@qlever-llc/trellis 0.8.4 → 0.9.0-rc.2

package/esm/auth/protocol.d.ts

@@ -4,24 +4,10 @@ export declare const ParticipantKindSchema: Type.TUnion<[Type.TUnion<[Type.TLite
 export type ParticipantKind = StaticDecode<typeof ParticipantKindSchema>;
 export declare const DigestSchema: Type.TString;
 export declare const OpenObjectSchema: Type.TUnsafe<Record<string, unknown>>;
-export declare const ServiceAppliedDeploymentContractSchema: Type.TObject<{
-    contractId: Type.TString;
-    allowedDigests: Type.TArray<Type.TString>;
-    resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
-}>;
-export declare const DeviceAppliedDeploymentContractSchema: Type.TObject<{
-    contractId: Type.TString;
-    allowedDigests: Type.TArray<Type.TString>;
-}>;
-export declare const ServiceDeploymentSchema: Type.TObject<{
-    deploymentId: Type.TString;
-    namespaces: Type.TArray<Type.TString>;
-    disabled: Type.TBoolean;
-    appliedContracts: Type.TArray<Type.TObject<{
-        contractId: Type.TString;
-        allowedDigests: Type.TArray<Type.TString>;
-        resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
-    }>>;
+export declare const ServiceDeploymentSchema: Type.TUnsafe<{
+    deploymentId: string;
+    namespaces: string[];
+    disabled: boolean;
 }>;
 export declare const ServiceInstanceSchema: Type.TObject<{
     instanceId: Type.TString;
@@ -35,269 +21,1613 @@ export declare const ServiceInstanceSchema: Type.TObject<{
     createdAt: Type.TString;
 }>;
 export declare const ApprovalDecisionSchema: Type.TUnion<[Type.TLiteral<"approved">, Type.TLiteral<"denied">]>;
-export declare const ContractApprovalViewSchema: Type.TObject<{
+export declare const IdentityAnchorViewSchema: Type.TUnion<[Type.TObject<{
+    kind: Type.TLiteral<"web">;
+    contractId: Type.TString;
+    origin: Type.TString;
+}>, Type.TObject<{
+    kind: Type.TLiteral<"cli">;
+    contractId: Type.TString;
+    sessionPublicKey: Type.TString;
+}>, Type.TObject<{
+    kind: Type.TLiteral<"native">;
+    contractId: Type.TString;
+    sessionPublicKey: Type.TString;
+}>, Type.TObject<{
+    kind: Type.TLiteral<"device-user">;
+    contractId: Type.TString;
+    devicePublicKey: Type.TString;
+}>]>;
+export declare const ContractEvidenceViewSchema: Type.TObject<{
+    contractDigest: Type.TString;
+    contractId: Type.TString;
+}>;
+export declare const ApprovalEvidenceViewSchema: Type.TObject<{
     contractDigest: Type.TString;
     contractId: Type.TString;
     displayName: Type.TString;
     description: Type.TString;
-    capabilities: Type.TArray<Type.TString>;
+    capabilities: Type.TRecord<"^.*$", Type.TObject<{
+        displayName: Type.TString;
+        description: Type.TString;
+        consequence: Type.TOptional<Type.TString>;
+    }>>;
+}>;
+export declare const IdentityEnvelopeApprovalViewSchema: Type.TObject<{
+    identityEnvelopeId: Type.TString;
+    identityAnchor: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"web">;
+        contractId: Type.TString;
+        origin: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"cli">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"native">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device-user">;
+        contractId: Type.TString;
+        devicePublicKey: Type.TString;
+    }>]>;
+    contractEvidence: Type.TObject<{
+        contractDigest: Type.TString;
+        contractId: Type.TString;
+    }>;
+    displayName: Type.TString;
+    description: Type.TString;
+    capabilities: Type.TRecord<"^.*$", Type.TObject<{
+        displayName: Type.TString;
+        description: Type.TString;
+        consequence: Type.TOptional<Type.TString>;
+    }>>;
 }>;
 export declare const ApprovalRecordViewSchema: Type.TObject<{
     user: Type.TString;
     answer: Type.TUnion<[Type.TLiteral<"approved">, Type.TLiteral<"denied">]>;
     answeredAt: Type.TString;
     updatedAt: Type.TString;
-    approval: Type.TObject<{
+    identityEnvelopeId: Type.TString;
+    identityAnchor: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"web">;
+        contractId: Type.TString;
+        origin: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"cli">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"native">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device-user">;
+        contractId: Type.TString;
+        devicePublicKey: Type.TString;
+    }>]>;
+    contractEvidence: Type.TObject<{
         contractDigest: Type.TString;
         contractId: Type.TString;
+    }>;
+    displayName: Type.TString;
+    description: Type.TString;
+    capabilities: Type.TRecord<"^.*$", Type.TObject<{
         displayName: Type.TString;
         description: Type.TString;
-        capabilities: Type.TArray<Type.TString>;
-    }>;
+        consequence: Type.TOptional<Type.TString>;
+    }>>;
     participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
 }>;
-export declare const InstanceGrantPolicyActorSchema: Type.TObject<{
-    origin: Type.TString;
-    id: Type.TString;
+export declare const DeploymentEnvelopeKindSchema: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
+export type DeploymentEnvelopeKind = StaticDecode<typeof DeploymentEnvelopeKindSchema>;
+export declare const EnvelopeSurfaceKindSchema: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+export type EnvelopeSurfaceKind = StaticDecode<typeof EnvelopeSurfaceKindSchema>;
+export declare const EnvelopeSurfaceActionSchema: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+export type EnvelopeSurfaceAction = StaticDecode<typeof EnvelopeSurfaceActionSchema>;
+export declare const EnvelopeResourceKindSchema: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+export type EnvelopeResourceKind = StaticDecode<typeof EnvelopeResourceKindSchema>;
+export declare const EnvelopeBoundaryContractSchema: Type.TObject<{
+    contractId: Type.TString;
+    required: Type.TBoolean;
 }>;
-export declare const PortalProfileSourceSchema: Type.TObject<{
-    kind: Type.TLiteral<"portal_profile">;
-    portalId: Type.TString;
-    entryUrl: Type.TString;
+export type EnvelopeBoundaryContract = StaticDecode<typeof EnvelopeBoundaryContractSchema>;
+export declare const EnvelopeBoundarySurfaceSchema: Type.TObject<{
+    contractId: Type.TString;
+    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+    name: Type.TString;
+    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+    required: Type.TBoolean;
 }>;
-export declare const AdminPolicySourceSchema: Type.TObject<{
-    kind: Type.TLiteral<"admin_policy">;
-    createdBy: Type.TOptional<Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
+export type EnvelopeBoundarySurface = StaticDecode<typeof EnvelopeBoundarySurfaceSchema>;
+export declare const EnvelopeBoundaryResourceSchema: Type.TObject<{
+    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+    alias: Type.TString;
+    required: Type.TBoolean;
+}>;
+export type EnvelopeBoundaryResource = StaticDecode<typeof EnvelopeBoundaryResourceSchema>;
+export declare const EnvelopeBoundarySchema: Type.TObject<{
+    contracts: Type.TArray<Type.TObject<{
+        contractId: Type.TString;
+        required: Type.TBoolean;
     }>>;
-    updatedBy: Type.TOptional<Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
+    surfaces: Type.TArray<Type.TObject<{
+        contractId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+        name: Type.TString;
+        action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+        required: Type.TBoolean;
+    }>>;
+    capabilities: Type.TArray<Type.TString>;
+    resources: Type.TArray<Type.TObject<{
+        kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+        alias: Type.TString;
+        required: Type.TBoolean;
     }>>;
 }>;
-export declare const InstanceGrantPolicySchema: Type.TObject<{
-    contractId: Type.TString;
-    allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-    impliedCapabilities: Type.TArray<Type.TString>;
+export type EnvelopeBoundary = StaticDecode<typeof EnvelopeBoundarySchema>;
+export declare const DeploymentEnvelopeSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
     disabled: Type.TBoolean;
     createdAt: Type.TString;
     updatedAt: Type.TString;
-    source: Type.TUnion<[Type.TObject<{
-        kind: Type.TLiteral<"admin_policy">;
-        createdBy: Type.TOptional<Type.TObject<{
-            origin: Type.TString;
-            id: Type.TString;
+    boundary: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
         }>>;
-        updatedBy: Type.TOptional<Type.TObject<{
-            origin: Type.TString;
-            id: Type.TString;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
         }>>;
-    }>, Type.TObject<{
-        kind: Type.TLiteral<"portal_profile">;
-        portalId: Type.TString;
-        entryUrl: Type.TString;
-    }>]>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
 }>;
-export type InstanceGrantPolicy = StaticDecode<typeof InstanceGrantPolicySchema>;
-export declare const AuthListInstanceGrantPoliciesSchema: Type.TObject<{}>;
-export declare const AuthListInstanceGrantPoliciesResponseSchema: Type.TObject<{
-    policies: Type.TArray<Type.TObject<{
-        contractId: Type.TString;
-        allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-        impliedCapabilities: Type.TArray<Type.TString>;
+export type DeploymentEnvelope = StaticDecode<typeof DeploymentEnvelopeSchema>;
+export declare const DeploymentResourceBindingSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+    alias: Type.TString;
+    binding: Type.TRecord<"^.*$", Type.TUnknown>;
+    limits: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+    createdAt: Type.TString;
+    updatedAt: Type.TString;
+}>;
+export type DeploymentResourceBinding = StaticDecode<typeof DeploymentResourceBindingSchema>;
+export declare const DeploymentContractEvidenceSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    contractId: Type.TString;
+    contractDigest: Type.TString;
+    contract: Type.TUnsafe<Record<string, unknown>>;
+    firstSeenAt: Type.TString;
+    lastSeenAt: Type.TString;
+    ignoredAt: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    ignoredBy: Type.TOptional<Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>>;
+    ignoreReason: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+}>;
+export type DeploymentContractEvidence = StaticDecode<typeof DeploymentContractEvidenceSchema>;
+export declare const DeploymentPortalRouteSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
+    entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+    disabled: Type.TBoolean;
+    updatedAt: Type.TString;
+}>;
+export type DeploymentPortalRoute = StaticDecode<typeof DeploymentPortalRouteSchema>;
+export declare const DeploymentGrantOverrideSchema: Type.TUnion<[Type.TObject<{
+    deploymentId: Type.TString;
+    identityKind: Type.TLiteral<"web">;
+    grantKind: Type.TLiteral<"capability">;
+    contractId: Type.TString;
+    origin: Type.TString;
+    sessionPublicKey: Type.TNull;
+    capability: Type.TString;
+    capabilityGroupKey: Type.TNull;
+}>, Type.TObject<{
+    deploymentId: Type.TString;
+    identityKind: Type.TLiteral<"web">;
+    grantKind: Type.TLiteral<"capability-group">;
+    contractId: Type.TString;
+    origin: Type.TString;
+    sessionPublicKey: Type.TNull;
+    capability: Type.TNull;
+    capabilityGroupKey: Type.TString;
+}>, Type.TObject<{
+    deploymentId: Type.TString;
+    identityKind: Type.TLiteral<"session">;
+    grantKind: Type.TLiteral<"capability">;
+    contractId: Type.TString;
+    origin: Type.TNull;
+    sessionPublicKey: Type.TString;
+    capability: Type.TString;
+    capabilityGroupKey: Type.TNull;
+}>, Type.TObject<{
+    deploymentId: Type.TString;
+    identityKind: Type.TLiteral<"session">;
+    grantKind: Type.TLiteral<"capability-group">;
+    contractId: Type.TString;
+    origin: Type.TNull;
+    sessionPublicKey: Type.TString;
+    capability: Type.TNull;
+    capabilityGroupKey: Type.TString;
+}>]>;
+export type DeploymentGrantOverride = StaticDecode<typeof DeploymentGrantOverrideSchema>;
+export declare const EnvelopeExpansionRequestSchema: Type.TObject<{
+    requestId: Type.TString;
+    deploymentId: Type.TString;
+    requestedByKind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"user">, Type.TLiteral<"admin">, Type.TLiteral<"automation">]>;
+    requestedBy: Type.TRecord<"^.*$", Type.TUnknown>;
+    contractId: Type.TString;
+    contractDigest: Type.TString;
+    contract: Type.TUnsafe<Record<string, unknown>>;
+    state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
+    createdAt: Type.TString;
+    decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+    decidedBy: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+    decisionReason: Type.TUnion<[Type.TString, Type.TNull]>;
+    delta: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+}>;
+export type EnvelopeExpansionRequest = StaticDecode<typeof EnvelopeExpansionRequestSchema>;
+export declare const AuthEnvelopesListSchema: Type.TObject<{
+    kind: Type.TOptional<Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>>;
+    disabled: Type.TOptional<Type.TBoolean>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export type AuthEnvelopesListInput = StaticDecode<typeof AuthEnvelopesListSchema>;
+export declare const AuthEnvelopesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
         disabled: Type.TBoolean;
         createdAt: Type.TString;
         updatedAt: Type.TString;
-        source: Type.TUnion<[Type.TObject<{
-            kind: Type.TLiteral<"admin_policy">;
-            createdBy: Type.TOptional<Type.TObject<{
-                origin: Type.TString;
-                id: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
             }>>;
-            updatedBy: Type.TOptional<Type.TObject<{
-                origin: Type.TString;
-                id: Type.TString;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
             }>>;
-        }>, Type.TObject<{
-            kind: Type.TLiteral<"portal_profile">;
-            portalId: Type.TString;
-            entryUrl: Type.TString;
-        }>]>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthUpsertInstanceGrantPolicySchema: Type.TObject<{
-    contractId: Type.TString;
-    allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-    impliedCapabilities: Type.TArray<Type.TString>;
+export type AuthEnvelopesListResponse = StaticDecode<typeof AuthEnvelopesListResponseSchema>;
+export declare const AuthEnvelopesGetSchema: Type.TObject<{
+    deploymentId: Type.TString;
 }>;
-export declare const AuthUpsertInstanceGrantPolicyResponseSchema: Type.TObject<{
-    policy: Type.TObject<{
-        contractId: Type.TString;
-        allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-        impliedCapabilities: Type.TArray<Type.TString>;
+export type AuthEnvelopesGetInput = StaticDecode<typeof AuthEnvelopesGetSchema>;
+export declare const AuthEnvelopesGetResponseSchema: Type.TObject<{
+    envelope: Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
         disabled: Type.TBoolean;
         createdAt: Type.TString;
         updatedAt: Type.TString;
-        source: Type.TUnion<[Type.TObject<{
-            kind: Type.TLiteral<"admin_policy">;
-            createdBy: Type.TOptional<Type.TObject<{
-                origin: Type.TString;
-                id: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
             }>>;
-            updatedBy: Type.TOptional<Type.TObject<{
-                origin: Type.TString;
-                id: Type.TString;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
             }>>;
-        }>, Type.TObject<{
-            kind: Type.TLiteral<"portal_profile">;
-            portalId: Type.TString;
-            entryUrl: Type.TString;
-        }>]>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
     }>;
-}>;
-export declare const AuthDisableInstanceGrantPolicySchema: Type.TObject<{
-    contractId: Type.TString;
-}>;
-export declare const AuthDisableInstanceGrantPolicyResponseSchema: Type.TObject<{
-    policy: Type.TObject<{
-        contractId: Type.TString;
-        allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-        impliedCapabilities: Type.TArray<Type.TString>;
-        disabled: Type.TBoolean;
+    resourceBindings: Type.TArray<Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+        alias: Type.TString;
+        binding: Type.TRecord<"^.*$", Type.TUnknown>;
+        limits: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
         createdAt: Type.TString;
         updatedAt: Type.TString;
-        source: Type.TUnion<[Type.TObject<{
-            kind: Type.TLiteral<"admin_policy">;
-            createdBy: Type.TOptional<Type.TObject<{
-                origin: Type.TString;
-                id: Type.TString;
+    }>>;
+    contractEvidence: Type.TArray<Type.TObject<{
+        deploymentId: Type.TString;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        firstSeenAt: Type.TString;
+        lastSeenAt: Type.TString;
+        ignoredAt: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+        ignoredBy: Type.TOptional<Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>>;
+        ignoreReason: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    }>>;
+    expansionRequests: Type.TArray<Type.TObject<{
+        requestId: Type.TString;
+        deploymentId: Type.TString;
+        requestedByKind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"user">, Type.TLiteral<"admin">, Type.TLiteral<"automation">]>;
+        requestedBy: Type.TRecord<"^.*$", Type.TUnknown>;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
+        createdAt: Type.TString;
+        decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        decidedBy: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+        decisionReason: Type.TUnion<[Type.TString, Type.TNull]>;
+        delta: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
             }>>;
-            updatedBy: Type.TOptional<Type.TObject<{
-                origin: Type.TString;
-                id: Type.TString;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
             }>>;
-        }>, Type.TObject<{
-            kind: Type.TLiteral<"portal_profile">;
-            portalId: Type.TString;
-            entryUrl: Type.TString;
-        }>]>;
-    }>;
-}>;
-export declare const AuthCreateServiceDeploymentSchema: Type.TObject<{
-    deploymentId: Type.TString;
-    namespaces: Type.TArray<Type.TString>;
-}>;
-export declare const AuthCreateServiceDeploymentResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    portalRoute: Type.TUnion<[Type.TObject<{
         deploymentId: Type.TString;
-        namespaces: Type.TArray<Type.TString>;
+        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
+        entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
         disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-            resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
-        }>>;
-    }>;
-}>;
-export declare const AuthListServiceDeploymentsSchema: Type.TObject<{
-    disabled: Type.TOptional<Type.TBoolean>;
-}>;
-export declare const AuthListServiceDeploymentsResponseSchema: Type.TObject<{
-    deployments: Type.TArray<Type.TObject<{
+        updatedAt: Type.TString;
+    }>, Type.TNull]>;
+    grantOverrides: Type.TArray<Type.TUnion<[Type.TObject<{
         deploymentId: Type.TString;
-        namespaces: Type.TArray<Type.TString>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-            resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
-        }>>;
-    }>>;
-}>;
-export declare const AuthApplyServiceDeploymentContractSchema: Type.TObject<{
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>]>>;
+}>;
+export type AuthEnvelopesGetResponse = StaticDecode<typeof AuthEnvelopesGetResponseSchema>;
+export declare const AuthEnvelopesGrantOverridesPutSchema: Type.TObject<{
     deploymentId: Type.TString;
-    contract: Type.TUnsafe<Record<string, unknown>>;
-    expectedDigest: Type.TString;
-    replaceExisting: Type.TOptional<Type.TBoolean>;
-}>;
-export declare const AuthApplyServiceDeploymentContractResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
+    overrides: Type.TArray<Type.TUnion<[Type.TObject<{
         deploymentId: Type.TString;
-        namespaces: Type.TArray<Type.TString>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-            resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
-        }>>;
-    }>;
-    contract: Type.TObject<{
-        digest: Type.TString;
-        id: Type.TString;
-        displayName: Type.TString;
-        description: Type.TString;
-        installedAt: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>]>>;
+}>;
+export type AuthEnvelopesGrantOverridesPutInput = StaticDecode<typeof AuthEnvelopesGrantOverridesPutSchema>;
+export declare const AuthEnvelopesGrantOverridesListSchema: Type.TObject<{
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export type AuthEnvelopesGrantOverridesListInput = StaticDecode<typeof AuthEnvelopesGrantOverridesListSchema>;
+export declare const AuthEnvelopesGrantOverridesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TUnion<[Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>]>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export type AuthEnvelopesGrantOverridesListResponse = StaticDecode<typeof AuthEnvelopesGrantOverridesListResponseSchema>;
+export declare const AuthEnvelopesGrantOverridesResponseSchema: Type.TObject<{
+    grantOverrides: Type.TArray<Type.TUnion<[Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>]>>;
+}>;
+export type AuthEnvelopesGrantOverridesResponse = StaticDecode<typeof AuthEnvelopesGrantOverridesResponseSchema>;
+export declare const AuthEnvelopesGrantOverridesRemoveSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    overrides: Type.TArray<Type.TUnion<[Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"web">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TString;
+        sessionPublicKey: Type.TNull;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TString;
+        capabilityGroupKey: Type.TNull;
+    }>, Type.TObject<{
+        deploymentId: Type.TString;
+        identityKind: Type.TLiteral<"session">;
+        grantKind: Type.TLiteral<"capability-group">;
+        contractId: Type.TString;
+        origin: Type.TNull;
+        sessionPublicKey: Type.TString;
+        capability: Type.TNull;
+        capabilityGroupKey: Type.TString;
+    }>]>>;
+}>;
+export type AuthEnvelopesGrantOverridesRemoveInput = StaticDecode<typeof AuthEnvelopesGrantOverridesRemoveSchema>;
+export declare const AuthEnvelopesExpandSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    contract: Type.TUnsafe<Record<string, unknown>>;
+    expectedDigest: Type.TString;
+}>;
+export type AuthEnvelopesExpandInput = StaticDecode<typeof AuthEnvelopesExpandSchema>;
+export declare const AuthEnvelopesExpandResponseSchema: Type.TObject<{
+    envelope: Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+    delta: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+    contractEvidence: Type.TObject<{
+        deploymentId: Type.TString;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        firstSeenAt: Type.TString;
+        lastSeenAt: Type.TString;
+        ignoredAt: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+        ignoredBy: Type.TOptional<Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>>;
+        ignoreReason: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    }>;
+    resourceBindings: Type.TArray<Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+        alias: Type.TString;
+        binding: Type.TRecord<"^.*$", Type.TUnknown>;
+        limits: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>>;
+}>;
+export type AuthEnvelopesExpandResponse = StaticDecode<typeof AuthEnvelopesExpandResponseSchema>;
+export declare const AuthEnvelopesApproveRequestSchema: Type.TObject<{
+    requestId: Type.TString;
+    reason: Type.TOptional<Type.TString>;
+}>;
+export type AuthEnvelopesApproveRequestInput = StaticDecode<typeof AuthEnvelopesApproveRequestSchema>;
+export declare const AuthEnvelopesApproveRequestResponseSchema: Type.TObject<{
+    request: Type.TObject<{
+        requestId: Type.TString;
+        deploymentId: Type.TString;
+        requestedByKind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"user">, Type.TLiteral<"admin">, Type.TLiteral<"automation">]>;
+        requestedBy: Type.TRecord<"^.*$", Type.TUnknown>;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
+        createdAt: Type.TString;
+        decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        decidedBy: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+        decisionReason: Type.TUnion<[Type.TString, Type.TNull]>;
+        delta: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+    envelope: Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+    delta: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+    contractEvidence: Type.TObject<{
+        deploymentId: Type.TString;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        firstSeenAt: Type.TString;
+        lastSeenAt: Type.TString;
+        ignoredAt: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+        ignoredBy: Type.TOptional<Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>>;
+        ignoreReason: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    }>;
+    resourceBindings: Type.TArray<Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+        alias: Type.TString;
+        binding: Type.TRecord<"^.*$", Type.TUnknown>;
+        limits: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>>;
+}>;
+export type AuthEnvelopesApproveRequestResponse = StaticDecode<typeof AuthEnvelopesApproveRequestResponseSchema>;
+export declare const AuthEnvelopeExpansionsListSchema: Type.TObject<{
+    deploymentId: Type.TOptional<Type.TString>;
+    state: Type.TOptional<Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export type AuthEnvelopeExpansionsListInput = StaticDecode<typeof AuthEnvelopeExpansionsListSchema>;
+export declare const AuthEnvelopeExpansionsListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        requestId: Type.TString;
+        deploymentId: Type.TString;
+        requestedByKind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"user">, Type.TLiteral<"admin">, Type.TLiteral<"automation">]>;
+        requestedBy: Type.TRecord<"^.*$", Type.TUnknown>;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
+        createdAt: Type.TString;
+        decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        decidedBy: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+        decisionReason: Type.TUnion<[Type.TString, Type.TNull]>;
+        delta: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export type AuthEnvelopeExpansionsListResponse = StaticDecode<typeof AuthEnvelopeExpansionsListResponseSchema>;
+export declare const AuthEnvelopeExpansionsRejectSchema: Type.TObject<{
+    requestId: Type.TString;
+    reason: Type.TOptional<Type.TString>;
+}>;
+export type AuthEnvelopeExpansionsRejectInput = StaticDecode<typeof AuthEnvelopeExpansionsRejectSchema>;
+export declare const AuthEnvelopeExpansionsRejectResponseSchema: Type.TObject<{
+    request: Type.TObject<{
+        requestId: Type.TString;
+        deploymentId: Type.TString;
+        requestedByKind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"user">, Type.TLiteral<"admin">, Type.TLiteral<"automation">]>;
+        requestedBy: Type.TRecord<"^.*$", Type.TUnknown>;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
+        createdAt: Type.TString;
+        decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        decidedBy: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
+        decisionReason: Type.TUnion<[Type.TString, Type.TNull]>;
+        delta: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+}>;
+export type AuthEnvelopeExpansionsRejectResponse = StaticDecode<typeof AuthEnvelopeExpansionsRejectResponseSchema>;
+export declare const AuthEnvelopeShrinkResourceSchema: Type.TObject<{
+    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+    alias: Type.TString;
+}>;
+export declare const AuthEnvelopeShrinkMissingBoundarySchema: Type.TObject<{
+    missing: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+}>;
+export declare const AuthEnvelopeShrinkImpactedSessionSchema: Type.TObject<{
+    sessionKey: Type.TString;
+    type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+    contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+    contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+    missing: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+}>;
+export declare const AuthEnvelopeShrinkImpactedIdentityEnvelopeSchema: Type.TObject<{
+    identityEnvelopeId: Type.TString;
+    identityAnchor: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"web">;
+        contractId: Type.TString;
+        origin: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"cli">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"native">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device-user">;
+        contractId: Type.TString;
+        devicePublicKey: Type.TString;
+    }>]>;
+    missing: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+}>;
+export declare const AuthEnvelopeShrinkImpactedRequestSchema: Type.TObject<{
+    requestId: Type.TString;
+    missing: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+}>;
+export declare const AuthEnvelopeChangeImpactSchema: Type.TObject<{
+    removed: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
     }>;
+    impactedSessions: Type.TArray<Type.TObject<{
+        sessionKey: Type.TString;
+        type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+        contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+        contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+        missing: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    impactedServiceInstances: Type.TArray<Type.TObject<{
+        missing: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    impactedDeviceSessions: Type.TArray<Type.TObject<{
+        sessionKey: Type.TString;
+        type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+        contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+        contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+        missing: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    impactedIdentityEnvelopes: Type.TArray<Type.TObject<{
+        identityEnvelopeId: Type.TString;
+        identityAnchor: Type.TUnion<[Type.TObject<{
+            kind: Type.TLiteral<"web">;
+            contractId: Type.TString;
+            origin: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"cli">;
+            contractId: Type.TString;
+            sessionPublicKey: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"native">;
+            contractId: Type.TString;
+            sessionPublicKey: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"device-user">;
+            contractId: Type.TString;
+            devicePublicKey: Type.TString;
+        }>]>;
+        missing: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    impactedPendingRequests: Type.TArray<Type.TObject<{
+        requestId: Type.TString;
+        missing: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>>;
+    orphanedResources: Type.TArray<Type.TObject<{
+        kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+        alias: Type.TString;
+    }>>;
 }>;
-export declare const AuthUnapplyServiceDeploymentContractSchema: Type.TObject<{
+export type AuthEnvelopeChangeImpact = StaticDecode<typeof AuthEnvelopeChangeImpactSchema>;
+export declare const AuthEnvelopesChangesPreviewSchema: Type.TObject<{
     deploymentId: Type.TString;
-    contractId: Type.TString;
-    digests: Type.TOptional<Type.TArray<Type.TString>>;
+    proposedBoundary: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
 }>;
-export declare const AuthUnapplyServiceDeploymentContractResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
+export type AuthEnvelopesChangesPreviewInput = StaticDecode<typeof AuthEnvelopesChangesPreviewSchema>;
+export declare const AuthEnvelopesChangesPreviewResponseSchema: Type.TObject<{
+    current: Type.TObject<{
         deploymentId: Type.TString;
-        namespaces: Type.TArray<Type.TString>;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+    proposed: Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
         disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+    impact: Type.TObject<{
+        removed: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+        impactedSessions: Type.TArray<Type.TObject<{
+            sessionKey: Type.TString;
+            type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+            contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+            contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedServiceInstances: Type.TArray<Type.TObject<{
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedDeviceSessions: Type.TArray<Type.TObject<{
+            sessionKey: Type.TString;
+            type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+            contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+            contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedIdentityEnvelopes: Type.TArray<Type.TObject<{
+            identityEnvelopeId: Type.TString;
+            identityAnchor: Type.TUnion<[Type.TObject<{
+                kind: Type.TLiteral<"web">;
+                contractId: Type.TString;
+                origin: Type.TString;
+            }>, Type.TObject<{
+                kind: Type.TLiteral<"cli">;
+                contractId: Type.TString;
+                sessionPublicKey: Type.TString;
+            }>, Type.TObject<{
+                kind: Type.TLiteral<"native">;
+                contractId: Type.TString;
+                sessionPublicKey: Type.TString;
+            }>, Type.TObject<{
+                kind: Type.TLiteral<"device-user">;
+                contractId: Type.TString;
+                devicePublicKey: Type.TString;
+            }>]>;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedPendingRequests: Type.TArray<Type.TObject<{
+            requestId: Type.TString;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        orphanedResources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+        }>>;
+    }>;
+}>;
+export type AuthEnvelopesChangesPreviewResponse = StaticDecode<typeof AuthEnvelopesChangesPreviewResponseSchema>;
+export declare const AuthEnvelopesShrinkSchema: Type.TObject<{
+    deploymentId: Type.TString;
+    proposedBoundary: Type.TObject<{
+        contracts: Type.TArray<Type.TObject<{
             contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-            resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
+            required: Type.TBoolean;
+        }>>;
+        surfaces: Type.TArray<Type.TObject<{
+            contractId: Type.TString;
+            kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+            name: Type.TString;
+            action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+            required: Type.TBoolean;
+        }>>;
+        capabilities: Type.TArray<Type.TString>;
+        resources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
+            required: Type.TBoolean;
+        }>>;
+    }>;
+    confirm: Type.TBoolean;
+}>;
+export type AuthEnvelopesShrinkInput = StaticDecode<typeof AuthEnvelopesShrinkSchema>;
+export declare const AuthEnvelopesShrinkResponseSchema: Type.TObject<{
+    envelope: Type.TObject<{
+        deploymentId: Type.TString;
+        kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">, Type.TLiteral<"app">, Type.TLiteral<"cli">, Type.TLiteral<"native">, Type.TLiteral<"device-user">]>;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+        boundary: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+    }>;
+    impact: Type.TObject<{
+        removed: Type.TObject<{
+            contracts: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+            surfaces: Type.TArray<Type.TObject<{
+                contractId: Type.TString;
+                kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                name: Type.TString;
+                action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                required: Type.TBoolean;
+            }>>;
+            capabilities: Type.TArray<Type.TString>;
+            resources: Type.TArray<Type.TObject<{
+                kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                alias: Type.TString;
+                required: Type.TBoolean;
+            }>>;
+        }>;
+        impactedSessions: Type.TArray<Type.TObject<{
+            sessionKey: Type.TString;
+            type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+            contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+            contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedServiceInstances: Type.TArray<Type.TObject<{
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedDeviceSessions: Type.TArray<Type.TObject<{
+            sessionKey: Type.TString;
+            type: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
+            contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+            contractDigest: Type.TUnion<[Type.TString, Type.TNull]>;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
+        }>>;
+        impactedIdentityEnvelopes: Type.TArray<Type.TObject<{
+            identityEnvelopeId: Type.TString;
+            identityAnchor: Type.TUnion<[Type.TObject<{
+                kind: Type.TLiteral<"web">;
+                contractId: Type.TString;
+                origin: Type.TString;
+            }>, Type.TObject<{
+                kind: Type.TLiteral<"cli">;
+                contractId: Type.TString;
+                sessionPublicKey: Type.TString;
+            }>, Type.TObject<{
+                kind: Type.TLiteral<"native">;
+                contractId: Type.TString;
+                sessionPublicKey: Type.TString;
+            }>, Type.TObject<{
+                kind: Type.TLiteral<"device-user">;
+                contractId: Type.TString;
+                devicePublicKey: Type.TString;
+            }>]>;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
         }>>;
-    }>;
-}>;
-export declare const AuthDisableServiceDeploymentSchema: Type.TObject<{
-    deploymentId: Type.TString;
-}>;
-export declare const AuthDisableServiceDeploymentResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
-        deploymentId: Type.TString;
-        namespaces: Type.TArray<Type.TString>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-            resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
+        impactedPendingRequests: Type.TArray<Type.TObject<{
+            requestId: Type.TString;
+            missing: Type.TObject<{
+                contracts: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+                surfaces: Type.TArray<Type.TObject<{
+                    contractId: Type.TString;
+                    kind: Type.TUnion<[Type.TLiteral<"rpc">, Type.TLiteral<"operation">, Type.TLiteral<"event">, Type.TLiteral<"feed">]>;
+                    name: Type.TString;
+                    action: Type.TUnion<[Type.TLiteral<"call">, Type.TLiteral<"publish">, Type.TLiteral<"subscribe">, Type.TLiteral<"read">, Type.TLiteral<"cancel">]>;
+                    required: Type.TBoolean;
+                }>>;
+                capabilities: Type.TArray<Type.TString>;
+                resources: Type.TArray<Type.TObject<{
+                    kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+                    alias: Type.TString;
+                    required: Type.TBoolean;
+                }>>;
+            }>;
         }>>;
-    }>;
-}>;
-export declare const AuthEnableServiceDeploymentSchema: Type.TObject<{
-    deploymentId: Type.TString;
-}>;
-export declare const AuthEnableServiceDeploymentResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
-        deploymentId: Type.TString;
-        namespaces: Type.TArray<Type.TString>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-            resourceBindingsByDigest: Type.TOptional<Type.TRecord<"^.*$", any>>;
+        orphanedResources: Type.TArray<Type.TObject<{
+            kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+            alias: Type.TString;
         }>>;
     }>;
+    retainedResources: Type.TArray<Type.TObject<{
+        kind: Type.TUnion<[Type.TLiteral<"kv">, Type.TLiteral<"store">, Type.TLiteral<"jobs">, Type.TLiteral<"transfer">]>;
+        alias: Type.TString;
+    }>>;
 }>;
-export declare const AuthRemoveServiceDeploymentSchema: Type.TObject<{
-    deploymentId: Type.TString;
-}>;
-export declare const AuthRemoveServiceDeploymentResponseSchema: Type.TObject<{
-    success: Type.TBoolean;
-}>;
-export declare const AuthProvisionServiceInstanceSchema: Type.TObject<{
+export type AuthEnvelopesShrinkResponse = StaticDecode<typeof AuthEnvelopesShrinkResponseSchema>;
+export declare const AuthServiceInstancesProvisionSchema: Type.TObject<{
     deploymentId: Type.TString;
     instanceKey: Type.TString;
 }>;
-export declare const AuthProvisionServiceInstanceResponseSchema: Type.TObject<{
+export declare const AuthServiceInstancesProvisionResponseSchema: Type.TObject<{
     instance: Type.TObject<{
         instanceId: Type.TString;
         deploymentId: Type.TString;
@@ -310,12 +1640,14 @@ export declare const AuthProvisionServiceInstanceResponseSchema: Type.TObject<{
         createdAt: Type.TString;
     }>;
 }>;
-export declare const AuthListServiceInstancesSchema: Type.TObject<{
+export declare const AuthServiceInstancesListSchema: Type.TObject<{
     deploymentId: Type.TOptional<Type.TString>;
     disabled: Type.TOptional<Type.TBoolean>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
 }>;
-export declare const AuthListServiceInstancesResponseSchema: Type.TObject<{
-    instances: Type.TArray<Type.TObject<{
+export declare const AuthServiceInstancesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
         instanceId: Type.TString;
         deploymentId: Type.TString;
         instanceKey: Type.TString;
@@ -326,11 +1658,15 @@ export declare const AuthListServiceInstancesResponseSchema: Type.TObject<{
         resourceBindings: any;
         createdAt: Type.TString;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthDisableServiceInstanceSchema: Type.TObject<{
+export declare const AuthServiceInstancesDisableSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthDisableServiceInstanceResponseSchema: Type.TObject<{
+export declare const AuthServiceInstancesDisableResponseSchema: Type.TObject<{
     instance: Type.TObject<{
         instanceId: Type.TString;
         deploymentId: Type.TString;
@@ -343,10 +1679,10 @@ export declare const AuthDisableServiceInstanceResponseSchema: Type.TObject<{
         createdAt: Type.TString;
     }>;
 }>;
-export declare const AuthEnableServiceInstanceSchema: Type.TObject<{
+export declare const AuthServiceInstancesEnableSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthEnableServiceInstanceResponseSchema: Type.TObject<{
+export declare const AuthServiceInstancesEnableResponseSchema: Type.TObject<{
     instance: Type.TObject<{
         instanceId: Type.TString;
         deploymentId: Type.TString;
@@ -359,10 +1695,10 @@ export declare const AuthEnableServiceInstanceResponseSchema: Type.TObject<{
         createdAt: Type.TString;
     }>;
 }>;
-export declare const AuthRemoveServiceInstanceSchema: Type.TObject<{
+export declare const AuthServiceInstancesRemoveSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthRemoveServiceInstanceResponseSchema: Type.TObject<{
+export declare const AuthServiceInstancesRemoveResponseSchema: Type.TObject<{
     success: Type.TBoolean;
 }>;
 export declare const ContractAnalysisSummarySchema: Type.TObject<{
@@ -550,305 +1886,29 @@ export declare const ContractAnalysisSchema: Type.TObject<{
         }>>;
     }>;
 }>;
-export declare const InstalledContractSchema: Type.TObject<{
-    digest: Type.TString;
-    id: Type.TString;
-    displayName: Type.TString;
-    description: Type.TString;
-    installedAt: Type.TString;
-    analysisSummary: Type.TOptional<Type.TObject<{
-        namespaces: Type.TArray<Type.TString>;
-        rpcMethods: Type.TNumber;
-        operations: Type.TNumber;
-        operationControls: Type.TNumber;
-        events: Type.TNumber;
-        natsPublish: Type.TNumber;
-        natsSubscribe: Type.TNumber;
-        kvResources: Type.TNumber;
-        storeResources: Type.TNumber;
-        jobsQueues: Type.TNumber;
-    }>>;
-}>;
-export declare const InstalledContractDetailSchema: Type.TObject<{
-    digest: Type.TString;
-    id: Type.TString;
-    displayName: Type.TString;
-    description: Type.TString;
-    installedAt: Type.TString;
-    analysisSummary: Type.TOptional<Type.TObject<{
-        namespaces: Type.TArray<Type.TString>;
-        rpcMethods: Type.TNumber;
-        operations: Type.TNumber;
-        operationControls: Type.TNumber;
-        events: Type.TNumber;
-        natsPublish: Type.TNumber;
-        natsSubscribe: Type.TNumber;
-        kvResources: Type.TNumber;
-        storeResources: Type.TNumber;
-        jobsQueues: Type.TNumber;
-    }>>;
-    analysis: Type.TOptional<Type.TObject<{
-        namespaces: Type.TArray<Type.TString>;
-        rpc: Type.TObject<{
-            methods: Type.TArray<Type.TObject<{
-                key: Type.TString;
-                subject: Type.TString;
-                wildcardSubject: Type.TString;
-                callerCapabilities: Type.TArray<Type.TString>;
-            }>>;
-        }>;
-        operations: Type.TObject<{
-            operations: Type.TArray<Type.TObject<{
-                key: Type.TString;
-                subject: Type.TString;
-                wildcardSubject: Type.TString;
-                controlSubject: Type.TString;
-                wildcardControlSubject: Type.TString;
-                callCapabilities: Type.TArray<Type.TString>;
-                readCapabilities: Type.TArray<Type.TString>;
-                cancelCapabilities: Type.TArray<Type.TString>;
-                cancel: Type.TBoolean;
-            }>>;
-            control: Type.TArray<Type.TObject<{
-                key: Type.TString;
-                action: Type.TUnion<[Type.TLiteral<"get">, Type.TLiteral<"wait">, Type.TLiteral<"watch">, Type.TLiteral<"cancel">]>;
-                subject: Type.TString;
-                wildcardSubject: Type.TString;
-                requiredCapabilities: Type.TArray<Type.TString>;
-            }>>;
-        }>;
-        events: Type.TObject<{
-            events: Type.TArray<Type.TObject<{
-                key: Type.TString;
-                subject: Type.TString;
-                wildcardSubject: Type.TString;
-                publishCapabilities: Type.TArray<Type.TString>;
-                subscribeCapabilities: Type.TArray<Type.TString>;
-            }>>;
-        }>;
-        subjects: Type.TOptional<Type.TObject<{
-            subjects: Type.TArray<Type.TObject<{
-                key: Type.TString;
-                subject: Type.TString;
-                publishCapabilities: Type.TArray<Type.TString>;
-                subscribeCapabilities: Type.TArray<Type.TString>;
-            }>>;
-        }>>;
-        nats: Type.TObject<{
-            publish: Type.TArray<Type.TObject<{
-                kind: Type.TString;
-                subject: Type.TString;
-                wildcardSubject: Type.TString;
-                requiredCapabilities: Type.TArray<Type.TString>;
-            }>>;
-            subscribe: Type.TArray<Type.TObject<{
-                kind: Type.TString;
-                subject: Type.TString;
-                wildcardSubject: Type.TString;
-                requiredCapabilities: Type.TArray<Type.TString>;
-            }>>;
-        }>;
-        resources: Type.TObject<{
-            kv: Type.TArray<Type.TObject<{
-                alias: Type.TString;
-                purpose: Type.TString;
-                required: Type.TBoolean;
-                history: Type.TNumber;
-                ttlMs: Type.TNumber;
-                maxValueBytes: Type.TOptional<Type.TNumber>;
-            }>>;
-            store: Type.TArray<Type.TObject<{
-                alias: Type.TString;
-                purpose: Type.TString;
-                required: Type.TBoolean;
-                ttlMs: Type.TNumber;
-                maxObjectBytes: Type.TOptional<Type.TNumber>;
-                maxTotalBytes: Type.TOptional<Type.TNumber>;
-            }>>;
-            jobs: Type.TArray<Type.TObject<{
-                queueType: Type.TString;
-                payload: Type.TObject<{
-                    schema: Type.TString;
-                }>;
-                result: Type.TOptional<Type.TObject<{
-                    schema: Type.TString;
-                }>>;
-                maxDeliver: Type.TNumber;
-                backoffMs: Type.TArray<Type.TNumber>;
-                ackWaitMs: Type.TNumber;
-                defaultDeadlineMs: Type.TOptional<Type.TNumber>;
-                progress: Type.TBoolean;
-                logs: Type.TBoolean;
-                dlq: Type.TBoolean;
-                concurrency: Type.TNumber;
-            }>>;
-        }>;
-    }>>;
-    resources: any;
-    contract: Type.TUnsafe<Record<string, unknown>>;
-}>;
-export declare const AuthListInstalledContractsSchema: Type.TObject<{}>;
-export declare const AuthListInstalledContractsResponseSchema: Type.TObject<{
-    contracts: Type.TArray<Type.TObject<{
-        digest: Type.TString;
-        id: Type.TString;
-        displayName: Type.TString;
-        description: Type.TString;
-        installedAt: Type.TString;
-        analysisSummary: Type.TOptional<Type.TObject<{
-            namespaces: Type.TArray<Type.TString>;
-            rpcMethods: Type.TNumber;
-            operations: Type.TNumber;
-            operationControls: Type.TNumber;
-            events: Type.TNumber;
-            natsPublish: Type.TNumber;
-            natsSubscribe: Type.TNumber;
-            kvResources: Type.TNumber;
-            storeResources: Type.TNumber;
-            jobsQueues: Type.TNumber;
-        }>>;
-    }>>;
-}>;
-export declare const AuthGetInstalledContractSchema: Type.TObject<{
-    digest: Type.TString;
-}>;
-export declare const AuthGetInstalledContractResponseSchema: Type.TObject<{
-    contract: Type.TObject<{
-        digest: Type.TString;
-        id: Type.TString;
-        displayName: Type.TString;
-        description: Type.TString;
-        installedAt: Type.TString;
-        analysisSummary: Type.TOptional<Type.TObject<{
-            namespaces: Type.TArray<Type.TString>;
-            rpcMethods: Type.TNumber;
-            operations: Type.TNumber;
-            operationControls: Type.TNumber;
-            events: Type.TNumber;
-            natsPublish: Type.TNumber;
-            natsSubscribe: Type.TNumber;
-            kvResources: Type.TNumber;
-            storeResources: Type.TNumber;
-            jobsQueues: Type.TNumber;
-        }>>;
-        analysis: Type.TOptional<Type.TObject<{
-            namespaces: Type.TArray<Type.TString>;
-            rpc: Type.TObject<{
-                methods: Type.TArray<Type.TObject<{
-                    key: Type.TString;
-                    subject: Type.TString;
-                    wildcardSubject: Type.TString;
-                    callerCapabilities: Type.TArray<Type.TString>;
-                }>>;
-            }>;
-            operations: Type.TObject<{
-                operations: Type.TArray<Type.TObject<{
-                    key: Type.TString;
-                    subject: Type.TString;
-                    wildcardSubject: Type.TString;
-                    controlSubject: Type.TString;
-                    wildcardControlSubject: Type.TString;
-                    callCapabilities: Type.TArray<Type.TString>;
-                    readCapabilities: Type.TArray<Type.TString>;
-                    cancelCapabilities: Type.TArray<Type.TString>;
-                    cancel: Type.TBoolean;
-                }>>;
-                control: Type.TArray<Type.TObject<{
-                    key: Type.TString;
-                    action: Type.TUnion<[Type.TLiteral<"get">, Type.TLiteral<"wait">, Type.TLiteral<"watch">, Type.TLiteral<"cancel">]>;
-                    subject: Type.TString;
-                    wildcardSubject: Type.TString;
-                    requiredCapabilities: Type.TArray<Type.TString>;
-                }>>;
-            }>;
-            events: Type.TObject<{
-                events: Type.TArray<Type.TObject<{
-                    key: Type.TString;
-                    subject: Type.TString;
-                    wildcardSubject: Type.TString;
-                    publishCapabilities: Type.TArray<Type.TString>;
-                    subscribeCapabilities: Type.TArray<Type.TString>;
-                }>>;
-            }>;
-            subjects: Type.TOptional<Type.TObject<{
-                subjects: Type.TArray<Type.TObject<{
-                    key: Type.TString;
-                    subject: Type.TString;
-                    publishCapabilities: Type.TArray<Type.TString>;
-                    subscribeCapabilities: Type.TArray<Type.TString>;
-                }>>;
-            }>>;
-            nats: Type.TObject<{
-                publish: Type.TArray<Type.TObject<{
-                    kind: Type.TString;
-                    subject: Type.TString;
-                    wildcardSubject: Type.TString;
-                    requiredCapabilities: Type.TArray<Type.TString>;
-                }>>;
-                subscribe: Type.TArray<Type.TObject<{
-                    kind: Type.TString;
-                    subject: Type.TString;
-                    wildcardSubject: Type.TString;
-                    requiredCapabilities: Type.TArray<Type.TString>;
-                }>>;
-            }>;
-            resources: Type.TObject<{
-                kv: Type.TArray<Type.TObject<{
-                    alias: Type.TString;
-                    purpose: Type.TString;
-                    required: Type.TBoolean;
-                    history: Type.TNumber;
-                    ttlMs: Type.TNumber;
-                    maxValueBytes: Type.TOptional<Type.TNumber>;
-                }>>;
-                store: Type.TArray<Type.TObject<{
-                    alias: Type.TString;
-                    purpose: Type.TString;
-                    required: Type.TBoolean;
-                    ttlMs: Type.TNumber;
-                    maxObjectBytes: Type.TOptional<Type.TNumber>;
-                    maxTotalBytes: Type.TOptional<Type.TNumber>;
-                }>>;
-                jobs: Type.TArray<Type.TObject<{
-                    queueType: Type.TString;
-                    payload: Type.TObject<{
-                        schema: Type.TString;
-                    }>;
-                    result: Type.TOptional<Type.TObject<{
-                        schema: Type.TString;
-                    }>>;
-                    maxDeliver: Type.TNumber;
-                    backoffMs: Type.TArray<Type.TNumber>;
-                    ackWaitMs: Type.TNumber;
-                    defaultDeadlineMs: Type.TOptional<Type.TNumber>;
-                    progress: Type.TBoolean;
-                    logs: Type.TBoolean;
-                    dlq: Type.TBoolean;
-                    concurrency: Type.TNumber;
-                }>>;
-            }>;
-        }>>;
-        resources: any;
-        contract: Type.TUnsafe<Record<string, unknown>>;
-    }>;
-}>;
 export declare const AuthenticatedUserSchema: Type.TObject<{
-    id: Type.TString;
-    origin: Type.TString;
+    userId: Type.TString;
     active: Type.TBoolean;
     name: Type.TString;
     email: Type.TString;
     image: Type.TOptional<Type.TString>;
     capabilities: Type.TArray<Type.TString>;
+    identity: Type.TObject<{
+        identityId: Type.TString;
+        provider: Type.TString;
+        subject: Type.TString;
+    }>;
     lastLogin: Type.TOptional<Type.TString>;
 }>;
 export type AuthenticatedUser = StaticDecode<typeof AuthenticatedUserSchema>;
-export declare const AuthMeSchema: Type.TObject<{}>;
-export declare const AuthValidateRequestSchema: Type.TObject<{
+export declare const AuthSessionsMeSchema: Type.TObject<{}>;
+export declare const AuthRequestsValidateSchema: Type.TObject<{
     sessionKey: Type.TString;
     proof: Type.TString;
     subject: Type.TString;
     payloadHash: Type.TString;
+    iat: Type.TInteger;
+    requestId: Type.TString;
     capabilities: Type.TOptional<Type.TArray<Type.TString>>;
 }>;
 export declare const AuthenticatedServiceSchema: Type.TObject<{
@@ -869,16 +1929,20 @@ export declare const AuthenticatedDeviceSchema: Type.TObject<{
     capabilities: Type.TArray<Type.TString>;
 }>;
 export type AuthenticatedDevice = StaticDecode<typeof AuthenticatedDeviceSchema>;
-export declare const AuthMeResponseSchema: Type.TObject<{
+export declare const AuthSessionsMeResponseSchema: Type.TObject<{
     participantKind: Type.TUnion<[Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>, Type.TLiteral<"device">, Type.TLiteral<"service">]>;
     user: Type.TUnion<[Type.TObject<{
-        id: Type.TString;
-        origin: Type.TString;
+        userId: Type.TString;
         active: Type.TBoolean;
         name: Type.TString;
         email: Type.TString;
         image: Type.TOptional<Type.TString>;
         capabilities: Type.TArray<Type.TString>;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
         lastLogin: Type.TOptional<Type.TString>;
     }>, Type.TNull]>;
     device: Type.TUnion<[Type.TObject<{
@@ -898,18 +1962,22 @@ export declare const AuthMeResponseSchema: Type.TObject<{
         capabilities: Type.TArray<Type.TString>;
     }>, Type.TNull]>;
 }>;
-export type AuthMeResponse = StaticDecode<typeof AuthMeResponseSchema>;
+export type AuthSessionsMeResponse = StaticDecode<typeof AuthSessionsMeResponseSchema>;
 export declare const CallerViewSchema: Type.TUnion<[Type.TObject<{
     type: Type.TLiteral<"user">;
     participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
-    trellisId: Type.TString;
-    id: Type.TString;
-    origin: Type.TString;
+    userId: Type.TString;
+    identity: Type.TObject<{
+        identityId: Type.TString;
+        provider: Type.TString;
+        subject: Type.TString;
+    }>;
     active: Type.TBoolean;
     name: Type.TString;
     email: Type.TString;
     image: Type.TOptional<Type.TString>;
     capabilities: Type.TArray<Type.TString>;
+    lastAuth: Type.TString;
 }>, Type.TObject<{
     type: Type.TLiteral<"service">;
     id: Type.TString;
@@ -925,20 +1993,24 @@ export declare const CallerViewSchema: Type.TUnion<[Type.TObject<{
     active: Type.TBoolean;
     capabilities: Type.TArray<Type.TString>;
 }>]>;
-export declare const AuthValidateRequestResponseSchema: Type.TObject<{
+export declare const AuthRequestsValidateResponseSchema: Type.TObject<{
     allowed: Type.TBoolean;
     inboxPrefix: Type.TString;
     caller: Type.TUnion<[Type.TObject<{
         type: Type.TLiteral<"user">;
         participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
-        trellisId: Type.TString;
-        id: Type.TString;
-        origin: Type.TString;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
         active: Type.TBoolean;
         name: Type.TString;
         email: Type.TString;
         image: Type.TOptional<Type.TString>;
         capabilities: Type.TArray<Type.TString>;
+        lastAuth: Type.TString;
     }>, Type.TObject<{
         type: Type.TLiteral<"service">;
         id: Type.TString;
@@ -955,36 +2027,83 @@ export declare const AuthValidateRequestResponseSchema: Type.TObject<{
         capabilities: Type.TArray<Type.TString>;
     }>]>;
 }>;
-export declare const AuthListApprovalsSchema: Type.TObject<{
+export declare const AuthIdentitiesListSchema: Type.TObject<{
     user: Type.TOptional<Type.TString>;
-    digest: Type.TOptional<Type.TString>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
 }>;
-export declare const AuthListApprovalsResponseSchema: Type.TObject<{
-    approvals: Type.TArray<Type.TObject<{
+export declare const AuthIdentitiesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
         user: Type.TString;
         answer: Type.TUnion<[Type.TLiteral<"approved">, Type.TLiteral<"denied">]>;
         answeredAt: Type.TString;
         updatedAt: Type.TString;
-        approval: Type.TObject<{
+        identityEnvelopeId: Type.TString;
+        identityAnchor: Type.TUnion<[Type.TObject<{
+            kind: Type.TLiteral<"web">;
+            contractId: Type.TString;
+            origin: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"cli">;
+            contractId: Type.TString;
+            sessionPublicKey: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"native">;
+            contractId: Type.TString;
+            sessionPublicKey: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"device-user">;
+            contractId: Type.TString;
+            devicePublicKey: Type.TString;
+        }>]>;
+        contractEvidence: Type.TObject<{
             contractDigest: Type.TString;
             contractId: Type.TString;
+        }>;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
             displayName: Type.TString;
             description: Type.TString;
-            capabilities: Type.TArray<Type.TString>;
-        }>;
+            consequence: Type.TOptional<Type.TString>;
+        }>>;
         participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthRevokeApprovalSchema: Type.TObject<{
-    contractDigest: Type.TString;
+export declare const AuthIdentityEnvelopesRevokeSchema: Type.TObject<{
+    identityEnvelopeId: Type.TString;
     user: Type.TOptional<Type.TString>;
 }>;
-export declare const AuthRevokeApprovalResponseSchema: Type.TObject<{
+export declare const AuthIdentityEnvelopesRevokeResponseSchema: Type.TObject<{
     success: Type.TBoolean;
 }>;
 export declare const UserGrantViewSchema: Type.TObject<{
-    contractDigest: Type.TString;
-    contractId: Type.TString;
+    identityEnvelopeId: Type.TString;
+    identityAnchor: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"web">;
+        contractId: Type.TString;
+        origin: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"cli">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"native">;
+        contractId: Type.TString;
+        sessionPublicKey: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device-user">;
+        contractId: Type.TString;
+        devicePublicKey: Type.TString;
+    }>]>;
+    contractEvidence: Type.TObject<{
+        contractDigest: Type.TString;
+        contractId: Type.TString;
+    }>;
     displayName: Type.TString;
     description: Type.TString;
     participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
@@ -993,11 +2112,34 @@ export declare const UserGrantViewSchema: Type.TObject<{
     updatedAt: Type.TString;
 }>;
 export type UserGrantView = StaticDecode<typeof UserGrantViewSchema>;
-export declare const AuthListUserGrantsSchema: Type.TObject<{}>;
-export declare const AuthListUserGrantsResponseSchema: Type.TObject<{
-    grants: Type.TArray<Type.TObject<{
-        contractDigest: Type.TString;
-        contractId: Type.TString;
+export declare const AuthIdentitiesGrantsListSchema: Type.TObject<{
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export declare const AuthIdentitiesGrantsListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        identityEnvelopeId: Type.TString;
+        identityAnchor: Type.TUnion<[Type.TObject<{
+            kind: Type.TLiteral<"web">;
+            contractId: Type.TString;
+            origin: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"cli">;
+            contractId: Type.TString;
+            sessionPublicKey: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"native">;
+            contractId: Type.TString;
+            sessionPublicKey: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"device-user">;
+            contractId: Type.TString;
+            devicePublicKey: Type.TString;
+        }>]>;
+        contractEvidence: Type.TObject<{
+            contractDigest: Type.TString;
+            contractId: Type.TString;
+        }>;
         displayName: Type.TString;
         description: Type.TString;
         participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
@@ -1005,48 +2147,212 @@ export declare const AuthListUserGrantsResponseSchema: Type.TObject<{
         grantedAt: Type.TString;
         updatedAt: Type.TString;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthRevokeUserGrantSchema: Type.TObject<{
-    contractDigest: Type.TString;
+export declare const LoginPortalRecordSchema: Type.TObject<{
+    portalId: Type.TString;
+    displayName: Type.TString;
+    entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+    builtIn: Type.TBoolean;
+    disabled: Type.TBoolean;
+    createdAt: Type.TString;
+    updatedAt: Type.TString;
 }>;
-export declare const AuthRevokeUserGrantResponseSchema: Type.TObject<{
-    success: Type.TBoolean;
+export type LoginPortalRecord = StaticDecode<typeof LoginPortalRecordSchema>;
+export declare const LoginPortalSettingsSchema: Type.TObject<{
+    portalId: Type.TString;
+    localRegistrationEnabled: Type.TBoolean;
+    federatedRegistrationEnabled: Type.TBoolean;
+    allowedFederatedProviders: Type.TUnion<[Type.TArray<Type.TString>, Type.TNull]>;
+    selfRegisteredAccountActive: Type.TBoolean;
+    updatedAt: Type.TString;
 }>;
-export declare const PortalSchema: Type.TObject<{
+export type LoginPortalSettings = StaticDecode<typeof LoginPortalSettingsSchema>;
+export declare const LoginPortalFederatedProviderSchema: Type.TObject<{
+    id: Type.TString;
+    displayName: Type.TString;
+    type: Type.TString;
+}>;
+export declare const LoginPortalRouteSchema: Type.TObject<{
+    routeKey: Type.TString;
     portalId: Type.TString;
-    entryUrl: Type.TString;
+    contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+    origin: Type.TUnion<[Type.TString, Type.TNull]>;
     disabled: Type.TBoolean;
+    updatedAt: Type.TString;
 }>;
-export type Portal = StaticDecode<typeof PortalSchema>;
-export declare const PortalProfileSchema: Type.TObject<{
+export type LoginPortalRoute = StaticDecode<typeof LoginPortalRouteSchema>;
+export declare const LoginPortalSummarySchema: Type.TObject<{
+    routeCount: Type.TInteger;
+    activeRouteCount: Type.TInteger;
     portalId: Type.TString;
-    entryUrl: Type.TString;
-    contractId: Type.TString;
-    allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-    impliedCapabilities: Type.TArray<Type.TString>;
+    displayName: Type.TString;
+    entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+    builtIn: Type.TBoolean;
     disabled: Type.TBoolean;
     createdAt: Type.TString;
     updatedAt: Type.TString;
 }>;
-export type PortalProfile = StaticDecode<typeof PortalProfileSchema>;
-export declare const LoginPortalDefaultSchema: Type.TObject<{
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
+export type LoginPortalSummary = StaticDecode<typeof LoginPortalSummarySchema>;
+export declare const AuthPortalsListSchema: Type.TObject<{
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export declare const AuthPortalsListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        routeCount: Type.TInteger;
+        activeRouteCount: Type.TInteger;
+        portalId: Type.TString;
+        displayName: Type.TString;
+        entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+        builtIn: Type.TBoolean;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export declare const AuthPortalsGetSchema: Type.TObject<{
+    portalId: Type.TString;
+}>;
+export declare const AuthPortalsGetResponseSchema: Type.TObject<{
+    portal: Type.TObject<{
+        portalId: Type.TString;
+        displayName: Type.TString;
+        entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+        builtIn: Type.TBoolean;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>;
+    settings: Type.TObject<{
+        portalId: Type.TString;
+        localRegistrationEnabled: Type.TBoolean;
+        federatedRegistrationEnabled: Type.TBoolean;
+        allowedFederatedProviders: Type.TUnion<[Type.TArray<Type.TString>, Type.TNull]>;
+        selfRegisteredAccountActive: Type.TBoolean;
+        updatedAt: Type.TString;
+    }>;
+    routes: Type.TArray<Type.TObject<{
+        routeKey: Type.TString;
+        portalId: Type.TString;
+        contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+        origin: Type.TUnion<[Type.TString, Type.TNull]>;
+        disabled: Type.TBoolean;
+        updatedAt: Type.TString;
+    }>>;
+    defaultCapabilities: Type.TArray<Type.TString>;
+    defaultCapabilityGroups: Type.TArray<Type.TString>;
+    federatedProviders: Type.TArray<Type.TObject<{
+        id: Type.TString;
+        displayName: Type.TString;
+        type: Type.TString;
+    }>>;
+}>;
+export declare const AuthPortalsPutSchema: Type.TObject<{
+    portalId: Type.TString;
+    displayName: Type.TString;
+    entryUrl: Type.TString;
+    disabled: Type.TOptional<Type.TBoolean>;
+}>;
+export declare const AuthPortalsPutResponseSchema: Type.TObject<{
+    portal: Type.TObject<{
+        portalId: Type.TString;
+        displayName: Type.TString;
+        entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+        builtIn: Type.TBoolean;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>;
+}>;
+export declare const AuthPortalsRemoveSchema: Type.TObject<{
+    portalId: Type.TString;
+}>;
+export declare const AuthPortalsRemoveResponseSchema: Type.TObject<{
+    success: Type.TBoolean;
+}>;
+export declare const AuthPortalsLoginSettingsGetSchema: Type.TObject<{
+    portalId: Type.TString;
+}>;
+export declare const AuthPortalsLoginSettingsResponseSchema: Type.TObject<{
+    portal: Type.TObject<{
+        portalId: Type.TString;
+        displayName: Type.TString;
+        entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+        builtIn: Type.TBoolean;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>;
+    settings: Type.TObject<{
+        portalId: Type.TString;
+        localRegistrationEnabled: Type.TBoolean;
+        federatedRegistrationEnabled: Type.TBoolean;
+        allowedFederatedProviders: Type.TUnion<[Type.TArray<Type.TString>, Type.TNull]>;
+        selfRegisteredAccountActive: Type.TBoolean;
+        updatedAt: Type.TString;
+    }>;
+    defaultCapabilities: Type.TArray<Type.TString>;
+    defaultCapabilityGroups: Type.TArray<Type.TString>;
+    federatedProviders: Type.TArray<Type.TObject<{
+        id: Type.TString;
+        displayName: Type.TString;
+        type: Type.TString;
+    }>>;
+}>;
+export declare const AuthPortalsLoginSettingsUpdateSchema: Type.TObject<{
+    portalId: Type.TString;
+    localRegistrationEnabled: Type.TBoolean;
+    federatedRegistrationEnabled: Type.TBoolean;
+    allowedFederatedProviders: Type.TUnion<[Type.TArray<Type.TString>, Type.TNull]>;
+    selfRegisteredAccountActive: Type.TBoolean;
+    defaultCapabilities: Type.TArray<Type.TString>;
+    defaultCapabilityGroups: Type.TArray<Type.TString>;
+}>;
+export declare const AuthPortalsRoutesPutSchema: Type.TObject<{
+    portalId: Type.TString;
+    contractId: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    origin: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    disabled: Type.TOptional<Type.TBoolean>;
+}>;
+export declare const AuthPortalsRoutesPutResponseSchema: Type.TObject<{
+    route: Type.TObject<{
+        routeKey: Type.TString;
+        portalId: Type.TString;
+        contractId: Type.TUnion<[Type.TString, Type.TNull]>;
+        origin: Type.TUnion<[Type.TString, Type.TNull]>;
+        disabled: Type.TBoolean;
+        updatedAt: Type.TString;
+    }>;
 }>;
-export type LoginPortalDefault = StaticDecode<typeof LoginPortalDefaultSchema>;
-export declare const DevicePortalDefaultSchema: Type.TObject<{
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
+export declare const AuthPortalsRoutesRemoveSchema: Type.TObject<{
+    portalId: Type.TString;
+    contractId: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+    origin: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
 }>;
-export type DevicePortalDefault = StaticDecode<typeof DevicePortalDefaultSchema>;
-export declare const LoginPortalSelectionSchema: Type.TObject<{
-    contractId: Type.TString;
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
+export declare const AuthPortalsRoutesRemoveResponseSchema: Type.TObject<{
+    success: Type.TBoolean;
 }>;
-export type LoginPortalSelection = StaticDecode<typeof LoginPortalSelectionSchema>;
-export declare const DevicePortalSelectionSchema: Type.TObject<{
-    deploymentId: Type.TString;
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
+export declare const FlowRegistrationAvailabilitySchema: Type.TObject<{
+    localIdentity: Type.TObject<{
+        available: Type.TBoolean;
+    }>;
+    federatedIdentity: Type.TObject<{
+        available: Type.TBoolean;
+        providers: Type.TArray<Type.TObject<{
+            id: Type.TString;
+            displayName: Type.TString;
+        }>>;
+    }>;
 }>;
-export type DevicePortalSelection = StaticDecode<typeof DevicePortalSelectionSchema>;
+export type FlowRegistrationAvailability = StaticDecode<typeof FlowRegistrationAvailabilitySchema>;
 export declare const PortalFlowStateSchema: Type.TUnion<[Type.TObject<{
     status: Type.TLiteral<"choose_provider">;
     flowId: Type.TString;
@@ -1061,6 +2367,27 @@ export declare const PortalFlowStateSchema: Type.TUnion<[Type.TObject<{
         description: Type.TString;
         context: Type.TOptional<Type.TUnsafe<Record<string, unknown>>>;
     }>;
+    portal: Type.TOptional<Type.TObject<{
+        portalId: Type.TString;
+        displayName: Type.TString;
+        entryUrl: Type.TUnion<[Type.TString, Type.TNull]>;
+        builtIn: Type.TBoolean;
+        disabled: Type.TBoolean;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>>;
+    registration: Type.TOptional<Type.TObject<{
+        localIdentity: Type.TObject<{
+            available: Type.TBoolean;
+        }>;
+        federatedIdentity: Type.TObject<{
+            available: Type.TBoolean;
+            providers: Type.TArray<Type.TObject<{
+                id: Type.TString;
+                displayName: Type.TString;
+            }>>;
+        }>;
+    }>>;
 }>, Type.TObject<{
     status: Type.TLiteral<"approval_required">;
     flowId: Type.TString;
@@ -1076,7 +2403,11 @@ export declare const PortalFlowStateSchema: Type.TUnion<[Type.TObject<{
         contractId: Type.TString;
         displayName: Type.TString;
         description: Type.TString;
-        capabilities: Type.TArray<Type.TString>;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+            consequence: Type.TOptional<Type.TString>;
+        }>>;
     }>;
 }>, Type.TObject<{
     status: Type.TLiteral<"approval_denied">;
@@ -1086,7 +2417,11 @@ export declare const PortalFlowStateSchema: Type.TUnion<[Type.TObject<{
         contractId: Type.TString;
         displayName: Type.TString;
         description: Type.TString;
-        capabilities: Type.TArray<Type.TString>;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+            consequence: Type.TOptional<Type.TString>;
+        }>>;
     }>;
     returnLocation: Type.TOptional<Type.TString>;
 }>, Type.TObject<{
@@ -1102,7 +2437,11 @@ export declare const PortalFlowStateSchema: Type.TUnion<[Type.TObject<{
         contractId: Type.TString;
         displayName: Type.TString;
         description: Type.TString;
-        capabilities: Type.TArray<Type.TString>;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+            consequence: Type.TOptional<Type.TString>;
+        }>>;
     }>;
     missingCapabilities: Type.TArray<Type.TString>;
     userCapabilities: Type.TArray<Type.TString>;
@@ -1136,387 +2475,293 @@ export type PortalFlowApp = PortalFlowChooseProviderState["app"];
 export type PortalFlowProvider = PortalFlowChooseProviderState["providers"][number];
 export type PortalFlowApproval = PortalFlowApprovalRequiredState["approval"];
 export type PortalFlowUser = PortalFlowApprovalRequiredState["user"];
-export declare const DeviceDeploymentSchema: Type.TObject<{
+export declare const DeviceDeploymentSchema: Type.TUnsafe<{
+    deploymentId: string;
+    reviewMode?: "none" | "required";
+    disabled: boolean;
+}>;
+export declare const AuthDeploymentKindSchema: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">]>;
+export type AuthDeploymentKind = StaticDecode<typeof AuthDeploymentKindSchema>;
+export declare const AuthDeploymentSchema: Type.TUnion<[Type.TObject<{
+    kind: Type.TLiteral<"service">;
     deploymentId: Type.TString;
-    reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
+    namespaces: Type.TArray<Type.TString>;
     disabled: Type.TBoolean;
-    appliedContracts: Type.TArray<Type.TObject<{
-        contractId: Type.TString;
-        allowedDigests: Type.TArray<Type.TString>;
-    }>>;
-}>;
-export declare const DeviceMetadataSchema: Type.TRecord<"^.*$", Type.TString>;
-export declare const DeviceSchema: Type.TObject<{
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
-    deploymentId: Type.TString;
-    metadata: Type.TOptional<Type.TRecord<"^.*$", Type.TString>>;
-    state: Type.TUnion<[Type.TLiteral<"registered">, Type.TLiteral<"activated">, Type.TLiteral<"revoked">, Type.TLiteral<"disabled">]>;
-    currentContractId: Type.TOptional<Type.TString>;
-    currentContractDigest: Type.TOptional<Type.TString>;
-    createdAt: Type.TString;
-    activatedAt: Type.TUnion<[Type.TString, Type.TNull]>;
-    revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
-}>;
-export declare const DeviceActivationActorSchema: Type.TObject<{
-    origin: Type.TString;
-    id: Type.TString;
-}>;
-export type DeviceActivationActor = StaticDecode<typeof DeviceActivationActorSchema>;
-export declare const DeviceActivationRecordSchema: Type.TObject<{
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
-    deploymentId: Type.TString;
-    activatedBy: Type.TOptional<Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
-    }>>;
-    state: Type.TUnion<[Type.TLiteral<"activated">, Type.TLiteral<"revoked">]>;
-    activatedAt: Type.TString;
-    revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
-}>;
-export type DeviceActivationRecord = StaticDecode<typeof DeviceActivationRecordSchema>;
-export declare const DeviceActivationReviewSchema: Type.TObject<{
-    reviewId: Type.TString;
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
-    deploymentId: Type.TString;
-    state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
-    requestedAt: Type.TString;
-    decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
-    reason: Type.TOptional<Type.TString>;
-}>;
-export declare const AuthDeviceActivationReviewRequestedEventSchema: Type.TObject<{
-    reviewId: Type.TString;
-    flowId: Type.TString;
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
-    deploymentId: Type.TString;
-    requestedAt: Type.TString;
-    requestedBy: Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
-    }>;
-}>;
-export declare const AuthDeviceActivationRequestedEventSchema: Type.TObject<{
-    flowId: Type.TString;
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
-    deploymentId: Type.TString;
-    requestedAt: Type.TString;
-    requestedBy: Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
-    }>;
-}>;
-export declare const AuthDeviceActivationApprovedEventSchema: Type.TObject<{
-    reviewId: Type.TString;
-    flowId: Type.TString;
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
+}>, Type.TObject<{
+    kind: Type.TLiteral<"device">;
     deploymentId: Type.TString;
-    requestedAt: Type.TString;
-    approvedAt: Type.TString;
-    requestedBy: Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
-    }>;
-    approvedBy: Type.TObject<{
-        id: Type.TString;
-        origin: Type.TOptional<Type.TString>;
-    }>;
-}>;
-export declare const AuthDeviceActivatedEventSchema: Type.TObject<{
-    instanceId: Type.TString;
-    publicIdentityKey: Type.TString;
+    reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
+    disabled: Type.TBoolean;
+}>]>;
+export type AuthDeployment = StaticDecode<typeof AuthDeploymentSchema>;
+export declare const AuthDeploymentsCreateSchema: Type.TUnion<[Type.TObject<{
+    kind: Type.TLiteral<"service">;
     deploymentId: Type.TString;
-    activatedAt: Type.TString;
-    activatedBy: Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
-    }>;
-    flowId: Type.TOptional<Type.TString>;
-    reviewId: Type.TOptional<Type.TString>;
-}>;
-export declare const DeviceConnectInfoSchema: Type.TObject<{
-    instanceId: Type.TString;
+    namespaces: Type.TArray<Type.TString>;
+}>, Type.TObject<{
+    kind: Type.TLiteral<"device">;
     deploymentId: Type.TString;
-    contractId: Type.TString;
-    contractDigest: Type.TString;
-    transports: Type.TObject<{
-        native: Type.TOptional<Type.TObject<{
-            natsServers: Type.TArray<Type.TString>;
-        }>>;
-        websocket: Type.TOptional<Type.TObject<{
-            natsServers: Type.TArray<Type.TString>;
-        }>>;
-    }>;
-    transport: Type.TObject<{
-        sentinel: Type.TObject<{
-            jwt: Type.TString;
-            seed: Type.TString;
-        }>;
-    }>;
-    auth: Type.TObject<{
-        mode: Type.TLiteral<"device_identity">;
-        iatSkewSeconds: Type.TNumber;
-    }>;
-}>;
-export declare const AuthCreatePortalSchema: Type.TObject<{
-    portalId: Type.TString;
-    entryUrl: Type.TString;
-}>;
-export declare const AuthCreatePortalResponseSchema: Type.TObject<{
-    portal: Type.TObject<{
-        portalId: Type.TString;
-        entryUrl: Type.TString;
-        disabled: Type.TBoolean;
-    }>;
-}>;
-export declare const AuthListPortalsSchema: Type.TObject<{}>;
-export declare const AuthListPortalsResponseSchema: Type.TObject<{
-    portals: Type.TArray<Type.TObject<{
-        portalId: Type.TString;
-        entryUrl: Type.TString;
-        disabled: Type.TBoolean;
-    }>>;
-}>;
-export declare const AuthDisablePortalSchema: Type.TObject<{
-    portalId: Type.TString;
-}>;
-export declare const AuthDisablePortalResponseSchema: Type.TObject<{
-    success: Type.TBoolean;
-}>;
-export declare const AuthListPortalProfilesSchema: Type.TObject<{}>;
-export declare const AuthListPortalProfilesResponseSchema: Type.TObject<{
-    profiles: Type.TArray<Type.TObject<{
-        portalId: Type.TString;
-        entryUrl: Type.TString;
-        contractId: Type.TString;
-        allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-        impliedCapabilities: Type.TArray<Type.TString>;
+    reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
+}>]>;
+export declare const AuthDeploymentsCreateResponseSchema: Type.TObject<{
+    deployment: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"service">;
+        deploymentId: Type.TString;
+        namespaces: Type.TArray<Type.TString>;
         disabled: Type.TBoolean;
-        createdAt: Type.TString;
-        updatedAt: Type.TString;
-    }>>;
-}>;
-export declare const AuthSetPortalProfileSchema: Type.TObject<{
-    portalId: Type.TString;
-    entryUrl: Type.TString;
-    contractId: Type.TString;
-    allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-}>;
-export declare const AuthSetPortalProfileResponseSchema: Type.TObject<{
-    profile: Type.TObject<{
-        portalId: Type.TString;
-        entryUrl: Type.TString;
-        contractId: Type.TString;
-        allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-        impliedCapabilities: Type.TArray<Type.TString>;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device">;
+        deploymentId: Type.TString;
+        reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
         disabled: Type.TBoolean;
-        createdAt: Type.TString;
-        updatedAt: Type.TString;
-    }>;
+    }>]>;
 }>;
-export declare const AuthDisablePortalProfileSchema: Type.TObject<{
-    portalId: Type.TString;
+export declare const AuthDeploymentsListSchema: Type.TObject<{
+    kind: Type.TOptional<Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">]>>;
+    disabled: Type.TOptional<Type.TBoolean>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
 }>;
-export declare const AuthDisablePortalProfileResponseSchema: Type.TObject<{
-    profile: Type.TObject<{
-        portalId: Type.TString;
-        entryUrl: Type.TString;
-        contractId: Type.TString;
-        allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
-        impliedCapabilities: Type.TArray<Type.TString>;
+export declare const AuthDeploymentsListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"service">;
+        deploymentId: Type.TString;
+        namespaces: Type.TArray<Type.TString>;
         disabled: Type.TBoolean;
-        createdAt: Type.TString;
-        updatedAt: Type.TString;
-    }>;
-}>;
-export declare const AuthGetLoginPortalDefaultSchema: Type.TObject<{}>;
-export declare const AuthGetLoginPortalDefaultResponseSchema: Type.TObject<{
-    defaultPortal: Type.TObject<{
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>;
-}>;
-export declare const AuthSetLoginPortalDefaultSchema: Type.TObject<{
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-}>;
-export declare const AuthSetLoginPortalDefaultResponseSchema: Type.TObject<{
-    defaultPortal: Type.TObject<{
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>;
-}>;
-export declare const AuthListLoginPortalSelectionsSchema: Type.TObject<{}>;
-export declare const AuthListLoginPortalSelectionsResponseSchema: Type.TObject<{
-    selections: Type.TArray<Type.TObject<{
-        contractId: Type.TString;
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>>;
-}>;
-export declare const AuthSetLoginPortalSelectionSchema: Type.TObject<{
-    contractId: Type.TString;
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-}>;
-export declare const AuthSetLoginPortalSelectionResponseSchema: Type.TObject<{
-    selection: Type.TObject<{
-        contractId: Type.TString;
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>;
-}>;
-export declare const AuthClearLoginPortalSelectionSchema: Type.TObject<{
-    contractId: Type.TString;
-}>;
-export declare const AuthClearLoginPortalSelectionResponseSchema: Type.TObject<{
-    success: Type.TBoolean;
-}>;
-export declare const AuthGetDevicePortalDefaultSchema: Type.TObject<{}>;
-export declare const AuthGetDevicePortalDefaultResponseSchema: Type.TObject<{
-    defaultPortal: Type.TObject<{
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>;
-}>;
-export declare const AuthSetDevicePortalDefaultSchema: Type.TObject<{
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-}>;
-export declare const AuthSetDevicePortalDefaultResponseSchema: Type.TObject<{
-    defaultPortal: Type.TObject<{
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>;
-}>;
-export declare const AuthListDevicePortalSelectionsSchema: Type.TObject<{}>;
-export declare const AuthListDevicePortalSelectionsResponseSchema: Type.TObject<{
-    selections: Type.TArray<Type.TObject<{
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device">;
         deploymentId: Type.TString;
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>>;
-}>;
-export declare const AuthSetDevicePortalSelectionSchema: Type.TObject<{
+        reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
+        disabled: Type.TBoolean;
+    }>]>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export declare const AuthDeploymentsDisableSchema: Type.TObject<{
+    kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">]>;
     deploymentId: Type.TString;
-    portalId: Type.TUnion<[Type.TString, Type.TNull]>;
 }>;
-export declare const AuthSetDevicePortalSelectionResponseSchema: Type.TObject<{
-    selection: Type.TObject<{
+export declare const AuthDeploymentsDisableResponseSchema: Type.TObject<{
+    deployment: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"service">;
         deploymentId: Type.TString;
-        portalId: Type.TUnion<[Type.TString, Type.TNull]>;
-    }>;
-}>;
-export declare const AuthClearDevicePortalSelectionSchema: Type.TObject<{
-    deploymentId: Type.TString;
-}>;
-export declare const AuthClearDevicePortalSelectionResponseSchema: Type.TObject<{
-    success: Type.TBoolean;
-}>;
-export declare const AuthCreateDeviceDeploymentSchema: Type.TObject<{
-    deploymentId: Type.TString;
-    reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
-}>;
-export declare const AuthCreateDeviceDeploymentResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
+        namespaces: Type.TArray<Type.TString>;
+        disabled: Type.TBoolean;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device">;
         deploymentId: Type.TString;
         reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
         disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-        }>>;
-    }>;
+    }>]>;
 }>;
-export declare const AuthListDeviceDeploymentsSchema: Type.TObject<{
-    disabled: Type.TOptional<Type.TBoolean>;
+export declare const AuthCatalogIssuesResolveSchema: Type.TObject<{
+    issueId: Type.TString;
+    action: Type.TUnion<[Type.TLiteral<"keep-current">, Type.TLiteral<"force-replace">]>;
 }>;
-export declare const AuthListDeviceDeploymentsResponseSchema: Type.TObject<{
-    deployments: Type.TArray<Type.TObject<{
+export declare const AuthCatalogIssuesResolveResponseSchema: Type.TObject<{
+    success: Type.TLiteral<true>;
+    issueId: Type.TString;
+    action: Type.TUnion<[Type.TLiteral<"keep-current">, Type.TLiteral<"force-replace">]>;
+    ignoredEvidence: Type.TArray<Type.TObject<{
         deploymentId: Type.TString;
-        reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-        }>>;
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        contract: Type.TUnsafe<Record<string, unknown>>;
+        firstSeenAt: Type.TString;
+        lastSeenAt: Type.TString;
+        ignoredAt: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
+        ignoredBy: Type.TOptional<Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>>;
+        ignoreReason: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
     }>>;
 }>;
-export declare const AuthApplyDeviceDeploymentContractSchema: Type.TObject<{
+export declare const AuthDeploymentsEnableSchema: Type.TObject<{
+    kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">]>;
     deploymentId: Type.TString;
-    contract: Type.TUnsafe<Record<string, unknown>>;
-    expectedDigest: Type.TString;
-    replaceExisting: Type.TOptional<Type.TBoolean>;
 }>;
-export declare const AuthApplyDeviceDeploymentContractResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
+export declare const AuthDeploymentsEnableResponseSchema: Type.TObject<{
+    deployment: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"service">;
+        deploymentId: Type.TString;
+        namespaces: Type.TArray<Type.TString>;
+        disabled: Type.TBoolean;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"device">;
         deploymentId: Type.TString;
         reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
         disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-        }>>;
-    }>;
-    contract: Type.TObject<{
-        digest: Type.TString;
-        id: Type.TString;
-        displayName: Type.TString;
-        description: Type.TString;
-        installedAt: Type.TString;
-    }>;
+    }>]>;
 }>;
-export declare const AuthUnapplyDeviceDeploymentContractSchema: Type.TObject<{
+export declare const AuthDeploymentsRemoveSchema: Type.TObject<{
+    kind: Type.TUnion<[Type.TLiteral<"service">, Type.TLiteral<"device">]>;
     deploymentId: Type.TString;
-    contractId: Type.TString;
-    digests: Type.TOptional<Type.TArray<Type.TString>>;
+    cascade: Type.TOptional<Type.TBoolean>;
+    purgeUnusedContracts: Type.TOptional<Type.TBoolean>;
 }>;
-export declare const AuthUnapplyDeviceDeploymentContractResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
-        deploymentId: Type.TString;
-        reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-        }>>;
+export declare const AuthDeploymentsRemoveResponseSchema: Type.TObject<{
+    success: Type.TBoolean;
+}>;
+export declare const DeviceMetadataSchema: Type.TRecord<"^.*$", Type.TString>;
+export declare const DeviceSchema: Type.TObject<{
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
+    deploymentId: Type.TString;
+    metadata: Type.TOptional<Type.TRecord<"^.*$", Type.TString>>;
+    state: Type.TUnion<[Type.TLiteral<"registered">, Type.TLiteral<"activated">, Type.TLiteral<"revoked">, Type.TLiteral<"disabled">]>;
+    currentContractId: Type.TOptional<Type.TString>;
+    currentContractDigest: Type.TOptional<Type.TString>;
+    createdAt: Type.TString;
+    activatedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+    revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+}>;
+export declare const DeviceActivationActorSchema: Type.TObject<{
+    participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+    userId: Type.TString;
+    identity: Type.TObject<{
+        identityId: Type.TString;
+        provider: Type.TString;
+        subject: Type.TString;
     }>;
 }>;
-export declare const AuthDisableDeviceDeploymentSchema: Type.TObject<{
+export type DeviceActivationActor = StaticDecode<typeof DeviceActivationActorSchema>;
+export declare const DeviceActivationRecordSchema: Type.TObject<{
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
     deploymentId: Type.TString;
+    activatedBy: Type.TOptional<Type.TObject<{
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
+    }>>;
+    state: Type.TUnion<[Type.TLiteral<"activated">, Type.TLiteral<"revoked">]>;
+    activatedAt: Type.TString;
+    revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
 }>;
-export declare const AuthDisableDeviceDeploymentResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
-        deploymentId: Type.TString;
-        reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-        }>>;
+export type DeviceActivationRecord = StaticDecode<typeof DeviceActivationRecordSchema>;
+export declare const DeviceActivationReviewSchema: Type.TObject<{
+    reviewId: Type.TString;
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
+    deploymentId: Type.TString;
+    state: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>;
+    requestedAt: Type.TString;
+    decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
+    reason: Type.TOptional<Type.TString>;
+}>;
+export declare const AuthDeviceUserAuthoritiesReviewRequestedEventSchema: Type.TObject<{
+    reviewId: Type.TString;
+    flowId: Type.TString;
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
+    deploymentId: Type.TString;
+    requestedAt: Type.TString;
+    requestedBy: Type.TObject<{
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
     }>;
 }>;
-export declare const AuthEnableDeviceDeploymentSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesRequestedEventSchema: Type.TObject<{
+    flowId: Type.TString;
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
     deploymentId: Type.TString;
+    requestedAt: Type.TString;
+    requestedBy: Type.TObject<{
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
+    }>;
 }>;
-export declare const AuthEnableDeviceDeploymentResponseSchema: Type.TObject<{
-    deployment: Type.TObject<{
-        deploymentId: Type.TString;
-        reviewMode: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"required">]>>;
-        disabled: Type.TBoolean;
-        appliedContracts: Type.TArray<Type.TObject<{
-            contractId: Type.TString;
-            allowedDigests: Type.TArray<Type.TString>;
-        }>>;
+export declare const AuthDeviceUserAuthoritiesApprovedEventSchema: Type.TObject<{
+    reviewId: Type.TString;
+    flowId: Type.TString;
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
+    deploymentId: Type.TString;
+    requestedAt: Type.TString;
+    approvedAt: Type.TString;
+    requestedBy: Type.TObject<{
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
+    }>;
+    approvedBy: Type.TObject<{
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
     }>;
 }>;
-export declare const AuthRemoveDeviceDeploymentSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesResolvedEventSchema: Type.TObject<{
+    instanceId: Type.TString;
+    publicIdentityKey: Type.TString;
     deploymentId: Type.TString;
+    resolvedAt: Type.TString;
+    resolvedBy: Type.TObject<{
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        userId: Type.TString;
+        identity: Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+        }>;
+    }>;
+    flowId: Type.TOptional<Type.TString>;
+    reviewId: Type.TOptional<Type.TString>;
 }>;
-export declare const AuthRemoveDeviceDeploymentResponseSchema: Type.TObject<{
-    success: Type.TBoolean;
+export declare const DeviceConnectInfoSchema: Type.TObject<{
+    instanceId: Type.TString;
+    deploymentId: Type.TString;
+    contractId: Type.TString;
+    contractDigest: Type.TString;
+    transports: Type.TObject<{
+        native: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+        websocket: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+    }>;
+    transport: Type.TObject<{
+        sentinel: Type.TObject<{
+            jwt: Type.TString;
+            seed: Type.TString;
+        }>;
+    }>;
+    auth: Type.TObject<{
+        mode: Type.TLiteral<"device_identity">;
+        authority: Type.TUnion<[Type.TLiteral<"admin_reviewed">, Type.TLiteral<"user_delegated">]>;
+        iatSkewSeconds: Type.TNumber;
+    }>;
 }>;
-export declare const AuthProvisionDeviceInstanceSchema: Type.TObject<{
+export declare const AuthDevicesProvisionSchema: Type.TObject<{
     deploymentId: Type.TString;
     publicIdentityKey: Type.TString;
     activationKey: Type.TString;
     metadata: Type.TOptional<Type.TRecord<"^.*$", Type.TString>>;
 }>;
-export declare const AuthProvisionDeviceInstanceResponseSchema: Type.TObject<{
+export declare const AuthDevicesProvisionResponseSchema: Type.TObject<{
     instance: Type.TObject<{
         instanceId: Type.TString;
         publicIdentityKey: Type.TString;
@@ -1530,12 +2775,14 @@ export declare const AuthProvisionDeviceInstanceResponseSchema: Type.TObject<{
         revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
     }>;
 }>;
-export declare const AuthListDeviceInstancesSchema: Type.TObject<{
+export declare const AuthDevicesListSchema: Type.TObject<{
     deploymentId: Type.TOptional<Type.TString>;
     state: Type.TOptional<Type.TUnion<[Type.TLiteral<"registered">, Type.TLiteral<"activated">, Type.TLiteral<"revoked">, Type.TLiteral<"disabled">]>>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
 }>;
-export declare const AuthListDeviceInstancesResponseSchema: Type.TObject<{
-    instances: Type.TArray<Type.TObject<{
+export declare const AuthDevicesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
         instanceId: Type.TString;
         publicIdentityKey: Type.TString;
         deploymentId: Type.TString;
@@ -1547,11 +2794,15 @@ export declare const AuthListDeviceInstancesResponseSchema: Type.TObject<{
         activatedAt: Type.TUnion<[Type.TString, Type.TNull]>;
         revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthDisableDeviceInstanceSchema: Type.TObject<{
+export declare const AuthDevicesDisableSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthDisableDeviceInstanceResponseSchema: Type.TObject<{
+export declare const AuthDevicesDisableResponseSchema: Type.TObject<{
     instance: Type.TObject<{
         instanceId: Type.TString;
         publicIdentityKey: Type.TString;
@@ -1565,10 +2816,10 @@ export declare const AuthDisableDeviceInstanceResponseSchema: Type.TObject<{
         revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
     }>;
 }>;
-export declare const AuthEnableDeviceInstanceSchema: Type.TObject<{
+export declare const AuthDevicesEnableSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthEnableDeviceInstanceResponseSchema: Type.TObject<{
+export declare const AuthDevicesEnableResponseSchema: Type.TObject<{
     instance: Type.TObject<{
         instanceId: Type.TString;
         publicIdentityKey: Type.TString;
@@ -1582,23 +2833,23 @@ export declare const AuthEnableDeviceInstanceResponseSchema: Type.TObject<{
         revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
     }>;
 }>;
-export declare const AuthRemoveDeviceInstanceSchema: Type.TObject<{
+export declare const AuthDevicesRemoveSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthRemoveDeviceInstanceResponseSchema: Type.TObject<{
+export declare const AuthDevicesRemoveResponseSchema: Type.TObject<{
     success: Type.TBoolean;
 }>;
-export declare const AuthActivateDeviceSchema: Type.TObject<{
+export declare const AuthResolveDeviceUserAuthoritiesSchema: Type.TObject<{
     flowId: Type.TString;
 }>;
-export declare const AuthActivateDeviceProgressSchema: Type.TObject<{
+export declare const AuthResolveDeviceUserAuthoritiesProgressSchema: Type.TObject<{
     status: Type.TLiteral<"pending_review">;
     reviewId: Type.TString;
     instanceId: Type.TString;
     deploymentId: Type.TString;
     requestedAt: Type.TString;
 }>;
-export declare const AuthActivateDeviceResponseSchema: Type.TUnion<[Type.TObject<{
+export declare const AuthResolveDeviceUserAuthoritiesResponseSchema: Type.TUnion<[Type.TObject<{
     status: Type.TLiteral<"activated">;
     instanceId: Type.TString;
     deploymentId: Type.TString;
@@ -1635,6 +2886,7 @@ export declare const WaitForDeviceActivationResponseSchema: Type.TUnion<[Type.TO
         }>;
         auth: Type.TObject<{
             mode: Type.TLiteral<"device_identity">;
+            authority: Type.TUnion<[Type.TLiteral<"admin_reviewed">, Type.TLiteral<"user_delegated">]>;
             iatSkewSeconds: Type.TNumber;
         }>;
     }>;
@@ -1642,13 +2894,21 @@ export declare const WaitForDeviceActivationResponseSchema: Type.TUnion<[Type.TO
     status: Type.TLiteral<"rejected">;
     reason: Type.TOptional<Type.TString>;
 }>]>;
-export declare const AuthGetDeviceConnectInfoSchema: Type.TObject<{
+export declare const WaitForDeviceActivationRequestSchema: Type.TObject<{
+    flowId: Type.TString;
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    contractDigest: Type.TString;
+    iat: Type.TNumber;
+    sig: Type.TString;
+}>;
+export declare const AuthDevicesConnectInfoGetSchema: Type.TObject<{
     publicIdentityKey: Type.TString;
     contractDigest: Type.TString;
     iat: Type.TNumber;
     sig: Type.TString;
 }>;
-export declare const AuthGetDeviceConnectInfoResponseSchema: Type.TObject<{
+export declare const AuthDevicesConnectInfoGetResponseSchema: Type.TObject<{
     status: Type.TLiteral<"ready">;
     connectInfo: Type.TObject<{
         instanceId: Type.TString;
@@ -1671,42 +2931,56 @@ export declare const AuthGetDeviceConnectInfoResponseSchema: Type.TObject<{
         }>;
         auth: Type.TObject<{
             mode: Type.TLiteral<"device_identity">;
+            authority: Type.TUnion<[Type.TLiteral<"admin_reviewed">, Type.TLiteral<"user_delegated">]>;
             iatSkewSeconds: Type.TNumber;
         }>;
     }>;
 }>;
-export declare const AuthListDeviceActivationsSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesListSchema: Type.TObject<{
     instanceId: Type.TOptional<Type.TString>;
     deploymentId: Type.TOptional<Type.TString>;
     state: Type.TOptional<Type.TUnion<[Type.TLiteral<"activated">, Type.TLiteral<"revoked">]>>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
 }>;
-export declare const AuthListDeviceActivationsResponseSchema: Type.TObject<{
-    activations: Type.TArray<Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
         instanceId: Type.TString;
         publicIdentityKey: Type.TString;
         deploymentId: Type.TString;
         activatedBy: Type.TOptional<Type.TObject<{
-            origin: Type.TString;
-            id: Type.TString;
+            participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+            userId: Type.TString;
+            identity: Type.TObject<{
+                identityId: Type.TString;
+                provider: Type.TString;
+                subject: Type.TString;
+            }>;
         }>>;
         state: Type.TUnion<[Type.TLiteral<"activated">, Type.TLiteral<"revoked">]>;
         activatedAt: Type.TString;
         revokedAt: Type.TUnion<[Type.TString, Type.TNull]>;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthRevokeDeviceActivationSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesRevokeSchema: Type.TObject<{
     instanceId: Type.TString;
 }>;
-export declare const AuthRevokeDeviceActivationResponseSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesRevokeResponseSchema: Type.TObject<{
     success: Type.TBoolean;
 }>;
-export declare const AuthListDeviceActivationReviewsSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesReviewsListSchema: Type.TObject<{
     instanceId: Type.TOptional<Type.TString>;
     deploymentId: Type.TOptional<Type.TString>;
     state: Type.TOptional<Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"approved">, Type.TLiteral<"rejected">]>>;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
 }>;
-export declare const AuthListDeviceActivationReviewsResponseSchema: Type.TObject<{
-    reviews: Type.TArray<Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesReviewsListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
         reviewId: Type.TString;
         instanceId: Type.TString;
         publicIdentityKey: Type.TString;
@@ -1716,13 +2990,17 @@ export declare const AuthListDeviceActivationReviewsResponseSchema: Type.TObject
         decidedAt: Type.TUnion<[Type.TString, Type.TNull]>;
         reason: Type.TOptional<Type.TString>;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthDecideDeviceActivationReviewSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesReviewsDecideSchema: Type.TObject<{
     reviewId: Type.TString;
     decision: Type.TUnion<[Type.TLiteral<"approve">, Type.TLiteral<"reject">]>;
     reason: Type.TOptional<Type.TString>;
 }>;
-export declare const AuthDecideDeviceActivationReviewResponseSchema: Type.TObject<{
+export declare const AuthDeviceUserAuthoritiesReviewsDecideResponseSchema: Type.TObject<{
     review: Type.TObject<{
         reviewId: Type.TString;
         instanceId: Type.TString;
@@ -1738,8 +3016,13 @@ export declare const AuthDecideDeviceActivationReviewResponseSchema: Type.TObjec
         publicIdentityKey: Type.TString;
         deploymentId: Type.TString;
         activatedBy: Type.TOptional<Type.TObject<{
-            origin: Type.TString;
-            id: Type.TString;
+            participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+            userId: Type.TString;
+            identity: Type.TObject<{
+                identityId: Type.TString;
+                provider: Type.TString;
+                subject: Type.TString;
+            }>;
         }>>;
         state: Type.TUnion<[Type.TLiteral<"activated">, Type.TLiteral<"revoked">]>;
         activatedAt: Type.TString;
@@ -1747,32 +3030,265 @@ export declare const AuthDecideDeviceActivationReviewResponseSchema: Type.TObjec
     }>>;
     confirmationCode: Type.TOptional<Type.TString>;
 }>;
+export declare const UserIdentityViewSchema: Type.TObject<{
+    identityId: Type.TString;
+    provider: Type.TString;
+    subject: Type.TString;
+    displayName: Type.TUnion<[Type.TString, Type.TNull]>;
+    email: Type.TUnion<[Type.TString, Type.TNull]>;
+    emailVerified: Type.TBoolean;
+    linkedAt: Type.TString;
+    lastLoginAt: Type.TUnion<[Type.TString, Type.TNull]>;
+}>;
 export declare const UserViewSchema: Type.TObject<{
-    origin: Type.TString;
-    id: Type.TString;
+    userId: Type.TString;
     name: Type.TOptional<Type.TString>;
     email: Type.TOptional<Type.TString>;
     active: Type.TBoolean;
     capabilities: Type.TArray<Type.TString>;
+    capabilityGroups: Type.TArray<Type.TString>;
+    identities: Type.TArray<Type.TObject<{
+        identityId: Type.TString;
+        provider: Type.TString;
+        subject: Type.TString;
+        displayName: Type.TUnion<[Type.TString, Type.TNull]>;
+        email: Type.TUnion<[Type.TString, Type.TNull]>;
+        emailVerified: Type.TBoolean;
+        linkedAt: Type.TString;
+        lastLoginAt: Type.TUnion<[Type.TString, Type.TNull]>;
+    }>>;
 }>;
-export declare const AuthListUsersSchema: Type.TObject<{}>;
-export declare const AuthListUsersResponseSchema: Type.TObject<{
-    users: Type.TArray<Type.TObject<{
-        origin: Type.TString;
-        id: Type.TString;
+export declare const AuthUsersListSchema: Type.TObject<{
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export declare const AuthUsersListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        userId: Type.TString;
         name: Type.TOptional<Type.TString>;
         email: Type.TOptional<Type.TString>;
         active: Type.TBoolean;
         capabilities: Type.TArray<Type.TString>;
+        capabilityGroups: Type.TArray<Type.TString>;
+        identities: Type.TArray<Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+            displayName: Type.TUnion<[Type.TString, Type.TNull]>;
+            email: Type.TUnion<[Type.TString, Type.TNull]>;
+            emailVerified: Type.TBoolean;
+            linkedAt: Type.TString;
+            lastLoginAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        }>>;
     }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
 }>;
-export declare const AuthUpdateUserSchema: Type.TObject<{
-    origin: Type.TString;
-    id: Type.TString;
+export declare const AuthUsersGetSchema: Type.TObject<{
+    userId: Type.TString;
+}>;
+export declare const AuthUsersGetResponseSchema: Type.TObject<{
+    user: Type.TObject<{
+        userId: Type.TString;
+        name: Type.TOptional<Type.TString>;
+        email: Type.TOptional<Type.TString>;
+        active: Type.TBoolean;
+        capabilities: Type.TArray<Type.TString>;
+        capabilityGroups: Type.TArray<Type.TString>;
+        identities: Type.TArray<Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+            displayName: Type.TUnion<[Type.TString, Type.TNull]>;
+            email: Type.TUnion<[Type.TString, Type.TNull]>;
+            emailVerified: Type.TBoolean;
+            linkedAt: Type.TString;
+            lastLoginAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        }>>;
+    }>;
+}>;
+export declare const AuthUsersCreateSchema: Type.TObject<{
+    name: Type.TOptional<Type.TString>;
+    email: Type.TOptional<Type.TString>;
+    username: Type.TOptional<Type.TString>;
+    active: Type.TOptional<Type.TBoolean>;
+    capabilities: Type.TOptional<Type.TArray<Type.TString>>;
+    capabilityGroups: Type.TOptional<Type.TArray<Type.TString>>;
+}>;
+export declare const AuthUsersCreateResponseSchema: Type.TObject<{
+    user: Type.TObject<{
+        userId: Type.TString;
+        name: Type.TOptional<Type.TString>;
+        email: Type.TOptional<Type.TString>;
+        active: Type.TBoolean;
+        capabilities: Type.TArray<Type.TString>;
+        capabilityGroups: Type.TArray<Type.TString>;
+        identities: Type.TArray<Type.TObject<{
+            identityId: Type.TString;
+            provider: Type.TString;
+            subject: Type.TString;
+            displayName: Type.TUnion<[Type.TString, Type.TNull]>;
+            email: Type.TUnion<[Type.TString, Type.TNull]>;
+            emailVerified: Type.TBoolean;
+            linkedAt: Type.TString;
+            lastLoginAt: Type.TUnion<[Type.TString, Type.TNull]>;
+        }>>;
+    }>;
+}>;
+export declare const AuthUsersIdentityLinkCreateSchema: Type.TObject<{
+    returnTo: Type.TOptional<Type.TString>;
+}>;
+export declare const AuthUsersPasswordChangeSchema: Type.TObject<{
+    currentPassword: Type.TString;
+    newPassword: Type.TString;
+}>;
+export declare const AuthUsersPasswordChangeResponseSchema: Type.TObject<{
+    success: Type.TBoolean;
+}>;
+export declare const AuthUsersPasswordResetCreateSchema: Type.TObject<{
+    userId: Type.TString;
+    expiresInSeconds: Type.TOptional<Type.TInteger>;
+}>;
+export declare const AuthUsersAccountFlowCreateResponseSchema: Type.TObject<{
+    flowId: Type.TString;
+    url: Type.TString;
+    expiresAt: Type.TString;
+}>;
+export declare const CapabilityDefinitionSchema: Type.TObject<{
+    key: Type.TString;
+    displayName: Type.TString;
+    description: Type.TString;
+    consequence: Type.TOptional<Type.TString>;
+    source: Type.TUnion<[Type.TLiteral<"contract">, Type.TLiteral<"platform">]>;
+    contractId: Type.TOptional<Type.TString>;
+    contractDigest: Type.TOptional<Type.TString>;
+    contractDisplayName: Type.TOptional<Type.TString>;
+}>;
+export declare const AuthCapabilitiesListSchema: Type.TObject<{
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export declare const AuthCapabilitiesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        key: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        consequence: Type.TOptional<Type.TString>;
+        source: Type.TUnion<[Type.TLiteral<"contract">, Type.TLiteral<"platform">]>;
+        contractId: Type.TOptional<Type.TString>;
+        contractDigest: Type.TOptional<Type.TString>;
+        contractDisplayName: Type.TOptional<Type.TString>;
+    }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export declare const CapabilityGroupSchema: Type.TObject<{
+    groupKey: Type.TString;
+    displayName: Type.TString;
+    description: Type.TString;
+    capabilities: Type.TArray<Type.TString>;
+    includedGroups: Type.TArray<Type.TString>;
+    createdAt: Type.TString;
+    updatedAt: Type.TString;
+}>;
+export declare const AuthCapabilityGroupsListSchema: Type.TObject<{
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export declare const AuthCapabilityGroupsListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        groupKey: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TArray<Type.TString>;
+        includedGroups: Type.TArray<Type.TString>;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export declare const AuthCapabilityGroupsGetSchema: Type.TObject<{
+    groupKey: Type.TString;
+}>;
+export declare const AuthCapabilityGroupsGetResponseSchema: Type.TObject<{
+    group: Type.TObject<{
+        groupKey: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TArray<Type.TString>;
+        includedGroups: Type.TArray<Type.TString>;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>;
+}>;
+export declare const AuthCapabilityGroupsPutSchema: Type.TObject<{
+    groupKey: Type.TString;
+    displayName: Type.TString;
+    description: Type.TString;
+    capabilities: Type.TOptional<Type.TArray<Type.TString>>;
+    includedGroups: Type.TOptional<Type.TArray<Type.TString>>;
+}>;
+export declare const AuthCapabilityGroupsPutResponseSchema: Type.TObject<{
+    group: Type.TObject<{
+        groupKey: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TArray<Type.TString>;
+        includedGroups: Type.TArray<Type.TString>;
+        createdAt: Type.TString;
+        updatedAt: Type.TString;
+    }>;
+}>;
+export declare const AuthCapabilityGroupsDeleteSchema: Type.TObject<{
+    groupKey: Type.TString;
+}>;
+export declare const AuthCapabilityGroupsDeleteResponseSchema: Type.TObject<{
+    success: Type.TBoolean;
+}>;
+export declare const AuthUsersUpdateSchema: Type.TObject<{
+    userId: Type.TString;
     active: Type.TOptional<Type.TBoolean>;
     capabilities: Type.TOptional<Type.TArray<Type.TString>>;
+    capabilityGroups: Type.TOptional<Type.TArray<Type.TString>>;
+    name: Type.TOptional<Type.TString>;
+    email: Type.TOptional<Type.TString>;
+}>;
+export declare const AuthUsersUpdateResponseSchema: Type.TObject<{
+    success: Type.TBoolean;
+}>;
+export declare const AuthUserIdentitiesListSchema: Type.TObject<{
+    userId: Type.TString;
+    offset: Type.TOptional<Type.TInteger>;
+    limit: Type.TInteger;
+}>;
+export declare const AuthUserIdentitiesListResponseSchema: Type.TObject<{
+    entries: Type.TArray<Type.TObject<{
+        identityId: Type.TString;
+        provider: Type.TString;
+        subject: Type.TString;
+        displayName: Type.TUnion<[Type.TString, Type.TNull]>;
+        email: Type.TUnion<[Type.TString, Type.TNull]>;
+        emailVerified: Type.TBoolean;
+        linkedAt: Type.TString;
+        lastLoginAt: Type.TUnion<[Type.TString, Type.TNull]>;
+    }>>;
+    count: Type.TInteger;
+    offset: Type.TInteger;
+    limit: Type.TInteger;
+    nextOffset: Type.TOptional<Type.TInteger>;
+}>;
+export declare const AuthUserIdentitiesUnlinkSchema: Type.TObject<{
+    userId: Type.TString;
+    identityId: Type.TString;
 }>;
-export declare const AuthUpdateUserResponseSchema: Type.TObject<{
+export declare const AuthUserIdentitiesUnlinkResponseSchema: Type.TObject<{
     success: Type.TBoolean;
 }>;
 //# sourceMappingURL=protocol.d.ts.map