Pulumi ESC environment discovery, definitions, revisions, referrers, tags, providers, rotators, and read/open/decrypt result retrieval. This leaf carries 33 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.