content-addressed resources.
+     */
+    "vfs/workspaces/delete": {
+        params: Api.VfsWorkspaceDeleteParams;
+        result: Api.AgentApiOutcomeOfVfsWorkspaceDeleteResponse;
+    };
+    /**
+     * Create or replace an MCP server record
+     *
+     * Stores the complete catalog document with its optional auth-grant credential. A new server is attributed to the caller. Use expectedRevision when replacing; token material is never accepted or returned.
+     */
+    "mcp/servers/put": {
+        params: Api.McpServerPutParams;
+        result: Api.AgentApiOutcomeOfMcpServerPutResponse;
+    };
+    /**
+     * Discover MCP server authentication
+     *
+     * Looks for standards-based OAuth protected-resource metadata without creating a server, OAuth client, flow, or grant. An absent OAuth result is inconclusive and callers must allow manual auth selection.
+     */
+    "mcp/servers/auth/discover": {
+        params: Api.McpServerAuthDiscoverParams;
+        result: Api.AgentApiOutcomeOfMcpServerAuthDiscoverResponse;
+    };
+    /**
+     * Discover MCP server tools
+     *
+     * Connects directly to the configured MCP server with its current universe credential and returns one bounded live tools/list result. The inventory is never persisted or cached and no tool is invoked.
+     */
+    "mcp/servers/tools/discover": {
+        params: Api.McpServerToolsDiscoverParams;
+        result: Api.AgentApiOutcomeOfMcpServerToolsDiscoverResponse;
+    };
+    /**
+     * Read an MCP server record
+     *
+     * Returns one catalog document with defaults, auth policy, non-secret grant binding, status, and revision; no credential value is exposed.
+     */
+    "mcp/servers/read": {
+        params: Api.McpServerReadParams;
+        result: Api.AgentApiOutcomeOfMcpServerReadResponse;
+    };
+    /**
+     * List MCP server records
+     *
+     * Lists the universe catalog entries, optionally filtered by lifecycle/configuration status.
+     */
+    "mcp/servers/list": {
+        params: Api.McpServerListParams;
+        result: Api.AgentApiOutcomeOfMcpServerListResponse;
+    };
+    /**
+     * Delete an MCP server record
+     *
+     * Deletes the catalog document. Existing session configs that reference it are not silently rewritten and may need explicit reconfiguration.
+     */
+    "mcp/servers/delete": {
+        params: Api.McpServerDeleteParams;
+        result: Api.AgentApiOutcomeOfMcpServerDeleteResponse;
+    };
+    /**
+     * Import a static bearer grant
+     *
+     * Accepts a plaintext token, encrypts it immediately, and returns only grant metadata/token-presence flags. Brokered is the default; retrievable exposure is immutable and permits service-only leases.
+     */
+    "auth/grants/import": {
+        params: Api.AuthGrantImportParams;
+        result: Api.AgentApiOutcomeOfAuthGrantImportResponse;
+    };
+    /**
+     * Lease a retrievable authentication grant
+     *
+     * Service callers only. Resolves the current access token through the broker, records the lease, and returns it once. Cache only in memory until expiry minus margin (or at most five minutes without expiry), re-lease after target 401/403, and never persist or place the token in workflow payloads.
+     */
+    "auth/grants/lease": {
+        params: Api.AuthGrantLeaseParams;
+        result: Api.AgentApiOutcomeOfAuthGrantLeaseResponse;
+    };
+    /**
+     * Read authentication grant metadata
+     *
+     * Returns creator attribution, provider binding, scopes, audience, expiry, status, and token-presence flags; access and refresh token values are never returned.
+     */
+    "auth/grants/read": {
+        params: Api.AuthGrantReadParams;
+        result: Api.AgentApiOutcomeOfAuthGrantReadResponse;
+    };
+    /**
+     * List authentication grants
+     *
+     * Lists non-secret grant metadata for the universe, optionally filtered by status.
+     */
+    "auth/grants/list": {
+        params: Api.AuthGrantListParams;
+        result: Api.AgentApiOutcomeOfAuthGrantListResponse;
+    };
+    /**
+     * Revoke an authentication grant
+     *
+     * Marks the grant unusable by token consumers while retaining non-secret audit metadata.
+     */
+    "auth/grants/revoke": {
+        params: Api.AuthGrantRevokeParams;
+        result: Api.AgentApiOutcomeOfAuthGrantRevokeResponse;
+    };
+    /**
+     * Register an OAuth client
+     *
+     * Stores provider endpoints and client identity; an optional plaintext client secret is encrypted and represented thereafter only by hasClientSecret.
+     */
+    "auth/clients/create": {
+        params: Api.AuthClientCreateParams;
+        result: Api.AgentApiOutcomeOfAuthClientCreateResponse;
+    };
+    /**
+     * Read OAuth client metadata
+     *
+     * Returns endpoints, public client identity, defaults, and secret-presence state; the client secret is never returned.
+     */
+    "auth/clients/read": {
+        params: Api.AuthClientReadParams;
+        result: Api.AgentApiOutcomeOfAuthClientReadResponse;
+    };
+    /**
+     * List OAuth clients
+     *
+     * Lists non-secret OAuth client registrations in the universe.
+     */
+    "auth/clients/list": {
+        params: Api.AuthClientListParams;
+        result: Api.AgentApiOutcomeOfAuthClientListResponse;
+    };
+    /**
+     * Delete an OAuth client
+     *
+     * Deletes the client registration and its stored client secret; grants already created from it remain separate records.
+     */
+    "auth/clients/delete": {
+        params: Api.AuthClientDeleteParams;
+        result: Api.AgentApiOutcomeOfAuthClientDeleteResponse;
+    };
+    /**
+     * Start an OAuth authorization flow
+     *
+     * Creates a short-lived PKCE flow carrying the immutable grant exposure choice and returns a browser authorization URL containing one-time state. Treat the URL as sensitive and poll auth/flows/read for completion.
+     */
+    "auth/flows/start": {
+        params: Api.AuthFlowStartParams;
+        result: Api.AgentApiOutcomeOfAuthFlowStartResponse;
+    };
+    /**
+     * Read OAuth flow status
+     *
+     * Polls a flow's pending/completed/failed/expired state and returns the resulting grant id when authorization succeeds; no token value is exposed.
+     */
+    "auth/flows/read": {
+        params: Api.AuthFlowStatusParams;
+        result: Api.AgentApiOutcomeOfAuthFlowStatusResponse;
+    };
+    /**
+     * Register an authentication provider
+     *
+     * Creates a model or GitHub credential source. Plaintext API keys/private keys are encrypted on receipt and later represented only by configuration plus hasCredential.
+     */
+    "auth/providers/create": {
+        params: Api.AuthProviderCreateParams;
+        result: Api.AgentApiOutcomeOfAuthProviderCreateResponse;
+    };
+    /**
+     * Read authentication provider metadata
+     *
+     * Returns provider kind, non-secret configuration, credential-presence state, and status; stored credentials are never returned.
+     */
+    "auth/providers/read": {
+        params: Api.AuthProviderReadParams;
+        result: Api.AgentApiOutcomeOfAuthProviderReadResponse;
+    };
+    /**
+     * List authentication providers
+     *
+     * Lists non-secret model/GitHub provider registrations for the universe.
+     */
+    "auth/providers/list": {
+        params: Api.AuthProviderListParams;
+        result: Api.AgentApiOutcomeOfAuthProviderListResponse;
+    };
+    /**
+     * Delete an authentication provider
+     *
+     * Deletes the provider registration and its directly stored credential; separately stored grants remain independent records.
+     */
+    "auth/providers/delete": {
+        params: Api.AuthProviderDeleteParams;
+        result: Api.AgentApiOutcomeOfAuthProviderDeleteResponse;
+    };
+    /**
+     * List GitHub App installations
+     *
+     * Uses the registered GitHub App provider credential to query accessible installations and returns account/permission metadata without tokens.
+     */
+    "auth/github/installations/list": {
+        params: Api.AuthGitHubInstallationListParams;
+        result: Api.AgentApiOutcomeOfAuthGitHubInstallationListResponse;
+    };
+    /**
+     * Grant access to a GitHub App installation
+     *
+     * Creates or refreshes a universe auth grant for one accessible installation. The installation token is brokered internally and never returned.
+     */
+    "auth/github/installations/grant": {
+        params: Api.AuthGitHubInstallationGrantParams;
+        result: Api.AgentApiOutcomeOfAuthGitHubInstallationGrantResponse;
+    };
+    /**
+     * Create a bot
+     *
+     * Creates the bot record, optionally with its triggers, and starts its controller. Fails if the bot id exists; a trigger failure rolls the bot back.
+     */
+    "bots/create": {
+        params: Api.BotCreateParams;
+        result: Api.AgentApiOutcomeOfBotCreateResponse;
+    };
+    /**
+     * Create or replace a bot document
+     *
+     * Replaces the mutable configuration whole and signals the controller, which applies it at its next idle boundary. Pass expectedRevision when replacing; a closed bot accepts label-only edits.
+     */
+    "bots/put": {
+        params: Api.BotPutParams;
+        result: Api.AgentApiOutcomeOfBotPutResponse;
+    };
+    /**
+     * Read a bot
+     *
+     * Returns the bot record, its current revision, and lifecycle columns.
+     */
+    "bots/read": {
+        params: Api.BotReadParams;
+        result: Api.AgentApiOutcomeOfBotReadResponse;
+    };
+    /**
+     * List bots
+     *
+     * Returns the roster: every bot with its trigger count, pending event count, and latest event, optionally narrowed by createdBy.
+     */
+    "bots/list": {
+        params: Api.BotListParams;
+        result: Api.AgentApiOutcomeOfBotListResponse;
+    };
+    /**
+     * Close a bot
+     *
+     * Terminal and idempotent: disables every trigger, drops schedules, and tells the controller to archive pending events and force-close its sessions. Returns once signalled; follow bots/state/read for closing to closed.
+     */
+    "bots/close": {
+        params: Api.BotCloseParams;
+        result: Api.AgentApiOutcomeOfBotCloseResponse;
+    };
+    /**
+     * Delete a bot
+     *
+     * Closes the bot if needed, waits for its controller to complete, deletes the sessions it closed, and removes the record so the bot id is free again.
+     */
+    "bots/delete": {
+        params: Api.BotDeleteParams;
+        result: Api.AgentApiOutcomeOfBotDeleteResponse;
+    };
+    /**
+     * Read bot controller state
+     *
+     * Queries the controller workflow for its live snapshot (sessions, buffers, active and recent deliveries, budget) and lists sub-agent descendants. The controller is absent until the bot's first event.
+     */
+    "bots/state/read": {
+        params: Api.BotStateReadParams;
+        result: Api.AgentApiOutcomeOfBotStateReadResponse;
+    };
+    /**
+     * Rotate a bot session
+     *
+     * Asks the controller to close one of the bot's sessions at its next idle boundary and continue on a fresh generation; queued deliveries follow.
+     */
+    "bots/sessions/rotate": {
+        params: Api.BotSessionRotateParams;
+        result: Api.AgentApiOutcomeOfBotSessionRotateResponse;
+    };
+    /**
+     * Create or replace a trigger
+     *
+     * Validates the trigger document (CEL parses, grants exist, one inbox per bot, chat routes per conversation), reconciles its Temporal Schedule, and stores it. A poll spec edit resets the cursor; a webhook keeps its URL token.
+     */
+    "bots/triggers/put": {
+        params: Api.BotTriggerPutParams;
+        result: Api.AgentApiOutcomeOfBotTriggerPutResponse;
+    };
+    /**
+     * Read a trigger
+     *
+     * Returns one trigger with its incidents and cursor; the ingest path and pairing code are included for bot-management callers.
+     */
+    "bots/triggers/read": {
+        params: Api.BotTriggerReadParams;
+        result: Api.AgentApiOutcomeOfBotTriggerReadResponse;
+    };
+    /**
+     * List a bot's triggers
+     *
+     * Returns every trigger of the bot ordered by id, secrets included for bot-management callers.
+     */
+    "bots/triggers/list": {
+        params: Api.BotTriggerListParams;
+        result: Api.AgentApiOutcomeOfBotTriggerListResponse;
+    };
+    /**
+     * Delete a trigger
+     *
+     * Drops the trigger's Temporal Schedule and pairings, then the record; stored events keep their history.
+     */
+    "bots/triggers/delete": {
+        params: Api.BotTriggerDeleteParams;
+        result: Api.AgentApiOutcomeOfBotTriggerDeleteResponse;
+    };
+    /**
+     * Admit an event manually
+     *
+     * Stores an operator-authored event for the bot's main session and wakes the controller. eventId is the dedupe identity; a duplicate returns the stored row.
+     */
+    "bots/events/admit": {
+        params: Api.BotEventAdmitParams;
+        result: Api.AgentApiOutcomeOfBotEventAdmitResponse;
+    };
+    /**
+     * Replay a stored event
+     *
+     * Re-admits the stored envelope as a fresh event with the original routing; the replay never coalesces.
+     */
+    "bots/events/replay": {
+        params: Api.BotEventReplayParams;
+        result: Api.AgentApiOutcomeOfBotEventReplayResponse;
+    };
+    /**
+     * List a bot's events
+     *
+     * Cursor-paginated event log, newest first, with outcomes; payload documents stay in the CAS.
+     */
+    "bots/events/list": {
+        params: Api.BotEventListParams;
+        result: Api.AgentApiOutcomeOfBotEventListResponse;
+    };
+    /**
+     * Read an event by number
+     *
+     * Returns the event row and its full stored envelope document.
+     */
+    "bots/events/read": {
+        params: Api.BotEventReadParams;
+        result: Api.AgentApiOutcomeOfBotEventReadResponse;
+    };
+    /**
+     * Test a CEL filter
+     *
+     * Evaluates a filter against one payload or a sample of recent stored events, reporting matches and evaluation errors without changing anything.
+     */
+    "bots/filters/test": {
+        params: Api.BotFilterTestParams;
+        result: Api.AgentApiOutcomeOfBotFilterTestResponse;
+    };
+    /**
+     * Create a channel account
+     *
+     * Registers a provider account (Telegram, WhatsApp) for this universe. The credential is a retrievable grant reference; no token is accepted here.
+     */
+    "channels/accounts/create": {
+        params: Api.ChannelAccountCreateParams;
+        result: Api.AgentApiOutcomeOfChannelAccountCreateResponse;
+    };
+    /**
+     * Create or replace a channel account
+     *
+     * Replaces the account document whole; pass expectedRevision when replacing. The connector host picks the change up on its next discovery pass.
+     */
+    "channels/accounts/put": {
+        params: Api.ChannelAccountPutParams;
+        result: Api.AgentApiOutcomeOfChannelAccountPutResponse;
+    };
+    /**
+     * Read a channel account
+     *
+     * Returns the account document and revision.
+     */
+    "channels/accounts/read": {
+        params: Api.ChannelAccountReadParams;
+        result: Api.AgentApiOutcomeOfChannelAccountReadResponse;
+    };
+    /**
+     * List channel accounts
+     *
+     * Lists this universe's provider accounts, optionally by provider.
+     */
+    "channels/accounts/list": {
+        params: Api.ChannelAccountListParams;
+        result: Api.AgentApiOutcomeOfChannelAccountListResponse;
+    };
+    /**
+     * Delete a channel account
+     *
+     * Removes the account and its pairings; chat triggers that reference it stop serving conversations.
+     */
+    "channels/accounts/delete": {
+        params: Api.ChannelAccountDeleteParams;
+        result: Api.AgentApiOutcomeOfChannelAccountDeleteResponse;
+    };
+    /**
+     * Admit a provider message
+     *
+     * Service callers only. Resolves the chat trigger for the conversation, applies pairing, and signals the conversation workflow. Returns the decision so the connector can send pairing prompts itself; acknowledge the provider only after this returns.
+     */
+    "channels/inbound/admit": {
+        params: Api.ChannelInboundAdmitParams;
+        result: Api.AgentApiOutcomeOfChannelInboundAdmitResponse;
+    };
+    /**
+     * List chat pairings
+     *
+     * Lists conversations paired to chat triggers, optionally by account or bot.
+     */
+    "channels/pairings/list": {
+        params: Api.ChannelPairingListParams;
+        result: Api.AgentApiOutcomeOfChannelPairingListResponse;
+    };
+    /**
+     * Unpair a conversation
+     *
+     * Removes one pairing; the conversation must present the pairing code again to reconnect.
+     */
+    "channels/pairings/delete": {
+        params: Api.ChannelPairingDeleteParams;
+        result: Api.AgentApiOutcomeOfChannelPairingDeleteResponse;
+    };
+    /**
+     * Read a conversation snapshot
+     *
+     * Queries the conversation workflow's live state for one chat, for debugging; absent when no workflow exists yet.
+     */
+    "channels/conversations/read": {
+        params: Api.ChannelConversationReadParams;
+        result: Api.AgentApiOutcomeOfChannelConversationReadResponse;
+    };
+    /**
+     * List a universe's deployment provider bindings
+     *
+     * Deployment configuration inventory of one universe's provider bindings.
+     */
+    "deployment/environment-provider-bindings/list": {
+        params: Api.DeploymentUniverseReadParams;
+        result: Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse;
+    };
+    /**
+     * Create a universe
+     *
+     * Creates the deployment tenant boundary for an explicit UUID. The operation is idempotent and reports whether a new universe was created.
+     */
+    "deployment/universes/create": {
+        params: Api.DeploymentUniverseCreateParams;
+        result: Api.AgentApiOutcomeOfDeploymentUniverseCreateResponse;
+    };
+    /**
+     * List universes
+     *
+     * Returns deployment-wide universe summaries with approximate live aggregate counts and last session activity.
+     */
+    "deployment/universes/list": {
+        params: Api.DeploymentUniverseListParams;
+        result: Api.AgentApiOutcomeOfDeploymentUniverseListResponse;
+    };
+    /**
+     * Read a universe
+     *
+     * Returns one deployment tenant summary with aggregate session, workspace, profile, and blob usage.
+     */
+    "deployment/universes/read": {
+        params: Api.DeploymentUniverseReadParams;
+        result: Api.AgentApiOutcomeOfDeploymentUniverseReadResponse;
+    };
+    /**
+     * Set a universe slug
+     *
+     * Sets or changes a deployment-unique slug without changing the universe UUID or resources. The previous slug is released and old URLs may stop working. With onlyIfUnset, a different existing slug is a conflict. Claiming another universe's slug also returns a conflict. Does not create a universe.
+     */
+    "deployment/universes/slug/put": {
+        params: Api.DeploymentUniverseSlugPutParams;
+        result: Api.AgentApiOutcomeOfDeploymentUniverseReadResponse;
+    };
+    /**
+     * Purge a universe
+     *
+     * Permanently terminates live session workflows, deletes external blob objects, and cascades universe data. The purge is resumable/idempotent after partial failure.
+     */
+    "deployment/universes/delete": {
+        params: Api.DeploymentUniverseDeleteParams;
+        result: Api.AgentApiOutcomeOfDeploymentUniverseDeleteResponse;
+    };
+    /**
+     * Create a scoped API key
+     *
+     * Mints a key for a universe or the deployment with the method groups it may call and whether it may assert actors. The plaintext secret is returned exactly once and cannot be recovered; persist only the displayed prefix for identification. Key authority is immutable: revoke and mint to change what one may do.
+     */
+    "deployment/api-keys/create": {
+        params: Api.DeploymentApiKeyCreateParams;
+        result: Api.AgentApiOutcomeOfDeploymentApiKeyCreateResponse;
+    };
+    /**
+     * List scoped API keys
+     *
+     * Returns non-secret key metadata, all keys or those of one scope, including groups, revocation and last-use timestamps. Plaintext secrets are never stored or returned.
+     */
+    "deployment/api-keys/list": {
+        params: Api.DeploymentApiKeyListParams;
+        result: Api.AgentApiOutcomeOfDeploymentApiKeyListResponse;
+    };
+    /**
+     * Rotate a scoped API key
+     *
+     * Atomically replaces an active key secret and display prefix, immediately rejecting the old secret on subsequent requests. Preserves scope, groups, actor authority, name, creator and creation time; clears last use. Returns the new secret once. Unknown or revoked prefixes are not found. Already admitted work continues.
+     */
+    "deployment/api-keys/rotate": {
+        params: Api.DeploymentApiKeyRotateParams;
+        result: Api.AgentApiOutcomeOfDeploymentApiKeyCreateResponse;
+    };
+    /**
+     * Revoke a scoped API key
+     *
+     * Revokes the key with this display prefix; revoking a revoked key keeps its first revocation time. An unknown prefix is not found.
+     */
+    "deployment/api-keys/revoke": {
+        params: Api.DeploymentApiKeyRevokeParams;
+        result: Api.AgentApiOutcomeOfDeploymentApiKeyRevokeResponse;
+    };
+    /**
+     * Put an environment provider
+     *
+     * Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+     */
+    "deployment/environment-providers/put": {
+        params: Api.DeploymentEnvironmentProviderPutParams;
+        result: Api.AgentApiOutcomeOfDeploymentEnvironmentProviderPutResponse;
+    };
+    /**
+     * List environment providers
+     *
+     * Returns every deployment-registered deployment provider and its controller connection.
+     */
+    "deployment/environment-providers/list": {
+        params: Api.DeploymentEnvironmentProviderListParams;
+        result: Api.AgentApiOutcomeOfDeploymentEnvironmentProviderListResponse;
+    };
+    /**
+     * Read an environment provider
+     *
+     * Returns one deployment-registered deployment provider and its controller connection.
+     */
+    "deployment/environment-providers/read": {
+        params: Api.DeploymentEnvironmentProviderReadParams;
+        result: Api.AgentApiOutcomeOfDeploymentEnvironmentProviderReadResponse;
+    };
+    /**
+     * Delete an environment provider
+     *
+     * Deletes a deployment provider only when no universe binding references it.
+     */
+    "deployment/environment-providers/delete": {
+        params: Api.DeploymentEnvironmentProviderDeleteParams;
+        result: Api.AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse;
+    };
+    /**
+     * Put an environment provider binding
+     *
+     * Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+     */
+    "deployment/environment-providers/bindings/put": {
+        params: Api.DeploymentProviderBindingPutParams;
+        result: Api.AgentApiOutcomeOfDeploymentProviderBindingPutResponse;
+    };
+    /**
+     * Delete an environment provider binding
+     *
+     * Deletes a universe provider binding only after every referencing environment has reached Closed.
+     */
+    "deployment/environment-providers/bindings/delete": {
+        params: Api.DeploymentProviderBindingDeleteParams;
+        result: Api.AgentApiOutcomeOfDeploymentProviderBindingDeleteResponse;
+    };
+    /**
+     * Adopt a provider environment
+     *
+     * Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
+     */
+    "deployment/environments/adopt": {
+        params: Api.DeploymentEnvironmentAdoptParams;
+        result: Api.AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse;
+    };
+    /**
+     * List channel accounts across universes
+     *
+     * The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.
+     */
+    "deployment/channels/accounts/list": {
+        params: Api.DeploymentChannelAccountListParams;
+        result: Api.AgentApiOutcomeOfDeploymentChannelAccountListResponse;
+    };
+}
+export type MethodParams<M extends Method> = MethodMap[M]["params"];
+export type MethodResult<M extends Method> = MethodMap[M]["result"];
+export interface RpcCaller {
+    call<M extends Method>(method: M, params: MethodParams<M>): Promise<MethodResult<M>>;
+}
+export declare const rpc: {
+    /**
+     * Read a workspace file
+     *
+     * Reads bytes at a path in the current workspace head.
+     */
+    readonly vfsWorkspacesFilesRead: (client: RpcCaller, params: Api.VfsWorkspaceFileReadParams) => Promise<Api.AgentApiOutcomeOfBlobReadResponse>;
+    /**
+     * Inspect the Lightspeed protocol
+     *
+     * Returns protocol version, server identity, credential scope and allowed groups before universe selection. Requires authentication in authenticated mode; no universe header is accepted.
+     */
+    readonly initialize: (client: RpcCaller, params: Api.InitializeParams) => Promise<Api.AgentApiOutcomeOfInitializeResponse>;
+    /**
+     * Create or reopen a session
+     *
+     * Creates a session, unshared unless access says universe, with optional config/profile setup. Profile metadata and retention supply defaults that explicit values override; the config's default environment attachment becomes active. Retrying an existing id returns that session and keeps its audience.
+     */
+    readonly sessionStart: (client: RpcCaller, params: Api.SessionStartParams) => Promise<Api.AgentApiOutcomeOfSessionStartResponse>;
+    /**
+     * Create or reopen a managed session
+     *
+     * Creates a session with immutable lifecycle and workflow-tool declarations using explicit bound dispatch. Profile metadata, retention, and default environment attachment selection follow session/start semantics. Retrying an id requires the same managed declaration; an ordinary session cannot be upgraded.
+     */
+    readonly sessionManagedStart: (client: RpcCaller, params: Api.ManagedSessionStartParams) => Promise<Api.AgentApiOutcomeOfSessionStartResponse>;
+    /**
+     * Read a session
+     *
+     * Returns current state plus a bounded newest-first run-summary page. Follow nextRunCursor with session/runs/list when hasOlderRuns is true; use session/events/read for the transcript.
+     */
+    readonly sessionRead: (client: RpcCaller, params: Api.SessionReadParams) => Promise<Api.AgentApiOutcomeOfSessionReadResponse>;
+    /**
+     * List sessions
+     *
+     * Returns a cursor-paginated summary list ordered by most recent update, optionally narrowed by the audience of each session's root: createdBy, visibility, or visibleTo (shared with the universe or created by that actor). Pages may shift while sessions are changing.
+     */
+    readonly sessionList: (client: RpcCaller, params: Api.SessionListParams) => Promise<Api.AgentApiOutcomeOfSessionListResponse>;
+    /**
+     * Replace session configuration
+     *
+     * Replaces the complete sparse config while the session is idle. Use the current config revision for safe read-modify-write; omitted features are revoked, an omitted model preserves the current model, and an identical document is a no-op.
+     */
+    readonly sessionConfigPut: (client: RpcCaller, params: Api.SessionConfigPutParams) => Promise<Api.AgentApiOutcomeOfSessionConfigPutResponse>;
+    /**
+     * Rename a session
+     *
+     * Sets the display name, or clears it when displayName is omitted.
+     */
+    readonly sessionRename: (client: RpcCaller, params: Api.SessionRenameParams) => Promise<Api.AgentApiOutcomeOfSessionRenameResponse>;
+    /**
+     * Replace session metadata
+     *
+     * Replaces the complete descriptive key/value map (bounded like session/start); an omitted or empty map clears it. Record-only: the event log and updatedAtMs are untouched.
+     */
+    readonly sessionMetadataPut: (client: RpcCaller, params: Api.SessionMetadataPutParams) => Promise<Api.AgentApiOutcomeOfSessionMetadataPutResponse>;
+    /**
+     * Replace session retention
+     *
+     * Sets the positive close-relative automatic-deletion duration on a retention root, or clears it with null. Forks and delegated children inherit the root policy and cannot override it.
+     */
+    readonly sessionRetentionPut: (client: RpcCaller, params: Api.SessionRetentionPutParams) => Promise<Api.AgentApiOutcomeOfSessionRetentionPutResponse>;
+    /**
+     * Close a session
+     *
+     * Closes an idle session and detaches its environment bindings. Force mode cancels active work, drops queued runs, and can recover a session whose workflow is unavailable.
+     */
+    readonly sessionClose: (client: RpcCaller, params: Api.SessionCloseParams) => Promise<Api.AgentApiOutcomeOfSessionCloseResponse>;
+    /**
+     * Delete closed sessions
+     *
+     * Permanently removes a closed retention-tree leaf, or its closed history-fork and delegated-child subtree when cascade is true. Config-only clones are never included.
+     */
+    readonly sessionDelete: (client: RpcCaller, params: Api.SessionDeleteParams) => Promise<Api.AgentApiOutcomeOfSessionDeleteResponse>;
+    /**
+     * Share a session with the universe
+     *
+     * Moves an unshared root session to universe visibility, one way; its delegated children follow it. Refused on a bot's session, a delegated child, and a session already shared. Core applies it for any caller of the method; who may share is the caller's gate's decision.
+     */
+    readonly sessionShare: (client: RpcCaller, params: Api.SessionShareParams) => Promise<Api.AgentApiOutcomeOfSessionShareResponse>;
+    /**
+     * Read the session event stream
+     *
+     * Returns chronological events. Forward (default) follows after and supports long-polling. Backward reads the latest window below before (or the head); pass nextCursor as before until complete. Follow live events after the initial backward headCursor. Windows may split runs/tool batches; keep historical reconstruction separate from live controls.
+     */
+    readonly sessionEventsRead: (client: RpcCaller, params: Api.SessionEventsReadParams) => Promise<Api.AgentApiOutcomeOfSessionEventsReadResponse>;
+    /**
+     * Append keyed session context
+     *
+     * Admits a batch of context entries with per-entry results. Stable keys make same-content retries no-ops; invalid input can fail one entry without discarding successful entries.
+     */
+    readonly sessionContextAppend: (client: RpcCaller, params: Api.ContextAppendParams) => Promise<Api.AgentApiOutcomeOfContextAppendResponse>;
+    /**
+     * Remove keyed session context
+     *
+     * Removes active entries by stable key with per-key results. Missing keys are idempotent no-ops; runtime-reserved run keys cannot be removed.
+     */
+    readonly sessionContextRemove: (client: RpcCaller, params: Api.ContextRemoveParams) => Promise<Api.AgentApiOutcomeOfContextRemoveResponse>;
+    /**
+     * Replace session context entries
+     *
+     * Replaces active tool results and user messages in place by entry id, with per-entry results, e.g. to withdraw content the provider rejects. Entries keep their ids, positions, and kinds, so a tool result takes only text and its call stays answered. Refused while a run is active; ids no longer in context report absent.
+     */
+    readonly sessionContextReplace: (client: RpcCaller, params: Api.ContextReplaceParams) => Promise<Api.AgentApiOutcomeOfContextReplaceResponse>;
+    /**
+     * Compact session context
+     *
+     * Performs one standalone compaction in any automatic mode, including Disabled, and waits for completion. Active work queues the operation until a safe turn boundary; automatic policy remains unchanged.
+     */
+    readonly sessionContextCompact: (client: RpcCaller, params: Api.ContextCompactParams) => Promise<Api.AgentApiOutcomeOfContextCompactResponse>;
+    /**
+     * Start an agent run
+     *
+     * Accepts input or existing context keys and returns once the run is accepted — queued behind an active run, or running — not when it finishes. Supply submissionId for retry safety, then follow session events or reread the session.
+     */
+    readonly sessionRunsStart: (client: RpcCaller, params: Api.RunStartParams) => Promise<Api.AgentApiOutcomeOfRunStartResponse>;
+    /**
+     * List session runs
+     *
+     * Returns a newest-first keyset page of bounded run summaries projected from current reducer state.
+     */
+    readonly sessionRunsList: (client: RpcCaller, params: Api.RunListParams) => Promise<Api.AgentApiOutcomeOfRunListResponse>;
+    /**
+     * Read one session run
+     *
+     * Reads and projects one run from its bounded event interval, paged by event sequence.
+     */
+    readonly sessionRunsRead: (client: RpcCaller, params: Api.RunReadParams) => Promise<Api.AgentApiOutcomeOfRunReadResponse>;
+    /**
+     * Cancel a run
+     *
+     * Requests cancellation of the named queued or active run and returns its current projected state; observe session events for terminal completion. In-flight model and tool activity is aborted; no grace turn runs.
+     */
+    readonly sessionRunsCancel: (client: RpcCaller, params: Api.RunCancelParams) => Promise<Api.AgentApiOutcomeOfRunCancelResponse>;
+    /**
+     * Decide pending run approvals
+     *
+     * Approves or rejects pending MCP tool calls on the named active run. Valid decisions apply independently; the run resumes only after every pending approval has a decision.
+     */
+    readonly sessionRunsApprovalsDecide: (client: RpcCaller, params: Api.RunApprovalsDecideParams) => Promise<Api.AgentApiOutcomeOfRunApprovalsDecideResponse>;
+    /**
+     * Steer the active run
+     *
+     * Injects input into the named active run; the model sees it at the next turn boundary without interrupting the in-flight turn. Accepted while the run is running or parked on an await; rejected for queued, cancelling, or finished runs.
+     */
+    readonly sessionRunsSteer: (client: RpcCaller, params: Api.RunSteerParams) => Promise<Api.AgentApiOutcomeOfRunSteerResponse>;
+    /**
+     * List available session skills
+     *
+     * Returns separate VFS and environment catalogs with source, reference, availability, readable skill paths, and warnings. Refreshes only when open with no active or queued run, without waking environments. Absent catalogs are omitted.
+     */
+    readonly sessionSkillsList: (client: RpcCaller, params: Api.SkillListParams) => Promise<Api.AgentApiOutcomeOfSkillListResponse>;
+    /**
+     * Apply a profile to a session
+     *
+     * Applies a named or inline profile's config, instructions, and environment setup to an existing session; mutating profile sections require it to be open and idle. Pass current revisions to guard concurrent changes.
+     */
+    readonly sessionProfilesApply: (client: RpcCaller, params: Api.ProfileApplyParams) => Promise<Api.AgentApiOutcomeOfProfileApplyResponse>;
+    /**
+     * Activate a session environment
+     *
+     * Selects an attached, live universe environment for environment-targeted tools while the session is idle.
+     */
+    readonly sessionEnvironmentsActivate: (client: RpcCaller, params: Api.SessionEnvironmentActivateParams) => Promise<Api.AgentApiOutcomeOfSessionEnvironmentActivateResponse>;
+    /**
+     * Deactivate the session environment
+     *
+     * Clears active environment selection without changing or closing the universe environment.
+     */
+    readonly sessionEnvironmentsDeactivate: (client: RpcCaller, params: Api.SessionEnvironmentDeactivateParams) => Promise<Api.AgentApiOutcomeOfSessionEnvironmentDeactivateResponse>;
+    /**
+     * Bind a credential into an environment
+     *
+     * Maps an environment variable name to an existing grant/provider/direct-secret handle for a universe environment. Requires configuring the environment and configuring resources in the universe. The response exposes only the source handle, never secret material.
+     */
+    readonly environmentsCredentialsBind: (client: RpcCaller, params: Api.EnvironmentCredentialBindParams) => Promise<Api.AgentApiOutcomeOfEnvironmentCredentialBindResponse>;
+    /**
+     * List environment credential bindings
+     *
+     * Returns variable names and credential source handles for a universe environment; resolved secret values are never returned.
+     */
+    readonly environmentsCredentialsList: (client: RpcCaller, params: Api.EnvironmentCredentialListParams) => Promise<Api.AgentApiOutcomeOfEnvironmentCredentialListResponse>;
+    /**
+     * Unbind an environment credential
+     *
+     * Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret.
+     */
+    readonly environmentsCredentialsUnbind: (client: RpcCaller, params: Api.EnvironmentCredentialUnbindParams) => Promise<Api.AgentApiOutcomeOfEnvironmentCredentialUnbindResponse>;
+    /**
+     * Create an environment
+     *
+     * Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.
+     */
+    readonly environmentsCreate: (client: RpcCaller, params: Api.EnvironmentCreateParams) => Promise<Api.AgentApiOutcomeOfEnvironmentCreateResponse>;
+    /**
+     * Read an environment
+     *
+     * Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+     */
+    readonly environmentsRead: (client: RpcCaller, params: Api.EnvironmentReadParams) => Promise<Api.AgentApiOutcomeOfEnvironmentReadResponse>;
+    /**
+     * List environments
+     *
+     * Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.
+     */
+    readonly environmentsList: (client: RpcCaller, params: Api.EnvironmentListParams) => Promise<Api.AgentApiOutcomeOfEnvironmentListResponse>;
+    /**
+     * Close an environment
+     *
+     * Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+     */
+    readonly environmentsClose: (client: RpcCaller, params: Api.EnvironmentCloseParams) => Promise<Api.AgentApiOutcomeOfEnvironmentCloseResponse>;
+    /**
+     * Register an external environment
+     *
+     * Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.
+     */
+    readonly environmentsExternalCreate: (client: RpcCaller, params: Api.EnvironmentExternalCreateParams) => Promise<Api.AgentApiOutcomeOfEnvironmentExternalCreateResponse>;
+    /**
+     * Configure environment public ingress
+     *
+     * Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+     */
+    readonly environmentsIngressPut: (client: RpcCaller, params: Api.EnvironmentIngressPutParams) => Promise<Api.AgentApiOutcomeOfEnvironmentIngressPutResponse>;
+    /**
+     * Set environment power intent
+     *
+     * Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+     */
+    readonly environmentsPowerPut: (client: RpcCaller, params: Api.EnvironmentPowerPutParams) => Promise<Api.AgentApiOutcomeOfEnvironmentPowerPutResponse>;
+    /**
+     * Set environment idle policy
+     *
+     * Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
+     */
+    readonly environmentsIdlePolicyPut: (client: RpcCaller, params: Api.EnvironmentIdlePolicyPutParams) => Promise<Api.AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse>;
+    /**
+     * List environment provider bindings
+     *
+     * Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+     */
+    readonly environmentsProviderBindingsList: (client: RpcCaller, params: Api.EnvironmentProviderBindingListParams) => Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse>;
+    /**
+     * Read an environment provider binding
+     *
+     * Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+     */
+    readonly environmentsProviderBindingsRead: (client: RpcCaller, params: Api.EnvironmentProviderBindingReadParams) => Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingReadResponse>;
+    /**
+     * List environment templates
+     *
+     * Reads immutable templates directly from the selected bound provider controller.
+     */
+    readonly environmentsTemplatesList: (client: RpcCaller, params: Api.EnvironmentTemplateListParams) => Promise<Api.AgentApiOutcomeOfEnvironmentTemplateListResponse>;
+    /**
+     * Read an environment template
+     *
+     * Returns one immutable template version from the selected bound provider controller.
+     */
+    readonly environmentsTemplatesRead: (client: RpcCaller, params: Api.EnvironmentTemplateReadParams) => Promise<Api.AgentApiOutcomeOfEnvironmentTemplateReadResponse>;
+    /**
+     * Create environment jobs
+     *
+     * Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+     */
+    readonly environmentsJobsCreate: (client: RpcCaller, params: Api.EnvironmentJobCreateParams) => Promise<Api.AgentApiOutcomeOfEnvironmentJobCreateResponse>;
+    /**
+     * Read environment jobs
+     *
+     * Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+     */
+    readonly environmentsJobsRead: (client: RpcCaller, params: Api.EnvironmentJobReadParams) => Promise<Api.AgentApiOutcomeOfEnvironmentJobReadResponse>;
+    /**
+     * Cancel environment jobs
+     *
+     * Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result.
+     */
+    readonly environmentsJobsCancel: (client: RpcCaller, params: Api.EnvironmentJobCancelParams) => Promise<Api.AgentApiOutcomeOfEnvironmentJobCancelResponse>;
+    /**
+     * Mint an environment registration key
+     *
+     * Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.
+     */
+    readonly environmentsRegistrationKeysCreate: (client: RpcCaller, params: Api.EnvironmentRegistrationKeyCreateParams) => Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyCreateResponse>;
+    /**
+     * Read an environment registration key
+     *
+     * Returns the key's display prefix, policy, status, and derived environment counts; never the secret or its hash.
+     */
+    readonly environmentsRegistrationKeysRead: (client: RpcCaller, params: Api.EnvironmentRegistrationKeyReadParams) => Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyReadResponse>;
+    /**
+     * List environment registration keys
+     *
+     * Lists this universe's registration keys with policy, status, and derived counts. Each key is the group of the environments it admitted.
+     */
+    readonly environmentsRegistrationKeysList: (client: RpcCaller, params: Api.EnvironmentRegistrationKeyListParams) => Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyListResponse>;
+    /**
+     * Revoke an environment registration key
+     *
+     * Stops the key from admitting new daemon identities; already registered daemons keep reconnecting. With closeEnvironments, also closes every non-closed environment the key admitted. Idempotent.
+     */
+    readonly environmentsRegistrationKeysRevoke: (client: RpcCaller, params: Api.EnvironmentRegistrationKeyRevokeParams) => Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyRevokeResponse>;
+    /**
+     * Start transcription
+     *
+     * Admit or rejoin a requester-scoped audio transcription. The resolved model is immutable. No session or run is created.
+     */
+    readonly transcriptionsStart: (client: RpcCaller, params: Api.TranscriptionStartParams) => Promise<Api.AgentApiOutcomeOfTranscriptionResponse>;
+    /**
+     * Read transcription
+     *
+     * Read status and transcript text. An asserted actor may only read their own drafts; direct universe keys retain method-group authority. Unsubmitted CAS results may expire.
+     */
+    readonly transcriptionsRead: (client: RpcCaller, params: Api.TranscriptionReadParams) => Promise<Api.AgentApiOutcomeOfTranscriptionResponse>;
+    /**
+     * Cancel transcription
+     *
+     * Cancel unfinished transcription. Repeated cancellation is safe; completed results remain unchanged. An asserted actor may only cancel their own drafts; direct universe keys retain method-group authority.
+     */
+    readonly transcriptionsCancel: (client: RpcCaller, params: Api.TranscriptionCancelParams) => Promise<Api.AgentApiOutcomeOfTranscriptionResponse>;
+    /**
+     * Read universe model defaults
+     *
+     * Returns the revision and independent agentRun and speechToText selections. Revision zero means no update has been made. Does not contact model providers.
+     */
+    readonly modelsDefaultsRead: (client: RpcCaller, params: Api.ModelDefaultsReadParams) => Promise<Api.AgentApiOutcomeOfModelDefaultsResponse>;
+    /**
+     * Set a universe model default
+     *
+     * Sets or explicitly clears one purpose slot using its current expected revision. Existing sessions and admitted work keep their model. Validates the purpose and protocol without contacting provider discovery.
+     */
+    readonly modelsDefaultsPut: (client: RpcCaller, params: Api.ModelDefaultsPutParams) => Promise<Api.AgentApiOutcomeOfModelDefaultsResponse>;
+    /**
+     * Discover available models
+     *
+     * Queries supported providers directly, with a brief process-local burst cache, and returns best-effort selectable routes. One provider failure does not discard successful results from others.
+     */
+    readonly modelsList: (client: RpcCaller, params: Api.ModelListParams) => Promise<Api.AgentApiOutcomeOfModelListResponse>;
+    /**
+     * Create an agent profile
+     *
+     * Creates a new universe-scoped reusable profile document; use profiles/put for create-or-replace revision semantics.
+     */
+    readonly profilesCreate: (client: RpcCaller, params: Api.ProfileCreateParams) => Promise<Api.AgentApiOutcomeOfProfileCreateResponse>;
+    /**
+     * Read an agent profile
+     *
+     * Returns the complete profile document and current revision.
+     */
+    readonly profilesRead: (client: RpcCaller, params: Api.ProfileReadParams) => Promise<Api.AgentApiOutcomeOfProfileReadResponse>;
+    /**
+     * List agent profiles
+     *
+     * Returns lightweight summaries of universe-scoped reusable profiles.
+     */
+    readonly profilesList: (client: RpcCaller, params: Api.ProfileListParams) => Promise<Api.AgentApiOutcomeOfProfileListResponse>;
+    /**
+     * Create or replace an agent profile
+     *
+     * Stores the complete profile document. Use expectedRevision from profiles/read when replacing to prevent lost updates; absence writes unconditionally.
+     */
+    readonly profilesPut: (client: RpcCaller, params: Api.ProfilePutParams) => Promise<Api.AgentApiOutcomeOfProfilePutResponse>;
+    /**
+     * Delete an agent profile
+     *
+     * Deletes the catalog document; sessions previously created or configured from it retain their materialized state.
+     */
+    readonly profilesDelete: (client: RpcCaller, params: Api.ProfileDeleteParams) => Promise<Api.AgentApiOutcomeOfProfileDeleteResponse>;
+    /**
+     * Store content-addressed blobs
+     *
+     * Decodes and stores a batch of base64 payloads, returning immutable content references in request order. Re-uploading identical bytes is naturally deduplicated.
+     */
+    readonly blobsPut: (client: RpcCaller, params: Api.BlobPutParams) => Promise<Api.AgentApiOutcomeOfBlobPutResponse>;
+    /**
+     * Read a content-addressed blob
+     *
+     * Returns the complete immutable blob of this universe as base64; large values count against gateway and MCP response limits.
+     */
+    readonly blobsRead: (client: RpcCaller, params: Api.BlobReadParams) => Promise<Api.AgentApiOutcomeOfBlobReadResponse>;
+    /**
+     * Check blob availability
+     *
+     * Checks a batch of content references without returning blob bodies, preserving request order.
+     */
+    readonly blobsHas: (client: RpcCaller, params: Api.BlobHasParams) => Promise<Api.AgentApiOutcomeOfBlobHasResponse>;
+    /**
+     * Commit a VFS snapshot
+     *
+     * Validates and stores an immutable filesystem manifest. Upload referenced file blobs first; the returned snapshot ref is content-addressed.
+     */
+    readonly vfsSnapshotsCommit: (client: RpcCaller, params: Api.VfsSnapshotCommitParams) => Promise<Api.AgentApiOutcomeOfVfsSnapshotCommitResponse>;
+    /**
+     * Read a VFS snapshot
+     *
+     * Returns an immutable snapshot manifest and aggregate file/byte counts; file bodies remain separate blobs.
+     */
+    readonly vfsSnapshotsRead: (client: RpcCaller, params: Api.VfsSnapshotReadParams) => Promise<Api.AgentApiOutcomeOfVfsSnapshotReadResponse>;
+    /**
+     * Create a mutable VFS workspace
+     *
+     * Creates a universe workspace attributed to the caller at an optional seed snapshot; absence starts from a server-created empty snapshot.
+     */
+    readonly vfsWorkspacesCreate: (client: RpcCaller, params: Api.VfsWorkspaceCreateParams) => Promise<Api.AgentApiOutcomeOfVfsWorkspaceCreateResponse>;
+    /**
+     * Read a VFS workspace
+     *
+     * Returns workspace metadata, current head snapshot, and revision for safe updates.
+     */
+    readonly vfsWorkspacesRead: (client: RpcCaller, params: Api.VfsWorkspaceReadParams) => Promise<Api.AgentApiOutcomeOfVfsWorkspaceReadResponse>;
+    /**
+     * List VFS workspaces
+     *
+     * Lists the mutable universe workspaces with head snapshots, sizes, and revisions.
+     */
+    readonly vfsWorkspacesList: (client: RpcCaller, params: Api.VfsWorkspaceListParams) => Promise<Api.AgentApiOutcomeOfVfsWorkspaceListResponse>;
+    /**
+     * Update a VFS workspace
+     *
+     * Moves the workspace head to an existing snapshot, which requires use of the workspace, and updates its display name, which requires configuring it. Pass expectedRevision from a read to prevent lost updates.
+     */
+    readonly vfsWorkspacesUpdate: (client: RpcCaller, params: Api.VfsWorkspaceUpdateParams) => Promise<Api.AgentApiOutcomeOfVfsWorkspaceUpdateResponse>;
+    /**
+     * Delete a VFS workspace
+     *
+     * Deletes the mutable workspace record; immutable snapshots and blobs remain content-addressed resources.
+     */
+    readonly vfsWorkspacesDelete: (client: RpcCaller, params: Api.VfsWorkspaceDeleteParams) => Promise<Api.AgentApiOutcomeOfVfsWorkspaceDeleteResponse>;
+    /**
+     * Create or replace an MCP server record
+     *
+     * Stores the complete catalog document with its optional auth-grant credential. A new server is attributed to the caller. Use expectedRevision when replacing; token material is never accepted or returned.
+     */
+    readonly mcpServersPut: (client: RpcCaller, params: Api.McpServerPutParams) => Promise<Api.AgentApiOutcomeOfMcpServerPutResponse>;
+    /**
+     * Discover MCP server authentication
+     *
+     * Looks for standards-based OAuth protected-resource metadata without creating a server, OAuth client, flow, or grant. An absent OAuth result is inconclusive and callers must allow manual auth selection.
+     */
+    readonly mcpServersAuthDiscover: (client: RpcCaller, params: Api.McpServerAuthDiscoverParams) => Promise<Api.AgentApiOutcomeOfMcpServerAuthDiscoverResponse>;
+    /**
+     * Discover MCP server tools
+     *
+     * Connects directly to the configured MCP server with its current universe credential and returns one bounded live tools/list result. The inventory is never persisted or cached and no tool is invoked.
+     */
+    readonly mcpServersToolsDiscover: (client: RpcCaller, params: Api.McpServerToolsDiscoverParams) => Promise<Api.AgentApiOutcomeOfMcpServerToolsDiscoverResponse>;
+    /**
+     * Read an MCP server record
+     *
+     * Returns one catalog document with defaults, auth policy, non-secret grant binding, status, and revision; no credential value is exposed.
+     */
+    readonly mcpServersRead: (client: RpcCaller, params: Api.McpServerReadParams) => Promise<Api.AgentApiOutcomeOfMcpServerReadResponse>;
+    /**
+     * List MCP server records
+     *
+     * Lists the universe catalog entries, optionally filtered by lifecycle/configuration status.
+     */
+    readonly mcpServersList: (client: RpcCaller, params: Api.McpServerListParams) => Promise<Api.AgentApiOutcomeOfMcpServerListResponse>;
+    /**
+     * Delete an MCP server record
+     *
+     * Deletes the catalog document. Existing session configs that reference it are not silently rewritten and may need explicit reconfiguration.
+     */
+    readonly mcpServersDelete: (client: RpcCaller, params: Api.McpServerDeleteParams) => Promise<Api.AgentApiOutcomeOfMcpServerDeleteResponse>;
+    /**
+     * Import a static bearer grant
+     *
+     * Accepts a plaintext token, encrypts it immediately, and returns only grant metadata/token-presence flags. Brokered is the default; retrievable exposure is immutable and permits service-only leases.
+     */
+    readonly authGrantsImport: (client: RpcCaller, params: Api.AuthGrantImportParams) => Promise<Api.AgentApiOutcomeOfAuthGrantImportResponse>;
+    /**
+     * Lease a retrievable authentication grant
+     *
+     * Service callers only. Resolves the current access token through the broker, records the lease, and returns it once. Cache only in memory until expiry minus margin (or at most five minutes without expiry), re-lease after target 401/403, and never persist or place the token in workflow payloads.
+     */
+    readonly authGrantsLease: (client: RpcCaller, params: Api.AuthGrantLeaseParams) => Promise<Api.AgentApiOutcomeOfAuthGrantLeaseResponse>;
+    /**
+     * Read authentication grant metadata
+     *
+     * Returns creator attribution, provider binding, scopes, audience, expiry, status, and token-presence flags; access and refresh token values are never returned.
+     */
+    readonly authGrantsRead: (client: RpcCaller, params: Api.AuthGrantReadParams) => Promise<Api.AgentApiOutcomeOfAuthGrantReadResponse>;
+    /**
+     * List authentication grants
+     *
+     * Lists non-secret grant metadata for the universe, optionally filtered by status.
+     */
+    readonly authGrantsList: (client: RpcCaller, params: Api.AuthGrantListParams) => Promise<Api.AgentApiOutcomeOfAuthGrantListResponse>;
+    /**
+     * Revoke an authentication grant
+     *
+     * Marks the grant unusable by token consumers while retaining non-secret audit metadata.
+     */
+    readonly authGrantsRevoke: (client: RpcCaller, params: Api.AuthGrantRevokeParams) => Promise<Api.AgentApiOutcomeOfAuthGrantRevokeResponse>;
+    /**
+     * Register an OAuth client
+     *
+     * Stores provider endpoints and client identity; an optional plaintext client secret is encrypted and represented thereafter only by hasClientSecret.
+     */
+    readonly authClientsCreate: (client: RpcCaller, params: Api.AuthClientCreateParams) => Promise<Api.AgentApiOutcomeOfAuthClientCreateResponse>;
+    /**
+     * Read OAuth client metadata
+     *
+     * Returns endpoints, public client identity, defaults, and secret-presence state; the client secret is never returned.
+     */
+    readonly authClientsRead: (client: RpcCaller, params: Api.AuthClientReadParams) => Promise<Api.AgentApiOutcomeOfAuthClientReadResponse>;
+    /**
+     * List OAuth clients
+     *
+     * Lists non-secret OAuth client registrations in the universe.
+     */
+    readonly authClientsList: (client: RpcCaller, params: Api.AuthClientListParams) => Promise<Api.AgentApiOutcomeOfAuthClientListResponse>;
+    /**
+     * Delete an OAuth client
+     *
+     * Deletes the client registration and its stored client secret; grants already created from it remain separate records.
+     */
+    readonly authClientsDelete: (client: RpcCaller, params: Api.AuthClientDeleteParams) => Promise<Api.AgentApiOutcomeOfAuthClientDeleteResponse>;
+    /**
+     * Start an OAuth authorization flow
+     *
+     * Creates a short-lived PKCE flow carrying the immutable grant exposure choice and returns a browser authorization URL containing one-time state. Treat the URL as sensitive and poll auth/flows/read for completion.
+     */
+    readonly authFlowsStart: (client: RpcCaller, params: Api.AuthFlowStartParams) => Promise<Api.AgentApiOutcomeOfAuthFlowStartResponse>;
+    /**
+     * Read OAuth flow status
+     *
+     * Polls a flow's pending/completed/failed/expired state and returns the resulting grant id when authorization succeeds; no token value is exposed.
+     */
+    readonly authFlowsRead: (client: RpcCaller, params: Api.AuthFlowStatusParams) => Promise<Api.AgentApiOutcomeOfAuthFlowStatusResponse>;
+    /**
+     * Register an authentication provider
+     *
+     * Creates a model or GitHub credential source. Plaintext API keys/private keys are encrypted on receipt and later represented only by configuration plus hasCredential.
+     */
+    readonly authProvidersCreate: (client: RpcCaller, params: Api.AuthProviderCreateParams) => Promise<Api.AgentApiOutcomeOfAuthProviderCreateResponse>;
+    /**
+     * Read authentication provider metadata
+     *
+     * Returns provider kind, non-secret configuration, credential-presence state, and status; stored credentials are never returned.
+     */
+    readonly authProvidersRead: (client: RpcCaller, params: Api.AuthProviderReadParams) => Promise<Api.AgentApiOutcomeOfAuthProviderReadResponse>;
+    /**
+     * List authentication providers
+     *
+     * Lists non-secret model/GitHub provider registrations for the universe.
+     */
+    readonly authProvidersList: (client: RpcCaller, params: Api.AuthProviderListParams) => Promise<Api.AgentApiOutcomeOfAuthProviderListResponse>;
+    /**
+     * Delete an authentication provider
+     *
+     * Deletes the provider registration and its directly stored credential; separately stored grants remain independent records.
+     */
+    readonly authProvidersDelete: (client: RpcCaller, params: Api.AuthProviderDeleteParams) => Promise<Api.AgentApiOutcomeOfAuthProviderDeleteResponse>;
+    /**
+     * List GitHub App installations
+     *
+     * Uses the registered GitHub App provider credential to query accessible installations and returns account/permission metadata without tokens.
+     */
+    readonly authGithubInstallationsList: (client: RpcCaller, params: Api.AuthGitHubInstallationListParams) => Promise<Api.AgentApiOutcomeOfAuthGitHubInstallationListResponse>;
+    /**
+     * Grant access to a GitHub App installation
+     *
+     * Creates or refreshes a universe auth grant for one accessible installation. The installation token is brokered internally and never returned.
+     */
+    readonly authGithubInstallationsGrant: (client: RpcCaller, params: Api.AuthGitHubInstallationGrantParams) => Promise<Api.AgentApiOutcomeOfAuthGitHubInstallationGrantResponse>;
+    /**
+     * Create a bot
+     *
+     * Creates the bot record, optionally with its triggers, and starts its controller. Fails if the bot id exists; a trigger failure rolls the bot back.
+     */
+    readonly botsCreate: (client: RpcCaller, params: Api.BotCreateParams) => Promise<Api.AgentApiOutcomeOfBotCreateResponse>;
+    /**
+     * Create or replace a bot document
+     *
+     * Replaces the mutable configuration whole and signals the controller, which applies it at its next idle boundary. Pass expectedRevision when replacing; a closed bot accepts label-only edits.
+     */
+    readonly botsPut: (client: RpcCaller, params: Api.BotPutParams) => Promise<Api.AgentApiOutcomeOfBotPutResponse>;
+    /**
+     * Read a bot
+     *
+     * Returns the bot record, its current revision, and lifecycle columns.
+     */
+    readonly botsRead: (client: RpcCaller, params: Api.BotReadParams) => Promise<Api.AgentApiOutcomeOfBotReadResponse>;
+    /**
+     * List bots
+     *
+     * Returns the roster: every bot with its trigger count, pending event count, and latest event, optionally narrowed by createdBy.
+     */
+    readonly botsList: (client: RpcCaller, params: Api.BotListParams) => Promise<Api.AgentApiOutcomeOfBotListResponse>;
+    /**
+     * Close a bot
+     *
+     * Terminal and idempotent: disables every trigger, drops schedules, and tells the controller to archive pending events and force-close its sessions. Returns once signalled; follow bots/state/read for closing to closed.
+     */
+    readonly botsClose: (client: RpcCaller, params: Api.BotCloseParams) => Promise<Api.AgentApiOutcomeOfBotCloseResponse>;
+    /**
+     * Delete a bot
+     *
+     * Closes the bot if needed, waits for its controller to complete, deletes the sessions it closed, and removes the record so the bot id is free again.
+     */
+    readonly botsDelete: (client: RpcCaller, params: Api.BotDeleteParams) => Promise<Api.AgentApiOutcomeOfBotDeleteResponse>;
+    /**
+     * Read bot controller state
+     *
+     * Queries the controller workflow for its live snapshot (sessions, buffers, active and recent deliveries, budget) and lists sub-agent descendants. The controller is absent until the bot's first event.
+     */
+    readonly botsStateRead: (client: RpcCaller, params: Api.BotStateReadParams) => Promise<Api.AgentApiOutcomeOfBotStateReadResponse>;
+    /**
+     * Rotate a bot session
+     *
+     * Asks the controller to close one of the bot's sessions at its next idle boundary and continue on a fresh generation; queued deliveries follow.
+     */
+    readonly botsSessionsRotate: (client: RpcCaller, params: Api.BotSessionRotateParams) => Promise<Api.AgentApiOutcomeOfBotSessionRotateResponse>;
+    /**
+     * Create or replace a trigger
+     *
+     * Validates the trigger document (CEL parses, grants exist, one inbox per bot, chat routes per conversation), reconciles its Temporal Schedule, and stores it. A poll spec edit resets the cursor; a webhook keeps its URL token.
+     */
+    readonly botsTriggersPut: (client: RpcCaller, params: Api.BotTriggerPutParams) => Promise<Api.AgentApiOutcomeOfBotTriggerPutResponse>;
+    /**
+     * Read a trigger
+     *
+     * Returns one trigger with its incidents and cursor; the ingest path and pairing code are included for bot-management callers.
+     */
+    readonly botsTriggersRead: (client: RpcCaller, params: Api.BotTriggerReadParams) => Promise<Api.AgentApiOutcomeOfBotTriggerReadResponse>;
+    /**
+     * List a bot's triggers
+     *
+     * Returns every trigger of the bot ordered by id, secrets included for bot-management callers.
+     */
+    readonly botsTriggersList: (client: RpcCaller, params: Api.BotTriggerListParams) => Promise<Api.AgentApiOutcomeOfBotTriggerListResponse>;
+    /**
+     * Delete a trigger
+     *
+     * Drops the trigger's Temporal Schedule and pairings, then the record; stored events keep their history.
+     */
+    readonly botsTriggersDelete: (client: RpcCaller, params: Api.BotTriggerDeleteParams) => Promise<Api.AgentApiOutcomeOfBotTriggerDeleteResponse>;
+    /**
+     * Admit an event manually
+     *
+     * Stores an operator-authored event for the bot's main session and wakes the controller. eventId is the dedupe identity; a duplicate returns the stored row.
+     */
+    readonly botsEventsAdmit: (client: RpcCaller, params: Api.BotEventAdmitParams) => Promise<Api.AgentApiOutcomeOfBotEventAdmitResponse>;
+    /**
+     * Replay a stored event
+     *
+     * Re-admits the stored envelope as a fresh event with the original routing; the replay never coalesces.
+     */
+    readonly botsEventsReplay: (client: RpcCaller, params: Api.BotEventReplayParams) => Promise<Api.AgentApiOutcomeOfBotEventReplayResponse>;
+    /**
+     * List a bot's events
+     *
+     * Cursor-paginated event log, newest first, with outcomes; payload documents stay in the CAS.
+     */
+    readonly botsEventsList: (client: RpcCaller, params: Api.BotEventListParams) => Promise<Api.AgentApiOutcomeOfBotEventListResponse>;
+    /**
+     * Read an event by number
+     *
+     * Returns the event row and its full stored envelope document.
+     */
+    readonly botsEventsRead: (client: RpcCaller, params: Api.BotEventReadParams) => Promise<Api.AgentApiOutcomeOfBotEventReadResponse>;
+    /**
+     * Test a CEL filter
+     *
+     * Evaluates a filter against one payload or a sample of recent stored events, reporting matches and evaluation errors without changing anything.
+     */
+    readonly botsFiltersTest: (client: RpcCaller, params: Api.BotFilterTestParams) => Promise<Api.AgentApiOutcomeOfBotFilterTestResponse>;
+    /**
+     * Create a channel account
+     *
+     * Registers a provider account (Telegram, WhatsApp) for this universe. The credential is a retrievable grant reference; no token is accepted here.
+     */
+    readonly channelsAccountsCreate: (client: RpcCaller, params: Api.ChannelAccountCreateParams) => Promise<Api.AgentApiOutcomeOfChannelAccountCreateResponse>;
+    /**
+     * Create or replace a channel account
+     *
+     * Replaces the account document whole; pass expectedRevision when replacing. The connector host picks the change up on its next discovery pass.
+     */
+    readonly channelsAccountsPut: (client: RpcCaller, params: Api.ChannelAccountPutParams) => Promise<Api.AgentApiOutcomeOfChannelAccountPutResponse>;
+    /**
+     * Read a channel account
+     *
+     * Returns the account document and revision.
+     */
+    readonly channelsAccountsRead: (client: RpcCaller, params: Api.ChannelAccountReadParams) => Promise<Api.AgentApiOutcomeOfChannelAccountReadResponse>;
+    /**
+     * List channel accounts
+     *
+     * Lists this universe's provider accounts, optionally by provider.
+     */
+    readonly channelsAccountsList: (client: RpcCaller, params: Api.ChannelAccountListParams) => Promise<Api.AgentApiOutcomeOfChannelAccountListResponse>;
+    /**
+     * Delete a channel account
+     *
+     * Removes the account and its pairings; chat triggers that reference it stop serving conversations.
+     */
+    readonly channelsAccountsDelete: (client: RpcCaller, params: Api.ChannelAccountDeleteParams) => Promise<Api.AgentApiOutcomeOfChannelAccountDeleteResponse>;
+    /**
+     * Admit a provider message
+     *
+     * Service callers only. Resolves the chat trigger for the conversation, applies pairing, and signals the conversation workflow. Returns the decision so the connector can send pairing prompts itself; acknowledge the provider only after this returns.
+     */
+    readonly channelsInboundAdmit: (client: RpcCaller, params: Api.ChannelInboundAdmitParams) => Promise<Api.AgentApiOutcomeOfChannelInboundAdmitResponse>;
+    /**
+     * List chat pairings
+     *
+     * Lists conversations paired to chat triggers, optionally by account or bot.
+     */
+    readonly channelsPairingsList: (client: RpcCaller, params: Api.ChannelPairingListParams) => Promise<Api.AgentApiOutcomeOfChannelPairingListResponse>;
+    /**
+     * Unpair a conversation
+     *
+     * Removes one pairing; the conversation must present the pairing code again to reconnect.
+     */
+    readonly channelsPairingsDelete: (client: RpcCaller, params: Api.ChannelPairingDeleteParams) => Promise<Api.AgentApiOutcomeOfChannelPairingDeleteResponse>;
+    /**
+     * Read a conversation snapshot
+     *
+     * Queries the conversation workflow's live state for one chat, for debugging; absent when no workflow exists yet.
+     */
+    readonly channelsConversationsRead: (client: RpcCaller, params: Api.ChannelConversationReadParams) => Promise<Api.AgentApiOutcomeOfChannelConversationReadResponse>;
+    /**
+     * List a universe's deployment provider bindings
+     *
+     * Deployment configuration inventory of one universe's provider bindings.
+     */
+    readonly deploymentEnvironmentProviderBindingsList: (client: RpcCaller, params: Api.DeploymentUniverseReadParams) => Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse>;
+    /**
+     * Create a universe
+     *
+     * Creates the deployment tenant boundary for an explicit UUID. The operation is idempotent and reports whether a new universe was created.
+     */
+    readonly deploymentUniversesCreate: (client: RpcCaller, params: Api.DeploymentUniverseCreateParams) => Promise<Api.AgentApiOutcomeOfDeploymentUniverseCreateResponse>;
+    /**
+     * List universes
+     *
+     * Returns deployment-wide universe summaries with approximate live aggregate counts and last session activity.
+     */
+    readonly deploymentUniversesList: (client: RpcCaller, params: Api.DeploymentUniverseListParams) => Promise<Api.AgentApiOutcomeOfDeploymentUniverseListResponse>;
+    /**
+     * Read a universe
+     *
+     * Returns one deployment tenant summary with aggregate session, workspace, profile, and blob usage.
+     */
+    readonly deploymentUniversesRead: (client: RpcCaller, params: Api.DeploymentUniverseReadParams) => Promise<Api.AgentApiOutcomeOfDeploymentUniverseReadResponse>;
+    /**
+     * Set a universe slug
+     *
+     * Sets or changes a deployment-unique slug without changing the universe UUID or resources. The previous slug is released and old URLs may stop working. With onlyIfUnset, a different existing slug is a conflict. Claiming another universe's slug also returns a conflict. Does not create a universe.
+     */
+    readonly deploymentUniversesSlugPut: (client: RpcCaller, params: Api.DeploymentUniverseSlugPutParams) => Promise<Api.AgentApiOutcomeOfDeploymentUniverseReadResponse>;
+    /**
+     * Purge a universe
+     *
+     * Permanently terminates live session workflows, deletes external blob objects, and cascades universe data. The purge is resumable/idempotent after partial failure.
+     */
+    readonly deploymentUniversesDelete: (client: RpcCaller, params: Api.DeploymentUniverseDeleteParams) => Promise<Api.AgentApiOutcomeOfDeploymentUniverseDeleteResponse>;
+    /**
+     * Create a scoped API key
+     *
+     * Mints a key for a universe or the deployment with the method groups it may call and whether it may assert actors. The plaintext secret is returned exactly once and cannot be recovered; persist only the displayed prefix for identification. Key authority is immutable: revoke and mint to change what one may do.
+     */
+    readonly deploymentApiKeysCreate: (client: RpcCaller, params: Api.DeploymentApiKeyCreateParams) => Promise<Api.AgentApiOutcomeOfDeploymentApiKeyCreateResponse>;
+    /**
+     * List scoped API keys
+     *
+     * Returns non-secret key metadata, all keys or those of one scope, including groups, revocation and last-use timestamps. Plaintext secrets are never stored or returned.
+     */
+    readonly deploymentApiKeysList: (client: RpcCaller, params: Api.DeploymentApiKeyListParams) => Promise<Api.AgentApiOutcomeOfDeploymentApiKeyListResponse>;
+    /**
+     * Rotate a scoped API key
+     *
+     * Atomically replaces an active key secret and display prefix, immediately rejecting the old secret on subsequent requests. Preserves scope, groups, actor authority, name, creator and creation time; clears last use. Returns the new secret once. Unknown or revoked prefixes are not found. Already admitted work continues.
+     */
+    readonly deploymentApiKeysRotate: (client: RpcCaller, params: Api.DeploymentApiKeyRotateParams) => Promise<Api.AgentApiOutcomeOfDeploymentApiKeyCreateResponse>;
+    /**
+     * Revoke a scoped API key
+     *
+     * Revokes the key with this display prefix; revoking a revoked key keeps its first revocation time. An unknown prefix is not found.
+     */
+    readonly deploymentApiKeysRevoke: (client: RpcCaller, params: Api.DeploymentApiKeyRevokeParams) => Promise<Api.AgentApiOutcomeOfDeploymentApiKeyRevokeResponse>;
+    /**
+     * Put an environment provider
+     *
+     * Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+     */
+    readonly deploymentEnvironmentProvidersPut: (client: RpcCaller, params: Api.DeploymentEnvironmentProviderPutParams) => Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderPutResponse>;
+    /**
+     * List environment providers
+     *
+     * Returns every deployment-registered deployment provider and its controller connection.
+     */
+    readonly deploymentEnvironmentProvidersList: (client: RpcCaller, params: Api.DeploymentEnvironmentProviderListParams) => Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderListResponse>;
+    /**
+     * Read an environment provider
+     *
+     * Returns one deployment-registered deployment provider and its controller connection.
+     */
+    readonly deploymentEnvironmentProvidersRead: (client: RpcCaller, params: Api.DeploymentEnvironmentProviderReadParams) => Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderReadResponse>;
+    /**
+     * Delete an environment provider
+     *
+     * Deletes a deployment provider only when no universe binding references it.
+     */
+    readonly deploymentEnvironmentProvidersDelete: (client: RpcCaller, params: Api.DeploymentEnvironmentProviderDeleteParams) => Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse>;
+    /**
+     * Put an environment provider binding
+     *
+     * Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+     */
+    readonly deploymentEnvironmentProvidersBindingsPut: (client: RpcCaller, params: Api.DeploymentProviderBindingPutParams) => Promise<Api.AgentApiOutcomeOfDeploymentProviderBindingPutResponse>;
+    /**
+     * Delete an environment provider binding
+     *
+     * Deletes a universe provider binding only after every referencing environment has reached Closed.
+     */
+    readonly deploymentEnvironmentProvidersBindingsDelete: (client: RpcCaller, params: Api.DeploymentProviderBindingDeleteParams) => Promise<Api.AgentApiOutcomeOfDeploymentProviderBindingDeleteResponse>;
+    /**
+     * Adopt a provider environment
+     *
+     * Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
+     */
+    readonly deploymentEnvironmentsAdopt: (client: RpcCaller, params: Api.DeploymentEnvironmentAdoptParams) => Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse>;
+    /**
+     * List channel accounts across universes
+     *
+     * The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.
+     */
+    readonly deploymentChannelsAccountsList: (client: RpcCaller, params: Api.DeploymentChannelAccountListParams) => Promise<Api.AgentApiOutcomeOfDeploymentChannelAccountListResponse>;
+};
+//# sourceMappingURL=methods.d.ts.map