@tarkahq/sdk 0.0.0-stage → 0.3.0

package/dist/cjs/generated/tarka/provisioning/v1/provisioning.d.ts

@@ -0,0 +1,2644 @@
+import { BinaryReader, BinaryWriter } from "@bufbuild/protobuf/wire";
+import { AgentHostSecretBundle, GetAgentHostSecretsRequest, PrepareAgentHostSecretsRequest, UploadAgentHostSecretsRequest } from "./agent_secrets.js";
+import { AcceptUsagePolicyRequest, AdmissionAssessment, ComputeQuote, CreateComputeQuoteRequest, GetUsagePolicyRequest, UsagePolicy } from "./billing_quote.js";
+import { CancelJobRunRequest, GetJobRequest, GetJobRunRequest, GetJobRunResultRequest, JobResources, JobRetryPolicy, JobRun, JobRunResult, ListJobRunsRequest, ListJobRunsResponse } from "./job.js";
+import { AgentHostRegistryCredential, AgentHostRegistryTest, CancelAgentHostRegistryTestRequest, GetAgentHostRegistryTestRequest, StartAgentHostRegistryTestRequest } from "./registry_credentials.js";
+import { CancelSourceBuildRequest, ConnectGitHubSourceRequest, ConnectHostedGitSourceRequest, DisconnectSourceConnectionRequest, GetSourceBuildLogsRequest, GetSourceBuildLogsResponse, GetSourceBuildRequest, GetSourceCapabilitiesRequest, GetSourceCapabilitiesResponse, GitHubSourceAuthorization, ListGitHubSourceInstallationsRequest, ListGitHubSourceInstallationsResponse, ListGitHubSourceRepositoriesRequest, ListGitHubSourceRepositoriesResponse, ListSourceBuildsRequest, ListSourceBuildsResponse, ListSourceConnectionsRequest, ListSourceConnectionsResponse, ListSourceTargetsRequest, ListSourceTargetsResponse, PrepareSourceDeploymentRequest, PrepareSourceDeploymentResponse, PreviewSourceRequest, PreviewSourceResponse, PutSourceTargetRequest, SourceBuild, SourceConnection, SourceTarget, StartGitHubSourceAuthorizationRequest, StartSourceBuildRequest } from "./source_builds.js";
+export declare const protobufPackage = "tarka.provisioning.v1";
+/**
+ * GetInferenceCaptureRequest identifies the organization, not a bucket supplied
+ * by the caller. Existing organization membership checks apply.
+ */
+export interface GetInferenceCaptureRequest {
+    orgId: string;
+}
+/**
+ * UpdateInferenceCaptureRequest replaces the organization-wide capture setting.
+ * Disabling stops new capture and does not delete existing objects.
+ */
+export interface UpdateInferenceCaptureRequest {
+    orgId: string;
+    enabled: boolean;
+    /** Zero retains objects until deletion; other supported values are 7, 30, 90. */
+    retentionDays: number;
+}
+/**
+ * InferenceCapture describes customer-controlled S3 delivery, independent of
+ * Responses store:true and free Himalaya's Tarka-owned evaluation archive.
+ */
+export interface InferenceCapture {
+    orgId: string;
+    enabled: boolean;
+    retentionDays: number;
+    bucketId: string;
+    bucketName: string;
+    deliveredLast24h: bigint;
+    failedLast24h: bigint;
+    pending: bigint;
+    lastDeliveredAt: Date | undefined;
+    /** A fixed diagnostic code; never includes payload content or storage secrets. */
+    lastErrorCode: string;
+}
+/** GetCurrentUserRequest has no parameters; identity comes from authentication. */
+export interface GetCurrentUserRequest {
+}
+/**
+ * BootstrapCurrentUserRequest customizes the first organization created for an
+ * identity. An empty org_name lets the server derive a display name.
+ */
+export interface BootstrapCurrentUserRequest {
+    /** org_name is the initial organization's human-readable name. */
+    orgName: string;
+}
+/**
+ * CreateOrgRequest creates an additional organization for the authenticated
+ * identity. The caller becomes its owner.
+ */
+export interface CreateOrgRequest {
+    /** name is a non-empty human-readable name of at most 120 characters. */
+    name: string;
+    /**
+     * slug is an optional immutable URL-safe identifier. When empty, the server
+     * allocates one from the name. Explicit slugs must be globally unique.
+     */
+    slug: string;
+}
+/**
+ * RequestProductAccessRequest submits interest in a product that requires an
+ * entitlement decision. The authenticated caller must be an active member of
+ * org_id. contact_email defaults to the authenticated account email.
+ */
+export interface RequestProductAccessRequest {
+    orgId: string;
+    /**
+     * product is one of inference, utilities, agents, jobs, sandboxes, storage,
+     * or git.
+     */
+    product: string;
+    /**
+     * product_detail identifies the requested tier or product variant when one
+     * exists, for example agent_hosts or job_runners.
+     */
+    productDetail: string;
+    contactEmail: string;
+    company: string;
+    useCase: string;
+}
+/** ListProductAccessRequestsRequest selects recent organization requests. */
+export interface ListProductAccessRequestsRequest {
+    orgId: string;
+    /** product optionally filters by the canonical product identifier. */
+    product: string;
+    /** limit defaults to 25 and is capped at 100. */
+    limit: number;
+}
+/** ListProductAccessRequestsResponse contains newest requests first. */
+export interface ListProductAccessRequestsResponse {
+    requests: ProductAccessRequest[];
+}
+/** ProductAccessRequest is the durable status of one product-access request. */
+export interface ProductAccessRequest {
+    id: string;
+    orgId: string;
+    userId: string;
+    product: string;
+    productDetail: string;
+    contactEmail: string;
+    company: string;
+    useCase: string;
+    /** status is draft, submitted, approved, live, or declined. */
+    status: string;
+    createdAt: Date | undefined;
+    updatedAt: Date | undefined;
+}
+/**
+ * EnsureHostedGitAccessRequest has no parameters; identity comes from
+ * authentication.
+ */
+export interface EnsureHostedGitAccessRequest {
+}
+/** HostedGitAccess describes the caller's hosted Git identity. */
+export interface HostedGitAccess {
+    /** status is the reconciliation state of hosted Git access. */
+    status: string;
+    /** forgejo_username is the stable username on Tarka's hosted Git service. */
+    forgejoUsername: string;
+    /** web_url opens the hosted Git user interface. */
+    webUrl: string;
+}
+/**
+ * CurrentUser is the authenticated platform identity and its active
+ * organization memberships.
+ */
+export interface CurrentUser {
+    /** user_id is the stable platform identity identifier. */
+    userId: string;
+    /** email is the identity's current email address, when available. */
+    email: string;
+    /** orgs contains active organizations in membership creation order. */
+    orgs: Org[];
+    /** default_org_id is the first active organization, or empty when none exists. */
+    defaultOrgId: string;
+    /**
+     * entitlements contains the caller's current server-authoritative product
+     * access decisions. API keys never grant access beyond these decisions.
+     */
+    entitlements: ProductEntitlement[];
+}
+/** ProductEntitlement describes one user-level product access decision. */
+export interface ProductEntitlement {
+    /**
+     * product is a canonical identifier such as "himalaya", "inference",
+     * "utilities", "agents", "jobs", "sandboxes", "storage", or "git".
+     */
+    product: string;
+    /**
+     * status is pending, approved, expired, suspended, or revoked. Expired is
+     * an effective status returned when an otherwise-approved grant is past its
+     * optional expires_at timestamp.
+     */
+    status: string;
+    /** approved_at is populated when status is approved. */
+    approvedAt: Date | undefined;
+    /**
+     * expires_at is the optional instant after which this grant stops
+     * authorizing requests. The server enforces it on every request.
+     */
+    expiresAt: Date | undefined;
+}
+/** Org is an organization as visible to the authenticated caller. */
+export interface Org {
+    /** id is the immutable organization identifier. */
+    id: string;
+    /** slug is the immutable URL-safe organization name. */
+    slug: string;
+    /** name is the mutable human-readable organization name. */
+    name: string;
+    /** status is the organization's lifecycle state. */
+    status: string;
+    /** role is the caller's role in this organization. */
+    role: string;
+    /** created_at is the organization creation time. */
+    createdAt: Date | undefined;
+}
+/**
+ * OrgMember describes one identity's access to an organization. Email is
+ * included so organization members can identify collaborators in the console.
+ */
+export interface OrgMember {
+    userId: string;
+    email: string;
+    role: string;
+    status: string;
+    createdAt: Date | undefined;
+}
+/** ListOrgMembersRequest selects one organization visible to the caller. */
+export interface ListOrgMembersRequest {
+    orgId: string;
+}
+/** ListOrgMembersResponse contains memberships in creation order. */
+export interface ListOrgMembersResponse {
+    members: OrgMember[];
+}
+/** ListModelsRequest selects active models by modality. */
+export interface ListModelsRequest {
+    /** modality is an exact modality filter; empty returns every active model. */
+    modality: string;
+}
+/** ListModelsResponse contains the active model catalog. */
+export interface ListModelsResponse {
+    models: Model[];
+}
+/** Model describes a stable Tarka model alias and its metering metadata. */
+export interface Model {
+    /** id is the immutable model-registry identifier. */
+    id: string;
+    /** model_alias is the stable customer-facing identifier used in requests. */
+    modelAlias: string;
+    /** display_name is a human-readable model name. */
+    displayName: string;
+    /** backend identifies the serving implementation. */
+    backend: string;
+    /** modality classifies the model's input/output family. */
+    modality: string;
+    /** status is the catalog lifecycle state. */
+    status: string;
+    /** provider_slug identifies the upstream provider, when applicable. */
+    providerSlug: string;
+    /** upstream_model is the provider's model identifier, when applicable. */
+    upstreamModel: string;
+    /** context_window is the maximum supported token context, when known. */
+    contextWindow: bigint;
+    /**
+     * price_input_microcents_per_million is the input-token price. One
+     * microcent is USD 0.00000001.
+     */
+    priceInputMicrocentsPerMillion: bigint;
+    /**
+     * price_output_microcents_per_million is the output-token price. One
+     * microcent is USD 0.00000001.
+     */
+    priceOutputMicrocentsPerMillion: bigint;
+    /** capabilities contains model-specific, non-secret feature metadata. */
+    capabilities: {
+        [key: string]: any;
+    } | undefined;
+    /**
+     * access_product is the server-authoritative API-key scope and user
+     * entitlement required to use this model: himalaya, inference, or utilities.
+     */
+    accessProduct: string;
+    priceCachedInputMicrocentsPerMillion: bigint;
+    priceAudioMicrocentsPerSecond: bigint;
+    pricePageMicrocents: bigint;
+    pricingVersion: string;
+}
+/** GetPricingCatalogRequest reads the currently published retail prices. */
+export interface GetPricingCatalogRequest {
+}
+/**
+ * PricingCatalog is versioned. All monetary integers are USD microcents,
+ * with explicit denominators for tokens, seconds and compute periods.
+ */
+export interface PricingCatalog {
+    version: string;
+    active: boolean;
+    catalog: {
+        [key: string]: any;
+    } | undefined;
+}
+/** CreateInferenceServiceRequest defines desired state for an inference service. */
+export interface CreateInferenceServiceRequest {
+    orgId: string;
+    /** name must be a DNS label and is unique per organization/resource type. */
+    name: string;
+    /** model_alias must refer to an active entry returned by ListModels. */
+    modelAlias: string;
+    /** min_replicas is the non-negative lower autoscaling bound. */
+    minReplicas: number;
+    /**
+     * max_replicas is the non-negative upper autoscaling bound; zero means the
+     * platform default.
+     */
+    maxReplicas: number;
+    /** spec carries non-secret extension fields. Typed fields take precedence. */
+    spec: {
+        [key: string]: any;
+    } | undefined;
+}
+/**
+ * CreateAgentHostRequest applies desired state for a complete Agent Host
+ * Compose stack. Existing single-image callers remain supported and are
+ * normalized into a one-service stack.
+ */
+export interface CreateAgentHostRequest {
+    orgId: string;
+    /** name must be a DNS label and is unique per organization/resource type. */
+    name: string;
+    /** image is a container image reference; embedded credentials are forbidden. */
+    image: string;
+    /** container_port is the service port; zero selects the platform default. */
+    containerPort: number;
+    minReplicas: number;
+    /** max_replicas is the upper bound; zero selects the platform default. */
+    maxReplicas: number;
+    /** spec carries non-secret extension fields. Typed fields take precedence. */
+    spec: {
+        [key: string]: any;
+    } | undefined;
+    /**
+     * template_id selects a versioned Tarka template such as openclaw, hermes,
+     * or onyx. It is mutually exclusive with compose_yaml and image.
+     */
+    templateId: string;
+    /**
+     * compose_yaml contains an inline Compose Specification document. Runtime
+     * secret values must be supplied through variables and must not be embedded
+     * in this document.
+     */
+    composeYaml: string;
+    /**
+     * variables supplies Compose interpolation values. Secret values are
+     * encrypted separately and never returned in ProvisionedResource.spec.
+     */
+    variables: AgentHostVariable[];
+    /**
+     * public_service optionally overrides the service exposed at the stack's
+     * generated HTTPS hostname. An x-tarka.routes extension can expose multiple
+     * service paths without this override.
+     */
+    publicService: string;
+    /**
+     * public_port is required when public_service is set unless the service has
+     * exactly one declared port.
+     */
+    publicPort: number;
+    /** tier is the platform capacity profile. Empty selects the beta default. */
+    tier: string;
+    /**
+     * runtime configures Tarka-managed model access, runtime-specific gateway
+     * files, and the Compose services that receive the managed environment.
+     * It is optional for backward compatibility.
+     */
+    runtime: AgentHostRuntimeConfiguration | undefined;
+    /**
+     * github_registry_credentials controls private ghcr.io pulls for custom Compose
+     * only. Omission preserves the saved credentials; replacement requires both
+     * username and token. Plaintext tokens are write-only and never echoed.
+     */
+    githubRegistryCredentials: AgentHostGitHubRegistryCredentials | undefined;
+    /**
+     * Validate and return spec.billing_quote without creating or changing a host.
+     * The quote uses the organization billing currency; admission reserves credit at apply time.
+     */
+    dryRun: boolean;
+    /** Optional for legacy EU clients; binds the normalized allocation at creation. */
+    acceptedQuoteId: string;
+    /**
+     * US East Agent Hosts: combined forwarded bytes per renewable five-minute
+     * allowance. Omitted uses 1 GiB for a new host and preserves an existing
+     * host's allowance. Zero disables public ingress and outbound networking.
+     * EU hosts must omit this field; their existing network policy is unchanged.
+     */
+    maxNetworkBytes?: bigint | undefined;
+    /**
+     * An uploaded, unexpired bundle bound to this organization, name and revision.
+     * Consumed atomically on apply; dry runs may reuse it without consuming it.
+     */
+    secretsBundleId: string;
+    /**
+     * Applies a successful, unexpired pull test's complete named-credential set.
+     * Bound to organization, host name, current credential versions and images.
+     * Mutually exclusive with github_registry_credentials. Omission preserves
+     * named credentials. Dry runs do not consume the test; apply consumes it once.
+     */
+    registryTestId: string;
+    /**
+     * location selects where the host runs, such as "eu-1" or "us-1" (see
+     * ListLocations). Empty selects the default location for a new host and
+     * keeps the current location for an existing one. A host cannot move:
+     * changing the location of an existing host is rejected.
+     */
+    location: string;
+}
+export interface SetAgentHostRunningRequest {
+    orgId: string;
+    agentHostId: string;
+    running: boolean;
+}
+/**
+ * AgentHostGitHubRegistryCredentials changes this host's ghcr.io credentials.
+ * A classic GitHub PAT needs read:packages and access to every referenced image.
+ */
+export interface AgentHostGitHubRegistryCredentials {
+    /** username is the token owner's GitHub login, not the package organization. */
+    username: string;
+    /** token is a write-only classic PAT. It is encrypted before persistence. */
+    token: string;
+    /**
+     * remove clears saved credentials and is mutually exclusive with username/token.
+     * The resulting Compose images must be accessible anonymously.
+     */
+    remove: boolean;
+}
+/** AgentHostGitHubRegistryAccess contains only non-secret saved credential metadata. */
+export interface AgentHostGitHubRegistryAccess {
+    username: string;
+    configured: boolean;
+}
+/**
+ * AgentHostVariable is one Compose interpolation value. Values marked secret
+ * are accepted once over TLS, encrypted at rest, mounted from Kubernetes
+ * Secrets, and redacted from all read responses.
+ */
+export interface AgentHostVariable {
+    name: string;
+    value: string;
+    secret: boolean;
+    /**
+     * preserve_existing reuses the encrypted value from the active revision.
+     * It is valid only for secret variables during an update and is returned by
+     * GetAgentHostConfiguration when an encrypted value already exists.
+     */
+    preserveExisting: boolean;
+}
+/**
+ * AgentHostRuntimeConfiguration describes Tarka-managed configuration layered
+ * onto a Compose stack without exposing the host-bound platform credential.
+ */
+export interface AgentHostRuntimeConfiguration {
+    /**
+     * primary_model_alias is an active chat model selected from ListModels.
+     * When empty, a new host starts on its template's default model, or the
+     * platform default for a stack without a template. An update keeps the
+     * model saved in the host's latest revision, and fails if that model is no
+     * longer available. It is mutually exclusive with model_endpoint: naming a
+     * Tarka model moves a host off its own endpoint and discards the stored key.
+     */
+    primaryModelAlias: string;
+    /** gateways contains the messaging integrations enabled for this revision. */
+    gateways: AgentHostGatewayConfiguration[];
+    /**
+     * platform_services names Compose services that receive managed runtime
+     * configuration and non-secret TARKA_* discovery environment variables.
+     */
+    platformServices: string[];
+    /**
+     * model_endpoint runs the host's chat model on an OpenAI-compatible
+     * endpoint with a key the customer brings, instead of a Tarka model. The
+     * host's platform gateway at http://tarka/v1 forwards requests for
+     * model_endpoint.model to that endpoint with that key; utility models
+     * (speech, OCR, embeddings, rerank) stay on Tarka. The provider bills the
+     * model's usage; Tarka bills the host. Mutually exclusive with
+     * primary_model_alias. When both are omitted, an update keeps the host's
+     * current choice, including its stored key; an empty model_endpoint message
+     * counts as omitted. The variable name TARKA_MODEL_API_KEY is reserved for
+     * the key: no stack variable may use it and no Compose file may mention it.
+     */
+    modelEndpoint: AgentHostModelEndpoint | undefined;
+}
+/**
+ * AgentHostModelEndpoint is a customer-supplied, OpenAI-compatible chat model
+ * endpoint. The key is write-only: it is encrypted at rest, mounted only into
+ * the host's platform gateway (never into the stack's own containers), and
+ * never returned. GetAgentHostConfiguration returns base_url and model with
+ * api_key empty and preserve_existing_api_key true while a key is stored.
+ */
+export interface AgentHostModelEndpoint {
+    /**
+     * base_url is the provider's OpenAI-compatible API base, such as
+     * https://openrouter.ai/api/v1. The gateway appends the part of the request
+     * path after /v1, so /v1/chat/completions is sent to
+     * https://openrouter.ai/api/v1/chat/completions. It must use HTTPS on port
+     * 443 and a public DNS name, not an IP address, and carry no credentials,
+     * query or fragment. It is stored normalized: lower-case host, no default
+     * port and no trailing slash.
+     */
+    baseUrl: string;
+    /**
+     * model is the provider's model ID, sent unchanged, such as
+     * "anthropic/claude-sonnet-5.5" on OpenRouter. Workloads in the host select
+     * it by this ID; the host's managed runtimes are configured with it.
+     * Surrounding whitespace is removed. It must not equal one of the host's
+     * Tarka utility model aliases, since the gateway routes by model ID.
+     */
+    model: string;
+    /**
+     * api_key is the provider key, sent as a Bearer token. Write-only.
+     * Surrounding whitespace is removed. A secret bundle (secrets_bundle_id) may
+     * supply it instead, under the name TARKA_MODEL_API_KEY, when this field is
+     * empty and preserve_existing_api_key is false; the request must then name
+     * base_url and model.
+     */
+    apiKey: string;
+    /**
+     * preserve_existing_api_key keeps the key stored on the host's latest
+     * revision. It is valid only on an update of a host that has one, and only
+     * while base_url keeps the host name the key was given for: a stored key is
+     * never sent to another host. It is mutually exclusive with api_key.
+     */
+    preserveExistingApiKey: boolean;
+}
+/**
+ * AgentHostGatewayConfiguration contains one runtime-specific messaging
+ * integration. config_yaml contains non-secret advanced settings. Credentials
+ * are supplied separately through variables and encrypted at rest.
+ */
+export interface AgentHostGatewayConfiguration {
+    gatewayId: string;
+    configYaml: string;
+    variables: AgentHostVariable[];
+}
+/**
+ * ListAgentHostTemplatesRequest has no parameters. Template visibility is
+ * controlled by the caller's platform and Agent Hosts entitlements.
+ */
+export interface ListAgentHostTemplatesRequest {
+}
+/** ListAgentHostTemplatesResponse contains stable template metadata. */
+export interface ListAgentHostTemplatesResponse {
+    templates: AgentHostTemplate[];
+}
+/** AgentHostTemplate describes a versioned, platform-tested Compose stack. */
+export interface AgentHostTemplate {
+    id: string;
+    title: string;
+    description: string;
+    version: string;
+    serviceCount: number;
+    variables: AgentHostTemplateVariable[];
+    /** tier is the default capacity profile for this template. */
+    tier: string;
+    /**
+     * runtime_profile contains platform-owned defaults for model routing,
+     * context management, utilities, and managed Compose services.
+     */
+    runtimeProfile: AgentHostRuntimeProfile | undefined;
+    /** gateways lists integrations understood by this template's runtime adapter. */
+    gateways: AgentHostGatewayDefinition[];
+}
+/**
+ * AgentHostTemplateVariable documents one configurable template value without
+ * exposing a runtime secret.
+ */
+export interface AgentHostTemplateVariable {
+    name: string;
+    label: string;
+    description: string;
+    secret: boolean;
+    required: boolean;
+    defaultValue: string;
+}
+/**
+ * AgentHostRuntimeProfile advertises immutable managed defaults for a template.
+ * context and compaction values are enforced by the runtime adapter rather than
+ * accepted from untrusted Compose or browser input.
+ */
+export interface AgentHostRuntimeProfile {
+    managedModel: boolean;
+    defaultModelAlias: string;
+    contextTokenLimit: bigint;
+    compactionThresholdTokens: bigint;
+    utilityModalities: string[];
+    platformServices: string[];
+}
+/**
+ * AgentHostGatewayDefinition describes one gateway option rendered by the
+ * Console. setup_mode is predeploy or postdeploy_pairing.
+ */
+export interface AgentHostGatewayDefinition {
+    id: string;
+    title: string;
+    description: string;
+    setupMode: string;
+    defaultConfigYaml: string;
+    variables: AgentHostTemplateVariable[];
+}
+/** GetAgentHostConfigurationRequest selects one editable Agent Host revision. */
+export interface GetAgentHostConfigurationRequest {
+    orgId: string;
+    agentHostId: string;
+}
+/**
+ * AgentHostConfiguration is a redacted editable snapshot of the active
+ * revision. Secret variables have empty values and preserve_existing=true.
+ */
+export interface AgentHostConfiguration {
+    agentHostId: string;
+    revision: number;
+    name: string;
+    templateId: string;
+    templateVersion: string;
+    composeYaml: string;
+    variables: AgentHostVariable[];
+    publicService: string;
+    publicPort: number;
+    tier: string;
+    runtime: AgentHostRuntimeConfiguration | undefined;
+    /** github_registry_access never contains the saved token. */
+    githubRegistryAccess: AgentHostGitHubRegistryAccess | undefined;
+    registryCredentials: AgentHostRegistryCredential[];
+}
+/** GetAgentHostGatewayPairingRequest selects a configured post-deploy gateway. */
+export interface GetAgentHostGatewayPairingRequest {
+    orgId: string;
+    agentHostId: string;
+    gatewayId: string;
+}
+/**
+ * AgentHostGatewayPairing contains a short-lived artifact generated by the
+ * private gateway runtime. data is base64-encoded by the REST gateway.
+ */
+export interface AgentHostGatewayPairing {
+    gatewayId: string;
+    contentType: string;
+    data: Buffer;
+    instructions: string;
+}
+/** DeleteAgentHostRequest selects an Agent Host visible to the caller. */
+export interface DeleteAgentHostRequest {
+    orgId: string;
+    agentHostId: string;
+}
+/** CreateJobRequest defines desired state for a finite-duration container job. */
+export interface CreateJobRequest {
+    orgId: string;
+    /** name must be a DNS label and is unique per organization/resource type. */
+    name: string;
+    /** image is a container image reference; embedded credentials are forbidden. */
+    image: string;
+    /** command is the argv executed in the container without shell expansion. */
+    command: string[];
+    /** timeout_seconds is the execution limit; zero selects the platform default. */
+    timeoutSeconds: number;
+    /** spec carries non-secret extension fields. Typed fields take precedence. */
+    spec: {
+        [key: string]: any;
+    } | undefined;
+    /**
+     * location is a hard constraint. Omission selects eu-1. US East requires explicit
+     * us-1 and accepted_quote_id; there is no automatic US East fallback. The selected
+     * location is immutable and returned on the resource and run.
+     */
+    location: string;
+    /** resources has platform defaults when omitted; zero fields select defaults. */
+    resources: JobResources | undefined;
+    /** retry_policy defaults to one On-Demand attempt with no automatic retries. */
+    retryPolicy: JobRetryPolicy | undefined;
+    /**
+     * idempotency_key safely retries creation for 24 hours. Reusing a key with
+     * changed content is rejected. A new key creates a new immutable revision
+     * only after the previous run is terminal.
+     */
+    idempotencyKey: string;
+    /**
+     * queue_timeout_seconds bounds capacity wait, independently of execution.
+     * Zero selects 600 seconds; explicit values must be between 30 and 3600.
+     */
+    queueTimeoutSeconds: number;
+    /** Required for us-1; must match the request and be unexpired. */
+    acceptedQuoteId: string;
+    /** Omission defaults to 1 GiB for US East; zero disables networking. */
+    maxNetworkBytes?: bigint | undefined;
+}
+/**
+ * ProvisionedResource is the recorded desired and observed state for a managed
+ * resource.
+ */
+export interface ProvisionedResource {
+    id: string;
+    orgId: string;
+    /**
+     * resource_type is a stable machine-readable type such as
+     * "inference_service", "agent", or "job".
+     */
+    resourceType: string;
+    name: string;
+    /** status is the lifecycle state reported by the platform. */
+    status: string;
+    /** namespace is the backing workload namespace, once assigned. */
+    namespace: string;
+    /** external_url is the public workload URL, once assigned. */
+    externalUrl: string;
+    /** spec is the normalized desired state and contains no credentials. */
+    spec: {
+        [key: string]: any;
+    } | undefined;
+    /** status_detail contains non-secret provider/controller status metadata. */
+    statusDetail: {
+        [key: string]: any;
+    } | undefined;
+    createdAt: Date | undefined;
+    updatedAt: Date | undefined;
+    /** location is where the resource runs, such as "eu-1" or "us-1". */
+    location: string;
+    /** latest_run_id is populated for jobs; use GetJobRun for execution state. */
+    latestRunId: string;
+    /** Present on validation previews; this is not a capacity reservation. */
+    admission: AdmissionAssessment | undefined;
+}
+/** CreateApiKeyRequest creates an organization-scoped customer credential. */
+export interface CreateApiKeyRequest {
+    orgId: string;
+    /** label is an optional human-readable purpose for the credential. */
+    label: string;
+    /**
+     * allowed_model_aliases narrows model access. Empty uses the organization
+     * policy rather than overriding it. At most 128 aliases may be submitted;
+     * duplicate entries still count toward that request limit.
+     */
+    allowedModelAliases: string[];
+    /**
+     * scopes grants product capabilities. Model scopes are "himalaya",
+     * "inference", and "utilities"; "sandboxes" grants code-sandbox access.
+     * Empty preserves the historical "inference" default.
+     */
+    scopes: string[];
+}
+/** CreateApiKeyResponse contains metadata plus the one-time plaintext secret. */
+export interface CreateApiKeyResponse {
+    apiKey: ApiKey | undefined;
+    /** plaintext_key is returned only at creation and cannot be recovered later. */
+    plaintextKey: string;
+}
+/** ListApiKeysRequest selects one organization. */
+export interface ListApiKeysRequest {
+    orgId: string;
+}
+/** ListApiKeysResponse contains redacted credential metadata. */
+export interface ListApiKeysResponse {
+    apiKeys: ApiKey[];
+}
+/** RevokeApiKeyRequest permanently revokes one organization credential. */
+export interface RevokeApiKeyRequest {
+    orgId: string;
+    apiKeyId: string;
+    /** revoked_reason is optional operator-visible context and contains no secret. */
+    revokedReason: string;
+}
+/** RevokeApiKeyResponse contains the credential's final metadata. */
+export interface RevokeApiKeyResponse {
+    apiKey: ApiKey | undefined;
+}
+/** ApiKey is redacted metadata for a customer credential. */
+export interface ApiKey {
+    id: string;
+    orgId: string;
+    /** user_id identifies the identity that created the credential. */
+    userId: string;
+    label: string;
+    /** kind distinguishes customer and future managed credential classes. */
+    kind: string;
+    /** key_prefix is safe to display and cannot authenticate a request. */
+    keyPrefix: string;
+    status: string;
+    allowedModelAliases: string[];
+    createdAt: Date | undefined;
+    revokedAt: Date | undefined;
+    revokedReason: string;
+    lastUsedAt: Date | undefined;
+    scopes: string[];
+}
+/** GetOrgRequest selects an organization visible to the caller. */
+export interface GetOrgRequest {
+    orgId: string;
+}
+/** UpdateOrgRequest replaces mutable organization metadata. */
+export interface UpdateOrgRequest {
+    orgId: string;
+    /** name is a non-empty human-readable name of at most 120 characters. */
+    name: string;
+}
+/** GetQuotaPolicyRequest selects an organization visible to the caller. */
+export interface GetQuotaPolicyRequest {
+    orgId: string;
+}
+/** UpdateQuotaPolicyRequest replaces the organization's inference policy. */
+export interface UpdateQuotaPolicyRequest {
+    orgId: string;
+    /** max_concurrent_requests is unlimited when absent. */
+    maxConcurrentRequests?: number | undefined;
+    /**
+     * allowed_model_aliases is required when allow_all_models is false. At most
+     * 128 aliases may be submitted; duplicate entries still count toward that
+     * request limit.
+     */
+    allowedModelAliases: string[];
+    allowAllModels: boolean;
+    /** monthly_request_budget is unlimited when absent. */
+    monthlyRequestBudget?: bigint | undefined;
+    /** monthly_token_budget is unlimited when absent. */
+    monthlyTokenBudget?: bigint | undefined;
+}
+/** QuotaPolicy is the effective inference policy for an organization. */
+export interface QuotaPolicy {
+    orgId: string;
+    /** max_concurrent_requests is unlimited when absent. */
+    maxConcurrentRequests?: number | undefined;
+    allowedModelAliases: string[];
+    allowAllModels: boolean;
+    /** monthly_request_budget is unlimited when absent. */
+    monthlyRequestBudget?: bigint | undefined;
+    /** monthly_token_budget is unlimited when absent. */
+    monthlyTokenBudget?: bigint | undefined;
+    updatedAt: Date | undefined;
+}
+/** GetSpendLimitsRequest selects an organization visible to the caller. */
+export interface GetSpendLimitsRequest {
+    orgId: string;
+}
+/**
+ * UpdateSpendLimitsRequest replaces every spend limit of an organization.
+ * Amounts are microcents of currency: one unit is 0.00000001 of it. A limit
+ * may be zero, which stops all priced usage it applies to, and at most
+ * 1,000,000,000,000,000 (10 million in the currency).
+ */
+export interface UpdateSpendLimitsRequest {
+    orgId: string;
+    /**
+     * currency must equal SpendLimits.currency, the organization's billing
+     * currency, so an amount is never applied in a currency the caller did not
+     * read. A mismatch fails with spend_limit_currency_mismatch.
+     */
+    currency: string;
+    /**
+     * monthly_limit_microcents caps everything the organization is charged in a
+     * UTC calendar month. Absent means no overall limit.
+     */
+    monthlyLimitMicrocents?: bigint | undefined;
+    /**
+     * product_limits caps single products, each also bounded by the overall
+     * limit. A product without an entry draws on the overall limit only. Each
+     * product may appear once and must be metered (ProductSpend.metered).
+     */
+    productLimits: ProductSpendLimit[];
+}
+/** ProductSpendLimit caps one product's charges in a UTC calendar month. */
+export interface ProductSpendLimit {
+    /**
+     * product is a product identifier from the product-access catalog, such as
+     * "inference" or "utilities".
+     */
+    product: string;
+    /**
+     * monthly_limit_microcents is required. A product limit sent without one
+     * fails with spend_limit_amount_required rather than reading as zero.
+     */
+    monthlyLimitMicrocents?: bigint | undefined;
+}
+/**
+ * SpendLimits is an organization's monthly spend limits and what it has been
+ * charged in the current UTC calendar month. Every amount is in microcents of
+ * currency: one unit is 0.00000001 of it.
+ */
+export interface SpendLimits {
+    orgId: string;
+    /**
+     * currency is the organization's billing currency, "usd" or "eur": that of
+     * its live billing account, otherwise "usd".
+     */
+    currency: string;
+    /** monthly_limit_microcents is absent when there is no overall limit. */
+    monthlyLimitMicrocents?: bigint | undefined;
+    /**
+     * spent_microcents is what priced usage has been charged since
+     * period_start, across every product.
+     */
+    spentMicrocents: bigint;
+    /**
+     * products lists every product whose usage is charged or can be, each
+     * with its own limit and spend.
+     */
+    products: ProductSpend[];
+    /** period_start is inclusive. */
+    periodStart: Date | undefined;
+    /** period_end is exclusive. Spend counts from zero again from then. */
+    periodEnd: Date | undefined;
+    /** updated_at is when the limits last changed. Absent if never set. */
+    updatedAt: Date | undefined;
+    /** as_of is when the spend in this message was measured. */
+    asOf: Date | undefined;
+    /**
+     * held_microcents is what priced calls in flight have reserved: the most
+     * each can cost. It counts against the limits, on top of spent_microcents,
+     * until those calls finish and are charged what they really cost.
+     */
+    heldMicrocents: bigint;
+}
+/** ProductSpend is one product's spend limit and what it has been charged. */
+export interface ProductSpend {
+    /** product is a product identifier from the product-access catalog. */
+    product: string;
+    /**
+     * metered is true when the product's usage is charged and its limits are
+     * enforced. A product that is not metered cannot take a limit yet.
+     */
+    metered: boolean;
+    /**
+     * monthly_limit_microcents is absent when the product has no limit of its
+     * own and draws on the overall limit only.
+     */
+    monthlyLimitMicrocents?: bigint | undefined;
+    /**
+     * spent_microcents is what the product has been charged since
+     * period_start.
+     */
+    spentMicrocents: bigint;
+}
+/** ListUsageEventsRequest selects recent metering records. */
+export interface ListUsageEventsRequest {
+    orgId: string;
+    /** limit defaults to 25 and is capped at 100. */
+    limit: number;
+}
+/** ListUsageEventsResponse contains records in newest-first order. */
+export interface ListUsageEventsResponse {
+    usageEvents: UsageEvent[];
+}
+/** UsageEvent is one metered inference request. */
+export interface UsageEvent {
+    id: bigint;
+    /** request_id correlates the event with the originating request. */
+    requestId: string;
+    /** model is the customer-facing Tarka alias. */
+    model: string;
+    providerSlug: string;
+    providerModel: string;
+    promptTokens: bigint;
+    completionTokens: bigint;
+    totalTokens: bigint;
+    statusCode: number;
+    latencyMs: number;
+    requestType: string;
+    /** error_code is empty for a successful request. */
+    errorCode: string;
+    /** cost_microcents uses true microcents: one unit is USD 0.00000001. */
+    costMicrocents: bigint;
+    createdAt: Date | undefined;
+    audioSeconds: number;
+    inputPages: bigint;
+    accessProduct: string;
+    resourceId: string;
+    pricingVersion: string;
+    /** Actual ledger amount, in billed_currency microcents, fixed at admission. */
+    billedCurrency: string;
+    billedMicrocents: bigint;
+    runtimeMs: bigint;
+}
+/** GetUsageSummaryRequest selects an organization visible to the caller. */
+export interface GetUsageSummaryRequest {
+    orgId: string;
+}
+/** UsageSummary aggregates metering over a half-open UTC time interval. */
+export interface UsageSummary {
+    orgId: string;
+    /** period_start is inclusive. */
+    periodStart: Date | undefined;
+    /** period_end is exclusive. */
+    periodEnd: Date | undefined;
+    requestCount: bigint;
+    promptTokens: bigint;
+    completionTokens: bigint;
+    totalTokens: bigint;
+    /** cost_microcents uses true microcents: one unit is USD 0.00000001. */
+    costMicrocents: bigint;
+    errorCount: bigint;
+    averageLatencyMs: bigint;
+}
+/** ListProvisionedResourcesRequest selects organization desired-state records. */
+export interface ListProvisionedResourcesRequest {
+    orgId: string;
+    /** resource_type is an exact filter; empty returns every supported type. */
+    resourceType: string;
+}
+/**
+ * ListProvisionedResourcesResponse contains desired-state resources in
+ * newest-first order.
+ */
+export interface ListProvisionedResourcesResponse {
+    resources: ProvisionedResource[];
+}
+/** GetProvisionedResourceRequest selects one organization resource. */
+export interface GetProvisionedResourceRequest {
+    orgId: string;
+    resourceId: string;
+}
+/**
+ * ListLocationsRequest optionally selects an organization so that preview
+ * locations it may use are included.
+ */
+export interface ListLocationsRequest {
+    orgId: string;
+}
+/** ListLocationsResponse lists placement locations, default first. */
+export interface ListLocationsResponse {
+    locations: Location[];
+}
+/**
+ * Location is a place where Tarka runs customer workloads and stores data.
+ * Identifiers are stable and provider-neutral: a location keeps its id if the
+ * hardware or provider behind it changes.
+ */
+export interface Location {
+    /** id is the stable identifier, such as "eu-1" or "us-1". */
+    id: string;
+    /** display_name is a human-readable name, such as "Europe (Germany)". */
+    displayName: string;
+    /** country_code is the ISO 3166-1 alpha-2 country where workloads run. */
+    countryCode: string;
+    /** is_default is true for the location used when a request omits location. */
+    isDefault: boolean;
+    /**
+     * products lists enabled placement products: "sandboxes", "agent_hosts",
+     * "jobs" and "object_storage". A listed location does not by itself grant
+     * product access or promise immediately available capacity.
+     */
+    products: string[];
+    /**
+     * status is "available", or "preview" when only admitted organizations may
+     * place resources here.
+     */
+    status: string;
+    /**
+     * Product-specific placement policy. Legacy resources may remain operable
+     * even when accepting_new_resources is false. No field grants entitlement.
+     */
+    capabilities: LocationProduct[];
+    /** False means the country has not yet been verified against provider inventory. */
+    countryVerified: boolean;
+}
+export interface LocationProduct {
+    product: string;
+    isDefault: boolean;
+    acceptingNewResources: boolean;
+    existingResourcesSupported: boolean;
+    /** Stable, non-secret explanation when new placement is unavailable. */
+    reason: string;
+}
+/** CreateStorageBucketRequest defines a private S3-compatible bucket. */
+export interface CreateStorageBucketRequest {
+    orgId: string;
+    /**
+     * name is the customer-visible, URL-safe bucket name within the
+     * organization. Tarka maps it to a globally unique physical bucket.
+     */
+    name: string;
+    /**
+     * location selects where the bucket's data is stored, such as "eu-1" or
+     * "us-1" (see ListLocations). Empty selects the default location for a new
+     * bucket and keeps the current location for an existing one. A bucket
+     * cannot move: a different location for an existing name is rejected.
+     */
+    location: string;
+}
+/** ListStorageBucketsRequest selects one organization. */
+export interface ListStorageBucketsRequest {
+    orgId: string;
+}
+/** ListStorageBucketsResponse contains object-storage bucket metadata. */
+export interface ListStorageBucketsResponse {
+    buckets: StorageBucket[];
+}
+/**
+ * DeleteStorageBucketRequest selects one organization bucket. The bucket must
+ * be empty before it can be deleted.
+ */
+export interface DeleteStorageBucketRequest {
+    orgId: string;
+    bucketId: string;
+}
+/** StorageBucket describes a private Tarka-managed S3-compatible bucket. */
+export interface StorageBucket {
+    id: string;
+    orgId: string;
+    /** name is the customer-visible name, unique within the organization. */
+    name: string;
+    /** status is the bucket lifecycle/reconciliation state. */
+    status: string;
+    /** endpoint is the public S3-compatible API endpoint. */
+    endpoint: string;
+    /**
+     * region is the S3 signing region to configure in S3 clients. It is not
+     * the Tarka location; see location.
+     */
+    region: string;
+    versioningEnabled: boolean;
+    createdAt: Date | undefined;
+    updatedAt: Date | undefined;
+    /**
+     * s3_bucket_name is the globally unique bucket identifier to send to S3
+     * data-plane clients. name remains the organization-local display name.
+     */
+    s3BucketName: string;
+    /**
+     * location is the Tarka location that stores the bucket, such as "eu-1"
+     * or "us-1".
+     */
+    location: string;
+}
+/** CreateStorageCredentialRequest creates one access key scoped to a bucket. */
+export interface CreateStorageCredentialRequest {
+    orgId: string;
+    bucketId: string;
+    /** label helps operators distinguish credentials without exposing secrets. */
+    label: string;
+}
+/**
+ * CreateStorageCredentialResponse includes the plaintext credential once.
+ * Tarka does not persist secret_access_key and cannot return it again.
+ */
+export interface CreateStorageCredentialResponse {
+    credential: StorageCredential | undefined;
+    accessKeyId: string;
+    secretAccessKey: string;
+    endpoint: string;
+    region: string;
+}
+/** ListStorageCredentialsRequest selects one organization bucket. */
+export interface ListStorageCredentialsRequest {
+    orgId: string;
+    bucketId: string;
+}
+/** ListStorageCredentialsResponse contains redacted storage credentials. */
+export interface ListStorageCredentialsResponse {
+    credentials: StorageCredential[];
+}
+/** RevokeStorageCredentialRequest selects one bucket credential. */
+export interface RevokeStorageCredentialRequest {
+    orgId: string;
+    bucketId: string;
+    credentialId: string;
+}
+/** StorageCredential is redacted metadata for a bucket-scoped S3 access key. */
+export interface StorageCredential {
+    id: string;
+    orgId: string;
+    bucketId: string;
+    label: string;
+    /** access_key_prefix is safe to display and identify in the console. */
+    accessKeyPrefix: string;
+    /** status is active or revoked. */
+    status: string;
+    createdAt: Date | undefined;
+    revokedAt: Date | undefined;
+}
+/** CreateGitRepositoryRequest defines a private hosted Git repository. */
+export interface CreateGitRepositoryRequest {
+    orgId: string;
+    /** name is the URL-safe repository name within the organization. */
+    name: string;
+    description: string;
+    /** initialize creates the first commit when true. */
+    initialize: boolean;
+    /**
+     * default_branch is used when initialize is true; empty selects the platform
+     * default.
+     */
+    defaultBranch: string;
+}
+/** ListGitRepositoriesRequest selects one organization. */
+export interface ListGitRepositoriesRequest {
+    orgId: string;
+}
+/** ListGitRepositoriesResponse contains hosted Git repository metadata. */
+export interface ListGitRepositoriesResponse {
+    repositories: GitRepository[];
+}
+/** DeleteGitRepositoryRequest selects one organization repository. */
+export interface DeleteGitRepositoryRequest {
+    orgId: string;
+    repositoryId: string;
+}
+/** GitRepository describes a private Tarka-hosted Git repository. */
+export interface GitRepository {
+    id: string;
+    orgId: string;
+    name: string;
+    /** status is the repository lifecycle/reconciliation state. */
+    status: string;
+    webUrl: string;
+    sshCloneUrl: string;
+    httpsCloneUrl: string;
+    /** lfs_enabled is true when Git LFS support is enforced. */
+    lfsEnabled: boolean;
+    createdAt: Date | undefined;
+    updatedAt: Date | undefined;
+}
+/** ListAgentHostTerminalTargetsRequest selects a host visible to the caller. */
+export interface ListAgentHostTerminalTargetsRequest {
+    orgId: string;
+    agentHostId: string;
+}
+/**
+ * AgentHostTerminalTarget identifies one currently running application container.
+ * Names are informational, not authority to access arbitrary Kubernetes pods.
+ */
+export interface AgentHostTerminalTarget {
+    service: string;
+    podName: string;
+    containerName: string;
+}
+export interface ListAgentHostTerminalTargetsResponse {
+    targets: AgentHostTerminalTarget[];
+}
+export interface CreateAgentHostTerminalRequest {
+    orgId: string;
+    agentHostId: string;
+    podName: string;
+    containerName: string;
+    /** auto selects bash when available and otherwise sh. Also accepts sh or bash. */
+    shell: string;
+    /** Terminal dimensions: 20..400 columns and 5..200 rows; zero uses 100x30. */
+    cols: number;
+    rows: number;
+}
+/**
+ * AgentHostTerminal contains no reusable infrastructure credential. The opaque
+ * ID is usable only with the same authenticated user, organization, and host.
+ * Sessions expire after 15 minutes without input or one hour in total; the
+ * broker can also terminate a session during restart or after 64 MiB of output.
+ */
+export interface AgentHostTerminal {
+    terminalId: string;
+    target: AgentHostTerminalTarget | undefined;
+    expiresAt: Date | undefined;
+}
+export interface ReadAgentHostTerminalRequest {
+    orgId: string;
+    agentHostId: string;
+    terminalId: string;
+    offset: bigint;
+    /** Zero returns immediately; maximum 20 seconds. */
+    waitSeconds: number;
+}
+/**
+ * AgentHostTerminalOutput contains at most 64 KiB of raw PTY output. REST bytes
+ * are base64 encoded; clients must not interpret output as HTML or log it.
+ */
+export interface AgentHostTerminalOutput {
+    data: Buffer;
+    nextOffset: bigint;
+    outputLost: boolean;
+    closed: boolean;
+    exitCode: number;
+    /**
+     * Stable, non-secret reason such as shell_unavailable, session_expired,
+     * output_limit, or connection_closed. An empty value indicates normal exit.
+     */
+    errorCode: string;
+}
+export interface WriteAgentHostTerminalRequest {
+    orgId: string;
+    agentHostId: string;
+    terminalId: string;
+    data: Buffer;
+    inputSequence: bigint;
+    /** Both zero preserves the current size; otherwise the create bounds apply. */
+    cols: number;
+    rows: number;
+}
+export interface WriteAgentHostTerminalResponse {
+    acknowledgedSequence: bigint;
+}
+export interface CloseAgentHostTerminalRequest {
+    orgId: string;
+    agentHostId: string;
+    terminalId: string;
+}
+export interface CloseAgentHostTerminalResponse {
+}
+/** OrgInvitation excludes the secret token and reports expiry as a status. */
+export interface OrgInvitation {
+    id: string;
+    orgId: string;
+    orgName: string;
+    email: string;
+    role: string;
+    status: string;
+    createdAt: Date | undefined;
+    expiresAt: Date | undefined;
+}
+export interface CreateOrgInvitationRequest {
+    orgId: string;
+    email: string;
+    /** admin, operator, member, or viewer. Defaults to member. */
+    role: string;
+}
+export interface CreateOrgInvitationResponse {
+    invitation: OrgInvitation | undefined;
+    /** One-time delivery secret. Only its SHA-256 hash is stored. */
+    token: string;
+}
+export interface ListOrgInvitationsRequest {
+    orgId: string;
+}
+export interface ListOrgInvitationsResponse {
+    invitations: OrgInvitation[];
+}
+export interface RevokeOrgInvitationRequest {
+    orgId: string;
+    invitationId: string;
+}
+export interface PreviewOrgInvitationRequest {
+    token: string;
+}
+export interface AcceptOrgInvitationRequest {
+    token: string;
+}
+export declare const GetInferenceCaptureRequest: MessageFns<GetInferenceCaptureRequest>;
+export declare const UpdateInferenceCaptureRequest: MessageFns<UpdateInferenceCaptureRequest>;
+export declare const InferenceCapture: MessageFns<InferenceCapture>;
+export declare const GetCurrentUserRequest: MessageFns<GetCurrentUserRequest>;
+export declare const BootstrapCurrentUserRequest: MessageFns<BootstrapCurrentUserRequest>;
+export declare const CreateOrgRequest: MessageFns<CreateOrgRequest>;
+export declare const RequestProductAccessRequest: MessageFns<RequestProductAccessRequest>;
+export declare const ListProductAccessRequestsRequest: MessageFns<ListProductAccessRequestsRequest>;
+export declare const ListProductAccessRequestsResponse: MessageFns<ListProductAccessRequestsResponse>;
+export declare const ProductAccessRequest: MessageFns<ProductAccessRequest>;
+export declare const EnsureHostedGitAccessRequest: MessageFns<EnsureHostedGitAccessRequest>;
+export declare const HostedGitAccess: MessageFns<HostedGitAccess>;
+export declare const CurrentUser: MessageFns<CurrentUser>;
+export declare const ProductEntitlement: MessageFns<ProductEntitlement>;
+export declare const Org: MessageFns<Org>;
+export declare const OrgMember: MessageFns<OrgMember>;
+export declare const ListOrgMembersRequest: MessageFns<ListOrgMembersRequest>;
+export declare const ListOrgMembersResponse: MessageFns<ListOrgMembersResponse>;
+export declare const ListModelsRequest: MessageFns<ListModelsRequest>;
+export declare const ListModelsResponse: MessageFns<ListModelsResponse>;
+export declare const Model: MessageFns<Model>;
+export declare const GetPricingCatalogRequest: MessageFns<GetPricingCatalogRequest>;
+export declare const PricingCatalog: MessageFns<PricingCatalog>;
+export declare const CreateInferenceServiceRequest: MessageFns<CreateInferenceServiceRequest>;
+export declare const CreateAgentHostRequest: MessageFns<CreateAgentHostRequest>;
+export declare const SetAgentHostRunningRequest: MessageFns<SetAgentHostRunningRequest>;
+export declare const AgentHostGitHubRegistryCredentials: MessageFns<AgentHostGitHubRegistryCredentials>;
+export declare const AgentHostGitHubRegistryAccess: MessageFns<AgentHostGitHubRegistryAccess>;
+export declare const AgentHostVariable: MessageFns<AgentHostVariable>;
+export declare const AgentHostRuntimeConfiguration: MessageFns<AgentHostRuntimeConfiguration>;
+export declare const AgentHostModelEndpoint: MessageFns<AgentHostModelEndpoint>;
+export declare const AgentHostGatewayConfiguration: MessageFns<AgentHostGatewayConfiguration>;
+export declare const ListAgentHostTemplatesRequest: MessageFns<ListAgentHostTemplatesRequest>;
+export declare const ListAgentHostTemplatesResponse: MessageFns<ListAgentHostTemplatesResponse>;
+export declare const AgentHostTemplate: MessageFns<AgentHostTemplate>;
+export declare const AgentHostTemplateVariable: MessageFns<AgentHostTemplateVariable>;
+export declare const AgentHostRuntimeProfile: MessageFns<AgentHostRuntimeProfile>;
+export declare const AgentHostGatewayDefinition: MessageFns<AgentHostGatewayDefinition>;
+export declare const GetAgentHostConfigurationRequest: MessageFns<GetAgentHostConfigurationRequest>;
+export declare const AgentHostConfiguration: MessageFns<AgentHostConfiguration>;
+export declare const GetAgentHostGatewayPairingRequest: MessageFns<GetAgentHostGatewayPairingRequest>;
+export declare const AgentHostGatewayPairing: MessageFns<AgentHostGatewayPairing>;
+export declare const DeleteAgentHostRequest: MessageFns<DeleteAgentHostRequest>;
+export declare const CreateJobRequest: MessageFns<CreateJobRequest>;
+export declare const ProvisionedResource: MessageFns<ProvisionedResource>;
+export declare const CreateApiKeyRequest: MessageFns<CreateApiKeyRequest>;
+export declare const CreateApiKeyResponse: MessageFns<CreateApiKeyResponse>;
+export declare const ListApiKeysRequest: MessageFns<ListApiKeysRequest>;
+export declare const ListApiKeysResponse: MessageFns<ListApiKeysResponse>;
+export declare const RevokeApiKeyRequest: MessageFns<RevokeApiKeyRequest>;
+export declare const RevokeApiKeyResponse: MessageFns<RevokeApiKeyResponse>;
+export declare const ApiKey: MessageFns<ApiKey>;
+export declare const GetOrgRequest: MessageFns<GetOrgRequest>;
+export declare const UpdateOrgRequest: MessageFns<UpdateOrgRequest>;
+export declare const GetQuotaPolicyRequest: MessageFns<GetQuotaPolicyRequest>;
+export declare const UpdateQuotaPolicyRequest: MessageFns<UpdateQuotaPolicyRequest>;
+export declare const QuotaPolicy: MessageFns<QuotaPolicy>;
+export declare const GetSpendLimitsRequest: MessageFns<GetSpendLimitsRequest>;
+export declare const UpdateSpendLimitsRequest: MessageFns<UpdateSpendLimitsRequest>;
+export declare const ProductSpendLimit: MessageFns<ProductSpendLimit>;
+export declare const SpendLimits: MessageFns<SpendLimits>;
+export declare const ProductSpend: MessageFns<ProductSpend>;
+export declare const ListUsageEventsRequest: MessageFns<ListUsageEventsRequest>;
+export declare const ListUsageEventsResponse: MessageFns<ListUsageEventsResponse>;
+export declare const UsageEvent: MessageFns<UsageEvent>;
+export declare const GetUsageSummaryRequest: MessageFns<GetUsageSummaryRequest>;
+export declare const UsageSummary: MessageFns<UsageSummary>;
+export declare const ListProvisionedResourcesRequest: MessageFns<ListProvisionedResourcesRequest>;
+export declare const ListProvisionedResourcesResponse: MessageFns<ListProvisionedResourcesResponse>;
+export declare const GetProvisionedResourceRequest: MessageFns<GetProvisionedResourceRequest>;
+export declare const ListLocationsRequest: MessageFns<ListLocationsRequest>;
+export declare const ListLocationsResponse: MessageFns<ListLocationsResponse>;
+export declare const Location: MessageFns<Location>;
+export declare const LocationProduct: MessageFns<LocationProduct>;
+export declare const CreateStorageBucketRequest: MessageFns<CreateStorageBucketRequest>;
+export declare const ListStorageBucketsRequest: MessageFns<ListStorageBucketsRequest>;
+export declare const ListStorageBucketsResponse: MessageFns<ListStorageBucketsResponse>;
+export declare const DeleteStorageBucketRequest: MessageFns<DeleteStorageBucketRequest>;
+export declare const StorageBucket: MessageFns<StorageBucket>;
+export declare const CreateStorageCredentialRequest: MessageFns<CreateStorageCredentialRequest>;
+export declare const CreateStorageCredentialResponse: MessageFns<CreateStorageCredentialResponse>;
+export declare const ListStorageCredentialsRequest: MessageFns<ListStorageCredentialsRequest>;
+export declare const ListStorageCredentialsResponse: MessageFns<ListStorageCredentialsResponse>;
+export declare const RevokeStorageCredentialRequest: MessageFns<RevokeStorageCredentialRequest>;
+export declare const StorageCredential: MessageFns<StorageCredential>;
+export declare const CreateGitRepositoryRequest: MessageFns<CreateGitRepositoryRequest>;
+export declare const ListGitRepositoriesRequest: MessageFns<ListGitRepositoriesRequest>;
+export declare const ListGitRepositoriesResponse: MessageFns<ListGitRepositoriesResponse>;
+export declare const DeleteGitRepositoryRequest: MessageFns<DeleteGitRepositoryRequest>;
+export declare const GitRepository: MessageFns<GitRepository>;
+export declare const ListAgentHostTerminalTargetsRequest: MessageFns<ListAgentHostTerminalTargetsRequest>;
+export declare const AgentHostTerminalTarget: MessageFns<AgentHostTerminalTarget>;
+export declare const ListAgentHostTerminalTargetsResponse: MessageFns<ListAgentHostTerminalTargetsResponse>;
+export declare const CreateAgentHostTerminalRequest: MessageFns<CreateAgentHostTerminalRequest>;
+export declare const AgentHostTerminal: MessageFns<AgentHostTerminal>;
+export declare const ReadAgentHostTerminalRequest: MessageFns<ReadAgentHostTerminalRequest>;
+export declare const AgentHostTerminalOutput: MessageFns<AgentHostTerminalOutput>;
+export declare const WriteAgentHostTerminalRequest: MessageFns<WriteAgentHostTerminalRequest>;
+export declare const WriteAgentHostTerminalResponse: MessageFns<WriteAgentHostTerminalResponse>;
+export declare const CloseAgentHostTerminalRequest: MessageFns<CloseAgentHostTerminalRequest>;
+export declare const CloseAgentHostTerminalResponse: MessageFns<CloseAgentHostTerminalResponse>;
+export declare const OrgInvitation: MessageFns<OrgInvitation>;
+export declare const CreateOrgInvitationRequest: MessageFns<CreateOrgInvitationRequest>;
+export declare const CreateOrgInvitationResponse: MessageFns<CreateOrgInvitationResponse>;
+export declare const ListOrgInvitationsRequest: MessageFns<ListOrgInvitationsRequest>;
+export declare const ListOrgInvitationsResponse: MessageFns<ListOrgInvitationsResponse>;
+export declare const RevokeOrgInvitationRequest: MessageFns<RevokeOrgInvitationRequest>;
+export declare const PreviewOrgInvitationRequest: MessageFns<PreviewOrgInvitationRequest>;
+export declare const AcceptOrgInvitationRequest: MessageFns<AcceptOrgInvitationRequest>;
+/**
+ * ProvisioningService manages Tarka identities, organizations, API keys,
+ * quotas, metering, object storage, hosted Git, and desired-state compute
+ * resources.
+ */
+export type ProvisioningServiceDefinition = typeof ProvisioningServiceDefinition;
+export declare const ProvisioningServiceDefinition: {
+    readonly name: "ProvisioningService";
+    readonly fullName: "tarka.provisioning.v1.ProvisioningService";
+    readonly methods: {
+        /**
+         * GetPricingCatalog exposes the active USD retail catalog and currency factors.
+         * Public, read-only; never includes credentials or upstream acquisition prices.
+         */
+        readonly getPricingCatalog: {
+            readonly name: "GetPricingCatalog";
+            readonly requestType: typeof GetPricingCatalogRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof PricingCatalog;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** CreateComputeQuote returns a five-minute quote without reserving funds. */
+        readonly createComputeQuote: {
+            readonly name: "CreateComputeQuote";
+            readonly requestType: typeof CreateComputeQuoteRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ComputeQuote;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetUsagePolicy returns current allowances and an owner acceptance estimate. */
+        readonly getUsagePolicy: {
+            readonly name: "GetUsagePolicy";
+            readonly requestType: typeof GetUsagePolicyRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof UsagePolicy;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** AcceptUsagePolicy enables prospective charging only after qualification. */
+        readonly acceptUsagePolicy: {
+            readonly name: "AcceptUsagePolicy";
+            readonly requestType: typeof AcceptUsagePolicyRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof UsagePolicy;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetInferenceCapture returns this organization's optional bucket-capture
+         * configuration and recent delivery health. It never exposes internal archives.
+         */
+        readonly getInferenceCapture: {
+            readonly name: "GetInferenceCapture";
+            readonly requestType: typeof GetInferenceCaptureRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof InferenceCapture;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * UpdateInferenceCapture enables or disables customer-owned capture for all
+         * model calls. Requires an organization owner/admin and storage access.
+         * Enabling idempotently provisions the organization's inference-history bucket.
+         */
+        readonly updateInferenceCapture: {
+            readonly name: "UpdateInferenceCapture";
+            readonly requestType: typeof UpdateInferenceCaptureRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof InferenceCapture;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetCurrentUser returns the authenticated identity and its active
+         * organization memberships.
+         */
+        readonly getCurrentUser: {
+            readonly name: "GetCurrentUser";
+            readonly requestType: typeof GetCurrentUserRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof CurrentUser;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * BootstrapCurrentUser idempotently creates an initial organization when the
+         * authenticated identity does not yet belong to one.
+         */
+        readonly bootstrapCurrentUser: {
+            readonly name: "BootstrapCurrentUser";
+            readonly requestType: typeof BootstrapCurrentUserRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof CurrentUser;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateOrg creates an additional organization and makes the authenticated
+         * identity its owner.
+         */
+        readonly createOrg: {
+            readonly name: "CreateOrg";
+            readonly requestType: typeof CreateOrgRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Org;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * RequestProductAccess submits an organization-scoped request for a product
+         * that is not yet generally self-service.
+         */
+        readonly requestProductAccess: {
+            readonly name: "RequestProductAccess";
+            readonly requestType: typeof RequestProductAccessRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProductAccessRequest;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListProductAccessRequests returns recent requests submitted for an
+         * organization, optionally filtered by product.
+         */
+        readonly listProductAccessRequests: {
+            readonly name: "ListProductAccessRequests";
+            readonly requestType: typeof ListProductAccessRequestsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListProductAccessRequestsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * EnsureHostedGitAccess provisions or reconciles the authenticated user's
+         * hosted Git identity.
+         */
+        readonly ensureHostedGitAccess: {
+            readonly name: "EnsureHostedGitAccess";
+            readonly requestType: typeof EnsureHostedGitAccessRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof HostedGitAccess;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListModels returns active model aliases, optionally filtered by modality. */
+        readonly listModels: {
+            readonly name: "ListModels";
+            readonly requestType: typeof ListModelsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListModelsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateInferenceService records desired state for a managed inference
+         * service. Reusing an organization, resource type, and name updates it.
+         */
+        readonly createInferenceService: {
+            readonly name: "CreateInferenceService";
+            readonly requestType: typeof CreateInferenceServiceRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateAgentHost applies desired state for a managed multi-service Compose
+         * stack or a backward-compatible single-image Agent Host.
+         */
+        readonly createAgentHost: {
+            readonly name: "CreateAgentHost";
+            readonly requestType: typeof CreateAgentHostRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListAgentHostTemplates returns the versioned Compose templates published
+         * by Tarka. Template definitions never contain runtime secret values.
+         */
+        readonly listAgentHostTemplates: {
+            readonly name: "ListAgentHostTemplates";
+            readonly requestType: typeof ListAgentHostTemplatesRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListAgentHostTemplatesResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetAgentHostConfiguration returns the editable, redacted configuration for
+         * one Agent Host. Secret values are never returned; preserve_existing marks
+         * secret references that may be carried into a later revision.
+         */
+        readonly getAgentHostConfiguration: {
+            readonly name: "GetAgentHostConfiguration";
+            readonly requestType: typeof GetAgentHostConfigurationRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostConfiguration;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * StartAgentHostRegistryTest validates a complete credential assignment in a
+         * disposable worker. It does not allocate a host or change saved credentials.
+         */
+        readonly startAgentHostRegistryTest: {
+            readonly name: "StartAgentHostRegistryTest";
+            readonly requestType: typeof StartAgentHostRegistryTestRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostRegistryTest;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly getAgentHostRegistryTest: {
+            readonly name: "GetAgentHostRegistryTest";
+            readonly requestType: typeof GetAgentHostRegistryTestRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostRegistryTest;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly cancelAgentHostRegistryTest: {
+            readonly name: "CancelAgentHostRegistryTest";
+            readonly requestType: typeof CancelAgentHostRegistryTestRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostRegistryTest;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * Source integration and isolated builds are capability-gated. Contract
+         * publication alone does not enable them or alter existing image-only hosts.
+         */
+        readonly getSourceCapabilities: {
+            readonly name: "GetSourceCapabilities";
+            readonly requestType: typeof GetSourceCapabilitiesRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof GetSourceCapabilitiesResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly previewSource: {
+            readonly name: "PreviewSource";
+            readonly requestType: typeof PreviewSourceRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof PreviewSourceResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly prepareSourceDeployment: {
+            readonly name: "PrepareSourceDeployment";
+            readonly requestType: typeof PrepareSourceDeploymentRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof PrepareSourceDeploymentResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly startGitHubSourceAuthorization: {
+            readonly name: "StartGitHubSourceAuthorization";
+            readonly requestType: typeof StartGitHubSourceAuthorizationRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof GitHubSourceAuthorization;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly listGitHubSourceInstallations: {
+            readonly name: "ListGitHubSourceInstallations";
+            readonly requestType: typeof ListGitHubSourceInstallationsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListGitHubSourceInstallationsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly listGitHubSourceRepositories: {
+            readonly name: "ListGitHubSourceRepositories";
+            readonly requestType: typeof ListGitHubSourceRepositoriesRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListGitHubSourceRepositoriesResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly connectGitHubSource: {
+            readonly name: "ConnectGitHubSource";
+            readonly requestType: typeof ConnectGitHubSourceRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceConnection;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly connectHostedGitSource: {
+            readonly name: "ConnectHostedGitSource";
+            readonly requestType: typeof ConnectHostedGitSourceRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceConnection;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly listSourceConnections: {
+            readonly name: "ListSourceConnections";
+            readonly requestType: typeof ListSourceConnectionsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListSourceConnectionsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly disconnectSourceConnection: {
+            readonly name: "DisconnectSourceConnection";
+            readonly requestType: typeof DisconnectSourceConnectionRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceConnection;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly putSourceTarget: {
+            readonly name: "PutSourceTarget";
+            readonly requestType: typeof PutSourceTargetRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceTarget;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly listSourceTargets: {
+            readonly name: "ListSourceTargets";
+            readonly requestType: typeof ListSourceTargetsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListSourceTargetsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly startSourceBuild: {
+            readonly name: "StartSourceBuild";
+            readonly requestType: typeof StartSourceBuildRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceBuild;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly listSourceBuilds: {
+            readonly name: "ListSourceBuilds";
+            readonly requestType: typeof ListSourceBuildsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListSourceBuildsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly getSourceBuild: {
+            readonly name: "GetSourceBuild";
+            readonly requestType: typeof GetSourceBuildRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceBuild;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly cancelSourceBuild: {
+            readonly name: "CancelSourceBuild";
+            readonly requestType: typeof CancelSourceBuildRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SourceBuild;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        readonly getSourceBuildLogs: {
+            readonly name: "GetSourceBuildLogs";
+            readonly requestType: typeof GetSourceBuildLogsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof GetSourceBuildLogsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetAgentHostGatewayPairing returns a short-lived pairing artifact for a
+         * post-deploy messaging gateway. The runtime service remains private to the
+         * Agent Host namespace and is never exposed directly to the Internet.
+         */
+        readonly getAgentHostGatewayPairing: {
+            readonly name: "GetAgentHostGatewayPairing";
+            readonly requestType: typeof GetAgentHostGatewayPairingRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostGatewayPairing;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListAgentHostTerminalTargets lists running application containers in this
+         * host. Platform gateways and initialization containers are excluded.
+         */
+        readonly listAgentHostTerminalTargets: {
+            readonly name: "ListAgentHostTerminalTargets";
+            readonly requestType: typeof ListAgentHostTerminalTargetsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListAgentHostTerminalTargetsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateAgentHostTerminal opens a real interactive PTY in a selected running
+         * container. Sessions belong to the authenticated user and this host; opening
+         * another session never resumes a different user's shell. Requires a resource
+         * manager role and active agents access. No command or output is audit logged.
+         */
+        readonly createAgentHostTerminal: {
+            readonly name: "CreateAgentHostTerminal";
+            readonly requestType: typeof CreateAgentHostTerminalRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostTerminal;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ReadAgentHostTerminal reads bounded raw terminal bytes after a byte offset.
+         * It may wait up to 20 seconds for output. Old bytes can be evicted; callers
+         * must advance to next_offset and indicate output_lost to the user.
+         */
+        readonly readAgentHostTerminal: {
+            readonly name: "ReadAgentHostTerminal";
+            readonly requestType: typeof ReadAgentHostTerminalRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostTerminalOutput;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * WriteAgentHostTerminal sends up to 16 KiB of raw input and/or a PTY resize.
+         * Each write uses a strictly increasing input_sequence starting at 1. An exact
+         * retry of the last write is acknowledged without replaying its input; a
+         * reused sequence with different content or a sequence gap is rejected.
+         */
+        readonly writeAgentHostTerminal: {
+            readonly name: "WriteAgentHostTerminal";
+            readonly requestType: typeof WriteAgentHostTerminalRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof WriteAgentHostTerminalResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CloseAgentHostTerminal closes only the caller's session and its exec
+         * connection. Expired or already closed sessions are safe to close again.
+         * Closing a terminal does not delete the host or its persistent files.
+         */
+        readonly closeAgentHostTerminal: {
+            readonly name: "CloseAgentHostTerminal";
+            readonly requestType: typeof CloseAgentHostTerminalRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof CloseAgentHostTerminalResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * DeleteAgentHost requests deletion of an Agent Host and every namespaced
+         * workload owned by it. Retained volume data follows the platform policy.
+         */
+        readonly deleteAgentHost: {
+            readonly name: "DeleteAgentHost";
+            readonly requestType: typeof DeleteAgentHostRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * Pausing retains persistent data. Resuming explicitly reserves prepaid credit;
+         * topping up alone never resumes a paused host.
+         */
+        readonly setAgentHostRunning: {
+            readonly name: "SetAgentHostRunning";
+            readonly requestType: typeof SetAgentHostRunningRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** PrepareAgentHostSecrets returns a console handoff without any secret values. */
+        readonly prepareAgentHostSecrets: {
+            readonly name: "PrepareAgentHostSecrets";
+            readonly requestType: typeof PrepareAgentHostSecretsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostSecretBundle;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetAgentHostSecrets returns only the handoff status and key names. */
+        readonly getAgentHostSecrets: {
+            readonly name: "GetAgentHostSecrets";
+            readonly requestType: typeof GetAgentHostSecretsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostSecretBundle;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * UploadAgentHostSecrets accepts direct authenticated file/console uploads.
+         * This write-only method is not offered through MCP.
+         */
+        readonly uploadAgentHostSecrets: {
+            readonly name: "UploadAgentHostSecrets";
+            readonly requestType: typeof UploadAgentHostSecretsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof AgentHostSecretBundle;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateJob records a finite job revision and queues its first run atomically.
+         * Exact idempotent retries return the original result. A changed revision of
+         * an active job is rejected. An accepted response is not execution readiness.
+         * The runtime remains feature-gated; unavailable products fail closed.
+         */
+        readonly createJob: {
+            readonly name: "CreateJob";
+            readonly requestType: typeof CreateJobRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetJob reads an organization-owned job's current desired state. Listing
+         * jobs uses ListProvisionedResources with resource_type="job".
+         */
+        readonly getJob: {
+            readonly name: "GetJob";
+            readonly requestType: typeof GetJobRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListJobRuns returns immutable revisions, newest first. A revision may have
+         * bounded infrastructure retries, but never overlapping execution attempts.
+         */
+        readonly listJobRuns: {
+            readonly name: "ListJobRuns";
+            readonly requestType: typeof ListJobRunsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListJobRunsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetJobRun reads execution state without returning customer output. */
+        readonly getJobRun: {
+            readonly name: "GetJobRun";
+            readonly requestType: typeof GetJobRunRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof JobRun;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CancelJobRun is idempotent. STOPPING retains its budget reservation until
+         * execution is confirmed stopped. A terminal run is returned unchanged.
+         */
+        readonly cancelJobRun: {
+            readonly name: "CancelJobRun";
+            readonly requestType: typeof CancelJobRunRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof JobRun;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetJobRunResult returns terminal result metadata and an optional signed log
+         * download. It rechecks organization and product access on every request.
+         */
+        readonly getJobRunResult: {
+            readonly name: "GetJobRunResult";
+            readonly requestType: typeof GetJobRunResultRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof JobRunResult;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateApiKey creates a customer API key. Its plaintext secret is returned
+         * exactly once in the response.
+         */
+        readonly createApiKey: {
+            readonly name: "CreateApiKey";
+            readonly requestType: typeof CreateApiKeyRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof CreateApiKeyResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListApiKeys returns redacted API-key metadata for an organization. */
+        readonly listApiKeys: {
+            readonly name: "ListApiKeys";
+            readonly requestType: typeof ListApiKeysRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListApiKeysResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** RevokeApiKey permanently disables an API key. */
+        readonly revokeApiKey: {
+            readonly name: "RevokeApiKey";
+            readonly requestType: typeof RevokeApiKeyRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof RevokeApiKeyResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetOrg returns an active organization visible to the caller. */
+        readonly getOrg: {
+            readonly name: "GetOrg";
+            readonly requestType: typeof GetOrgRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Org;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** UpdateOrg changes mutable organization metadata. */
+        readonly updateOrg: {
+            readonly name: "UpdateOrg";
+            readonly requestType: typeof UpdateOrgRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Org;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateOrgInvitation issues a seven-day invitation or replaces a previous link.
+         * Owners may invite admins; owners and admins may invite other non-owner roles.
+         * The token is returned once for delivery by a trusted email client. Never log it.
+         */
+        readonly createOrgInvitation: {
+            readonly name: "CreateOrgInvitation";
+            readonly requestType: typeof CreateOrgInvitationRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof CreateOrgInvitationResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListOrgInvitations returns invitation history to organization administrators. */
+        readonly listOrgInvitations: {
+            readonly name: "ListOrgInvitations";
+            readonly requestType: typeof ListOrgInvitationsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListOrgInvitationsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** RevokeOrgInvitation invalidates an outstanding link. */
+        readonly revokeOrgInvitation: {
+            readonly name: "RevokeOrgInvitation";
+            readonly requestType: typeof RevokeOrgInvitationRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof OrgInvitation;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * PreviewOrgInvitation requires the verified recipient identity. Pending platform
+         * accounts may preview and accept; invitations never grant product entitlements.
+         */
+        readonly previewOrgInvitation: {
+            readonly name: "PreviewOrgInvitation";
+            readonly requestType: typeof PreviewOrgInvitationRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof OrgInvitation;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * AcceptOrgInvitation atomically consumes a link and creates the membership.
+         * Retrying with the same recipient is safe and never changes an existing role.
+         */
+        readonly acceptOrgInvitation: {
+            readonly name: "AcceptOrgInvitation";
+            readonly requestType: typeof AcceptOrgInvitationRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Org;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListOrgMembers returns active and inactive memberships visible to an
+         * organization member.
+         */
+        readonly listOrgMembers: {
+            readonly name: "ListOrgMembers";
+            readonly requestType: typeof ListOrgMembersRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListOrgMembersResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetQuotaPolicy returns an organization's effective inference quota policy. */
+        readonly getQuotaPolicy: {
+            readonly name: "GetQuotaPolicy";
+            readonly requestType: typeof GetQuotaPolicyRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof QuotaPolicy;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** UpdateQuotaPolicy replaces an organization's inference quota policy. */
+        readonly updateQuotaPolicy: {
+            readonly name: "UpdateQuotaPolicy";
+            readonly requestType: typeof UpdateQuotaPolicyRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof QuotaPolicy;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * GetSpendLimits returns an organization's monthly spend limits and what it
+         * has been charged against each in the current UTC calendar month.
+         */
+        readonly getSpendLimits: {
+            readonly name: "GetSpendLimits";
+            readonly requestType: typeof GetSpendLimitsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SpendLimits;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * UpdateSpendLimits replaces an organization's monthly spend limits. Once a
+         * priced request could take spend past a limit that applies to it, the
+         * Inference API refuses the request with HTTP 402 and the error code
+         * spend_limit_reached.
+         */
+        readonly updateSpendLimits: {
+            readonly name: "UpdateSpendLimits";
+            readonly requestType: typeof UpdateSpendLimitsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SpendLimits;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListUsageEvents returns the organization's newest metered requests. */
+        readonly listUsageEvents: {
+            readonly name: "ListUsageEvents";
+            readonly requestType: typeof ListUsageEventsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListUsageEventsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetUsageSummary aggregates the organization's current UTC calendar month. */
+        readonly getUsageSummary: {
+            readonly name: "GetUsageSummary";
+            readonly requestType: typeof GetUsageSummaryRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof UsageSummary;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListProvisionedResources returns desired-state resources, optionally
+         * filtered by resource type.
+         */
+        readonly listProvisionedResources: {
+            readonly name: "ListProvisionedResources";
+            readonly requestType: typeof ListProvisionedResourcesRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListProvisionedResourcesResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** GetProvisionedResource returns one desired-state resource by identifier. */
+        readonly getProvisionedResource: {
+            readonly name: "GetProvisionedResource";
+            readonly requestType: typeof GetProvisionedResourceRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ProvisionedResource;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * ListLocations returns the locations where Tarka can place sandboxes,
+         * Agent Hosts and storage buckets, with the products each one offers. With
+         * an organization, preview locations that organization may use are
+         * included.
+         */
+        readonly listLocations: {
+            readonly name: "ListLocations";
+            readonly requestType: typeof ListLocationsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListLocationsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** CreateStorageBucket provisions a private, versioned S3-compatible bucket. */
+        readonly createStorageBucket: {
+            readonly name: "CreateStorageBucket";
+            readonly requestType: typeof CreateStorageBucketRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof StorageBucket;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListStorageBuckets returns object-storage buckets in an organization. */
+        readonly listStorageBuckets: {
+            readonly name: "ListStorageBuckets";
+            readonly requestType: typeof ListStorageBucketsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListStorageBucketsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** DeleteStorageBucket permanently deletes an empty object-storage bucket. */
+        readonly deleteStorageBucket: {
+            readonly name: "DeleteStorageBucket";
+            readonly requestType: typeof DeleteStorageBucketRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof StorageBucket;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * CreateStorageCredential creates credentials scoped to one bucket. The
+         * secret_access_key is returned exactly once in the response.
+         */
+        readonly createStorageCredential: {
+            readonly name: "CreateStorageCredential";
+            readonly requestType: typeof CreateStorageCredentialRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof CreateStorageCredentialResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListStorageCredentials returns redacted credential metadata for a bucket. */
+        readonly listStorageCredentials: {
+            readonly name: "ListStorageCredentials";
+            readonly requestType: typeof ListStorageCredentialsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListStorageCredentialsResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** RevokeStorageCredential permanently disables a storage credential. */
+        readonly revokeStorageCredential: {
+            readonly name: "RevokeStorageCredential";
+            readonly requestType: typeof RevokeStorageCredentialRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof StorageCredential;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** CreateGitRepository creates a private, LFS-enabled hosted Git repository. */
+        readonly createGitRepository: {
+            readonly name: "CreateGitRepository";
+            readonly requestType: typeof CreateGitRepositoryRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof GitRepository;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /** ListGitRepositories returns hosted Git repositories in an organization. */
+        readonly listGitRepositories: {
+            readonly name: "ListGitRepositories";
+            readonly requestType: typeof ListGitRepositoriesRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof ListGitRepositoriesResponse;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+        /**
+         * DeleteGitRepository deletes a hosted Git repository and records its final
+         * state.
+         */
+        readonly deleteGitRepository: {
+            readonly name: "DeleteGitRepository";
+            readonly requestType: typeof DeleteGitRepositoryRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof GitRepository;
+            readonly responseStream: false;
+            readonly options: {
+                readonly _unknownFields: {
+                    readonly 578365826: readonly [Buffer<ArrayBufferLike>];
+                };
+            };
+        };
+    };
+};
+type Builtin = Date | Function | Uint8Array | string | number | boolean | bigint | undefined;
+export type DeepPartial<T> = T extends bigint ? string | number | bigint : T extends Builtin ? T : T extends globalThis.Array<infer U> ? globalThis.Array<DeepPartial<U>> : T extends ReadonlyArray<infer U> ? ReadonlyArray<DeepPartial<U>> : T extends {
+    $case: string;
+    value: unknown;
+} ? {
+    $case: T["$case"];
+    value?: DeepPartial<T["value"]>;
+} : T extends {} ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : Partial<T>;
+export interface MessageFns<T> {
+    encode(message: T, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): T;
+    fromJSON(object: any): T;
+    toJSON(message: T): unknown;
+    create(base?: DeepPartial<T>): T;
+    fromPartial(object: DeepPartial<T>): T;
+}
+export {};