lua-cli 3.53.0 → 3.55.0

package/dist/api-exports.d.ts

@@ -189,6 +189,17 @@ declare interface AgentDirectoryEntry {
     callerActions: string[];
 }
 
+/**
+ * A fresh agent identity assertion (ADR 0025): a 60-second, single-use, platform-signed proof that the call comes
+ * from a live execution of this agent.
+ */
+export declare interface AgentIdentityAssertion {
+    /** Send as the `X-Lua-Agent-Assertion` header on ONE call to the system named by `audience`. */
+    token: string;
+    /** ISO-8601 instant the token expires (60 s after it was minted). */
+    expiresAt: string;
+}
+
 /**
  * Narrowed, wire-safe output for `Agents.invoke`. A slice of the internal
  * `FullOutput` shape — raw Mastra steps / tripwire payloads are intentionally
@@ -2874,15 +2885,6 @@ export declare interface ChannelSendTarget {
     identity?: UserIdentityRef;
 }
 
-/**
- * Wire-format types for `GET /chat/history/:agentId` and the VM-sandbox
- * `User.getChatHistory()` API. Both paths return the same shape.
- *
- * Shared between lua-core (HTTP controller + VM devtools) and lua-cli
- * (HTTP client typing for `lua test`). Also shared with lua-api's
- * `thread.service.ts` (admin org-thread listing) so the parser never
- * diverges across services.
- */
 /**
  * One content part of a chat-history message.
  *
@@ -2953,6 +2955,8 @@ export declare interface ChatHistoryMessage {
     servedModel?: string;
     /** True when the turn reached that model through the Auto selector. */
     autoModelRequested?: boolean;
+    /** On an assistant message: the id the reply streamed under, which its usage and ledger rows carry. */
+    turnId?: string;
     author?: {
         userId: string;
     };
@@ -2962,6 +2966,8 @@ export declare interface ChatHistoryMessage {
     };
     /** On a user message: the id the client gave the turn when it sent it, so it can tell which of its sends arrived. */
     clientTurnId?: string;
+    /** Set on every message of a turn that has more than one version. */
+    replyVersion?: ReplyVersionInfo;
     /**
      * Permanent recording for a voice-note turn (Lua Desktop). Populated by the
      * admin threads history endpoint from the row's `content.metadata.audio` — a
@@ -3277,6 +3283,8 @@ declare interface CustomDataAPI {
         set?: Record<string, any>;
         unset?: string[];
         searchText?: string | null;
+        /** Refreshes the index declarations (same semantics as create's option). */
+        index?: Array<string | string[]>;
     }, options?: {
         ifVersion?: number;
     }): Promise<UpdateCustomDataResponse>;
@@ -3474,7 +3482,7 @@ export declare const Data: {
      *
      * @param collectionName - Name of the collection
      * @param entryId - ID of the entry
-     * @param mutation - `{ set?, unset?, searchText? }` (`searchText: null` clears it)
+     * @param mutation - `{ set?, unset?, searchText?, index? }` (`searchText: null` clears it; `index` as create's option)
      * @param options - `{ ifVersion? }` for compare-and-swap
      * @returns Promise resolving to `{ status, message, version }` (`version` = the entry's new version)
      */
@@ -3482,6 +3490,8 @@ export declare const Data: {
         set?: Record<string, any>;
         unset?: string[];
         searchText?: string | null;
+        /** Refreshes the index declarations (same semantics as create's `index` option). */
+        index?: Array<string | string[]>;
     }, options?: PatchCustomDataOptions): Promise<UpdateCustomDataResponse>;
     /**
      * Atomically adds `by` (default 1; negative and fractional amounts allowed)
@@ -3546,7 +3556,9 @@ export declare const Data: {
      * - Readers may `collections`, `get`, `getEntry`, `search`; writers may also `create`, `update`, `patch`,
      *   `increment`, `delete` (a writer can read). Anything else rejects with `code === 'shared_data_forbidden'`
      *   (403) — also when the name does not exist or belongs to another org.
-     * - Same limits, filters, managed indexes, compare-and-swap and vector search as `Data`. Every write is audited
+     * - Same limits, filters, managed indexes, compare-and-swap and vector search as `Data`. A writer declares indexes
+     *   (`{ index }` on create/update/patch); they belong to the shared collection (5 across its sub-collections) and
+     *   `collections()` reports their status to every reader. Every write is audited
      *   (agent, collection, entry id; never the value).
      * - A test session may read but not write (`shared_data_test_session_write_refused`, 409).
      * - Deployed agents only: under `lua test` every call rejects with `code === 'shared_data_unavailable_offline'`.
@@ -3590,11 +3602,11 @@ export declare class DataEntryInstance {
     /**
      * Updates the custom data entry
      * @param data - The data fields to update (partial update supported)
-     * @param searchText - Optional new search text for semantic search indexing
+     * @param optionsOrSearchText - `{ searchText?, index? }` (as `Data.update`), or a bare string (legacy `searchText`)
      * @returns Promise resolving to the updated data
      * @throws Error if the update fails
      */
-    update(data: Record<string, any>, searchText?: string): Promise<Record<string, any>>;
+    update(data: Record<string, any>, optionsOrSearchText?: string | CreateCustomDataOptions): Promise<Record<string, any>>;
     /**
      * Atomically sets/unsets fields. `options.ifVersion` makes it a
      * compare-and-swap (pass `entry._version`); a stale version rejects with
@@ -3605,6 +3617,8 @@ export declare class DataEntryInstance {
         set?: Record<string, any>;
         unset?: string[];
         searchText?: string | null;
+        /** Refreshes the index declarations (same semantics as create's option). */
+        index?: Array<string | string[]>;
     }, options?: {
         ifVersion?: number;
     }): Promise<Record<string, any>>;
@@ -3617,11 +3631,11 @@ export declare class DataEntryInstance {
     delete(): Promise<boolean>;
     /**
      * Saves the data entry
-     * @param searchText - Optional search text for vector search indexing
+     * @param optionsOrSearchText - `{ searchText?, index? }` (as `Data.update`), or a bare string (legacy `searchText`)
      * @returns Promise resolving to true if saving was successful
      * @throws Error if the save operation fails
      */
-    save(searchText?: string): Promise<boolean>;
+    save(optionsOrSearchText?: string | CreateCustomDataOptions): Promise<boolean>;
 }
 
 export { DatasetRef }
@@ -3870,6 +3884,10 @@ export declare function defineVoice(config: LuaVoiceConfig): LuaVoice;
 /**
  * Define a web app on the agent.
  *
+ * `GET` routes must only read. People a view was shared with view-only (`auth.accessLevel === 'view_only'`) can call
+ * every `GET` route with the agent's own data and connections, and nothing else; any change belongs in a
+ * `POST`, `PUT`, `PATCH` or `DELETE` route, which only people with full access reach.
+ *
  * @example
  * ```typescript
  * import { defineWebApp, route, json } from 'lua-cli';
@@ -4964,6 +4982,17 @@ export declare interface IntegrationPassthroughRequest {
      * server-side and cannot be overridden.
      */
     headers?: Record<string, string>;
+    /**
+     * BAC-2677 — ask for the provider body as bytes. With `'base64'`, a 2xx
+     * response body is read as raw bytes and returned base64-encoded in `data`
+     * (and `encoding: 'base64'` is set on the response), so binary files such as
+     * a Drive PDF (`drive/v3/files/<id>?alt=media`) survive intact. Bodies over
+     * {@link INTEGRATION_PASSTHROUGH_MAX_BASE64_RESPONSE_BYTES} are refused with
+     * {@link INTEGRATION_PASSTHROUGH_RESPONSE_TOO_LARGE_CODE}, never truncated.
+     * Provider error statuses keep the normal JSON/text body. Omit for the
+     * default JSON/text handling.
+     */
+    responseType?: 'base64';
 }
 
 /**
@@ -4979,8 +5008,16 @@ export declare interface IntegrationPassthroughResponse {
     /**
      * Provider response body: parsed JSON when the response is JSON, the raw
      * string otherwise (e.g. a `text/plain` unified diff round-trips intact).
+     * A base64 string when `encoding` is `'base64'`.
      */
     data: unknown;
+    /**
+     * BAC-2677 — `'base64'` when `data` is the provider body base64-encoded
+     * (the request asked for `responseType: 'base64'` and the provider answered
+     * 2xx). Absent means `data` took the normal JSON/text path, so a caller that
+     * asked for bytes can tell when it did not get them.
+     */
+    encoding?: 'base64';
 }
 
 export declare const Integrations: IntegrationsApi;
@@ -5946,7 +5983,14 @@ export declare interface LuaAgentConfig {
  */
 export declare type LuaAgentModel = string | ((request: LuaRequest) => string | Promise<string>);
 
-/** The signed-in person a route runs for (never an API key, never anonymous). */
+/**
+ * The signed-in person a route runs for (never an API key, never anonymous).
+ *
+ * `auth.accessLevel` says how much of the app they may use: `'full'` when they can read the app's agent, or
+ * `'view_only'` when someone shared just this view with them (or it is org-wide in their workspace) — then only
+ * `GET` routes reach your handlers, `roles` and `scopes` are empty, and the agent pane is off. A `GET` route must
+ * therefore only read: never create, change or delete anything in one.
+ */
 export declare type LuaAuth = WebRouteAuth;
 
 export declare class LuaBrowser {
@@ -6122,6 +6166,29 @@ export declare interface LuaDeviceTriggerConfig {
     execute: (payload: any, context: DeviceTriggerContext) => Promise<any>;
 }
 
+/**
+ * The agent's own identity, proven by the platform (ADR 0025).
+ */
+export declare interface LuaIdentity {
+    /**
+     * Mint a fresh agent identity assertion for `audience`. Only platform-allowlisted audiences are minted; today
+     * that is `'lua-api:staff'` (Lua's staff API, for an agent enrolled as a staff service principal).
+     *
+     * Throws an `AgentIdentityError` (`err.code`):
+     * - `agent_identity_requires_live_execution` outside a live execution (always in `lua test` / `lua dev`);
+     * - `agent_identity_audience_not_allowed` for any other audience;
+     * - `agent_identity_input_invalid` when `audience` is missing;
+     * - `agent_identity_unavailable` when the platform cannot mint one right now.
+     *
+     * Inside a test session it throws a `TestSessionError` with `test_session_tier_unsupported` instead.
+     *
+     * Mint one per call. A token is single-use, so never cache or reuse it.
+     */
+    assertion(input: {
+        audience: string;
+    }): Promise<AgentIdentityAssertion>;
+}
+
 /**
  * Lua Job class.
  * Main class for building scheduled jobs (cron jobs, one-time tasks, intervals).
@@ -6469,6 +6536,11 @@ export declare interface LuaRequest {
 export declare interface LuaRuntime {
     /** Request context information */
     request: LuaRequest;
+    /**
+     * The agent's platform-proven identity (ADR 0025). Optional because older runtimes do not provide it, so read it
+     * defensively: `Lua.identity?.assertion`.
+     */
+    identity?: LuaIdentity;
 }
 
 /**
@@ -6584,6 +6656,22 @@ export declare interface LuaTool<TInput extends ZodType = ZodType> {
     name: string;
     /** Description of what the tool does */
     description: string;
+    /**
+     * Optional text the chat shows to the user while this tool runs and after it
+     * finishes, instead of the tool's name. Either one text for both moments, or
+     * one for each:
+     *
+     * ```ts
+     * label = { running: 'Creating a ticket for {subject}', done: 'Created a ticket for {subject}' };
+     * label = 'Checked stock';
+     * ```
+     *
+     * `{argName}` is replaced with that argument's value from the call (string
+     * and number arguments only). Don't end the text with "…": the chat adds it
+     * while the tool runs. Each text is a string literal (or a const holding one)
+     * of at most 80 characters; `lua compile` ignores a computed label.
+     */
+    label?: ToolLabel;
     /** Zod schema for input validation */
     inputSchema: TInput;
     /**
@@ -6849,15 +6937,15 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
          */
         options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     }, {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"plugin">;
         provider: z.ZodEnum<["deepgram", "elevenlabs"]>;
@@ -6872,13 +6960,13 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     }, {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"realtime">;
         provider: z.ZodEnum<["openai", "google", "xai"]>;
@@ -6891,12 +6979,12 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
         options: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, "strip", z.ZodTypeAny, {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     }, {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     }>]>;
     stt: z.ZodOptional<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"inference">;
@@ -6915,15 +7003,15 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
          */
         options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     }, {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"plugin">;
         provider: z.ZodEnum<["deepgram", "elevenlabs"]>;
@@ -6938,13 +7026,13 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     }, {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"realtime">;
         provider: z.ZodEnum<["openai", "google", "xai"]>;
@@ -6957,12 +7045,12 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
         options: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, "strip", z.ZodTypeAny, {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     }, {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     }>]>>;
     tts: z.ZodOptional<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"inference">;
@@ -6981,15 +7069,15 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
          */
         options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     }, {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"plugin">;
         provider: z.ZodEnum<["deepgram", "elevenlabs"]>;
@@ -7004,13 +7092,13 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     }, {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"realtime">;
         provider: z.ZodEnum<["openai", "google", "xai"]>;
@@ -7023,12 +7111,12 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
         options: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, "strip", z.ZodTypeAny, {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     }, {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     }>]>>;
     vad: z.ZodOptional<z.ZodString>;
     vadOptions: z.ZodOptional<z.ZodObject<{
@@ -7187,52 +7275,52 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     excludeTools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     llm: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     };
     name?: string | undefined;
     vad?: string | undefined;
     stt?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     volume?: number | undefined;
     tts?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     vadOptions?: {
         minSpeechDuration?: number | undefined;
@@ -7281,52 +7369,52 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     excludeTools?: string[] | undefined;
 }, {
     llm: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     };
     name?: string | undefined;
     vad?: string | undefined;
     stt?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     volume?: number | undefined;
     tts?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     vadOptions?: {
         minSpeechDuration?: number | undefined;
@@ -7375,52 +7463,52 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     excludeTools?: string[] | undefined;
 }>, {
     llm: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     };
     name?: string | undefined;
     vad?: string | undefined;
     stt?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     volume?: number | undefined;
     tts?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     vadOptions?: {
         minSpeechDuration?: number | undefined;
@@ -7469,52 +7557,52 @@ declare const LuaVoiceConfigSchema: z.ZodEffects<z.ZodObject<{
     excludeTools?: string[] | undefined;
 }, {
     llm: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     };
     name?: string | undefined;
     vad?: string | undefined;
     stt?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     volume?: number | undefined;
     tts?: {
-        model: string;
         kind: "inference";
-        voice?: string | undefined;
+        model: string;
         options?: Record<string, unknown> | undefined;
+        voice?: string | undefined;
     } | {
         class: "LLM" | "STT" | "STTv2" | "TTS";
         options: Record<string, unknown>;
-        provider: "deepgram" | "elevenlabs";
         kind: "plugin";
+        provider: "deepgram" | "elevenlabs";
     } | {
         options: Record<string, unknown>;
-        provider: "openai" | "google" | "xai";
         kind: "realtime";
+        provider: "openai" | "google" | "xai";
     } | undefined;
     vadOptions?: {
         minSpeechDuration?: number | undefined;
@@ -7608,6 +7696,7 @@ export declare class LuaVoiceTool<TInput extends ZodType = ZodType> implements L
     readonly inputSchema: TInput;
     readonly execute: (input: any, ctx?: LuaVoiceToolCtx) => Promise<any>;
     readonly condition?: () => Promise<boolean>;
+    readonly label?: ToolLabel;
     readonly voice?: {
         flags?: ToolFlag[];
     };
@@ -7626,6 +7715,8 @@ export declare interface LuaVoiceToolConfig<TInput extends ZodType = ZodType> {
     execute: (input: any, ctx?: LuaVoiceToolCtx) => Promise<any>;
     condition?: () => Promise<boolean>;
     flags?: ToolFlag[];
+    /** What a step shows while the tool runs and when it is done, as on `LuaTool`. */
+    label?: ToolLabel;
 }
 
 /**
@@ -9369,6 +9460,22 @@ export declare interface RefusedAnswer {
 
 export declare type ReplyChannel = 'whatsapp' | 'sms' | 'email' | 'webchat' | 'slack';
 
+/**
+ * Reply versions on a stored conversation. A version is a block: one user row and the
+ * rows after it up to the next user row. A re-run of the latest turn hides the current
+ * block (`metadata.inactiveVersion`) and stamps `metadata.replyVersion` on the user row
+ * of every block of the turn. Readers fold rich parts first, then call
+ * `applyReplyVersions`, so a hidden reply's citations leave with it.
+ */
+declare interface ReplyVersionInfo {
+    group: string;
+    /** 1-based. */
+    index: number;
+    total: number;
+    /** The version the agent reads; the others are hidden from it. */
+    active: boolean;
+}
+
 declare interface RequestCredential {
     readonly descriptor: RequestCredentialDescriptor;
     bearer(): Promise<string>;
@@ -10644,6 +10751,12 @@ export declare enum ToolFlag {
     DISALLOW_INTERRUPTION = "disallow_interruption"
 }
 
+/** A tool's `label`: one text for both moments, or one while it runs and one when it is done. `{arg}` fills from the call. */
+declare type ToolLabel = string | {
+    running: string;
+    done: string;
+};
+
 export declare interface ToolStepOptions {
     input?: LuaMapConfig;
     timeoutSeconds?: number;
@@ -11251,6 +11364,9 @@ export declare interface WebhookRequest {
     payload: any;
 }
 
+/** LUA-1353 — see {@link WebRouteAuth.accessLevel}. */
+declare type WebRouteAccessLevel = 'full' | 'view_only';
+
 /** The app the handler belongs to, for `ctx.app` and log correlation. */
 declare interface WebRouteApp {
     id: string;
@@ -11281,6 +11397,14 @@ declare interface WebRouteAuth {
     email?: string;
     /** ISO timestamp the session token expires at, when known. */
     expiresAt?: string;
+    /**
+     * LUA-1353 — how much of the app the caller may use. `full`: they can read the app's agent (every route, the
+     * agent pane). `view_only`: the app was shared with them, or is org-wide in their workspace, without access to
+     * the agent — only `GET` routes reach a handler, `roles` and `scopes` are empty, and the agent pane is off. A
+     * `GET` handler must therefore never change anything. Absent only from a gateway older than LUA-1353 (read it
+     * as `full`).
+     */
+    accessLevel?: WebRouteAccessLevel;
 }
 
 declare type WebRouteMethod = (typeof WEB_ROUTE_METHODS)[number];