@ax-hub/sdk 0.1.0 → 0.2.0

package/dist/index.d.cts

@@ -404,7 +404,8 @@ interface EmitAuditEventInput {
 interface IntegrityCheckResult {
     ok: boolean;
     checked: number;
-    brokenAt?: string;
+    firstBadSeq?: number;
+    reason?: string;
 }
 interface AnonymizeInput {
     subjectId?: string;
@@ -453,6 +454,13 @@ declare class AuditServerForTenantClient {
     private readonly http;
     private readonly tenantSlug;
     constructor(http: HttpClient, tenantSlug: string);
+    /**
+     * Emit a server-side audit event.
+     *
+     * @remarks The backend route `POST /audit-events/server` is not yet
+     * implemented (currently 404). Retained ahead of backend support — see
+     * ADR-0040. Do not rely on this in production until the route ships.
+     */
     emit(input: EmitAuditEventInput, opts?: RequestOptions): Promise<AuditEvent>;
 }
 
@@ -508,7 +516,7 @@ declare class Crud<T extends {
     private readonly http;
     private readonly base;
     constructor(http: HttpClient, base: string);
-    list(opts?: PageRequestOptions): Promise<PaginatedList<T>>;
+    list(opts?: RequestOptions): Promise<T[]>;
     get(id: string, opts?: RequestOptions): Promise<T>;
     create(input: Record<string, unknown>, opts?: RequestOptions): Promise<T>;
     update(id: string, patch: Record<string, unknown>, opts?: RequestOptions): Promise<T>;
@@ -567,6 +575,7 @@ interface BulkInviteResult {
     rejected: Array<{
         email: string;
         reason: string;
+        message?: string;
     }>;
 }
 interface EmailDomain {
@@ -613,9 +622,9 @@ declare class TenantMembersForTenantClient {
     list(opts?: PageRequestOptions): Promise<PaginatedList<TenantMember>>;
     update(membershipId: string, patch: {
         role?: string;
-    }, opts?: RequestOptions): Promise<TenantMember>;
-    deactivate(membershipId: string, opts?: RequestOptions): Promise<TenantMember>;
-    reactivate(membershipId: string, opts?: RequestOptions): Promise<TenantMember>;
+    }, opts?: RequestOptions): Promise<void>;
+    deactivate(membershipId: string, opts?: RequestOptions): Promise<void>;
+    reactivate(membershipId: string, opts?: RequestOptions): Promise<void>;
 }
 declare class TenantInvitationsClient {
     private readonly http;
@@ -851,11 +860,13 @@ declare class AppsCrudMixin {
     signIconDarkUploadURL(appId: string, input: SignIconUploadInput): Promise<SignIconUploadResult>;
     private signIconImpl;
     /**
-     * List apps the caller has been granted access to (not necessarily owned).
-     * Useful for "apps in my dashboard" type views.
+     * List the caller's workspace apps — owned plus apps they've been granted
+     * access to (not necessarily owned). Useful for "apps in my dashboard" views.
      *
-     * Backend route is `/api/v1/users/me/apps` — surfaced here under `sdk.apps`
-     * to avoid a `sdk.users.*` namespace just for this one method (eng review #3).
+     * Backend route is `/api/v1/me/apps/workspace`, which returns plain
+     * `appResponse` rows. (The legacy `/users/me/apps` route returns access
+     * records with a different shape, so it is not used here.) Surfaced under
+     * `sdk.apps` to avoid a `sdk.users.*` namespace for one method (eng review #3).
      *
      * @example happy
      *   const mine = await sdk.apps.listMine()
@@ -1767,68 +1778,45 @@ declare class AppScopedTablesClient {
     inspect(tableName: string, opts?: RequestOptions): Promise<unknown>;
 }
 
-interface ParsedFrame {
-    id?: string;
-    event?: string;
-    data: string;
-}
-type StreamItem<T> = {
-    type: 'item';
-    value: T;
-    id: string | undefined;
-} | {
-    type: 'gap';
-    sinceId: string | undefined;
-    missingCount?: number;
-} | {
-    type: 'decode-skip';
-    frame: ParsedFrame;
-    error: AxHubError;
-};
-interface SSEStream<T> extends AsyncIterable<StreamItem<T>> {
-    dispose(): void;
+type DeploymentStatus = 'pending' | 'building' | 'pushing' | 'deploying' | 'succeeded' | 'failed' | 'cancelled';
+interface DeploymentFailureReason {
+    stage: string;
+    code: string;
+    category: string;
+    message: string;
 }
-
-type DeploymentStatus = 'queued' | 'building' | 'deploying' | 'succeeded' | 'failed' | 'cancelled' | 'rolled_back';
 interface DeploymentResponse {
     id: string;
     appId: string;
+    commitSha: string;
     status: DeploymentStatus;
+    /** Stage in progress (building/pushing/deploying); null once terminal. */
+    currentStage: string | null;
+    /** Pushed image path; null before the build completes. */
+    imageUri: string | null;
     triggerSource: string;
     startedAt: string | null;
     completedAt: string | null;
-    url: string | null;
-    errorMessage: string | null;
-    createdAt: string;
-    updatedAt: string;
+    /** Populated only when status === 'failed'; null otherwise. */
+    failureReason: DeploymentFailureReason | null;
 }
 interface CreateDeploymentInput {
-    ref?: string;
-}
-interface BuildLogEvent {
-    ts: string;
-    line: string;
-}
-interface PodLogEvent {
-    ts: string;
-    line: string;
-}
-interface PodEventEvent {
-    type: 'Normal' | 'Warning';
-    reason: string;
-    message: string;
-    ts: string;
+    /** Specific git commit SHA (40-hex) to build. Omit to deploy the GitConnection default-branch HEAD. */
+    commitSha?: string;
+    /** Force a rebuild even if this commit already has a built image (dependency / base-image refresh). */
+    forceRebuild?: boolean;
 }
 declare class DeploymentsClient {
     private readonly http;
     constructor(http: HttpClient);
     /**
      * Trigger a new deployment. Returns immediately with the deployment row
-     * in `queued` or `building` state; use `streamBuildLogs` or polling
-     * `get()` to observe progression.
+     * in `pending` or `building` state; poll `get()` to observe progression.
      *
      * @example happy
-     *   const dep = await sdk.deployments.create('app_abc', { ref: 'main' })
+     *   const dep = await sdk.deployments.create('app_abc', { commitSha: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0' })
+     *   // or omit input entirely to deploy the default-branch HEAD:
+     *   const head = await sdk.deployments.create('app_abc')
      *
      * @example failure
      *   try { await sdk.deployments.create('app_abc') }
@@ -1851,7 +1839,7 @@ declare class DeploymentsClient {
      *
      * @example happy
      *   const dep = await sdk.deployments.get('app_abc', 'dep_123')
-     *   if (dep.status === 'succeeded') console.log(dep.url)
+     *   if (dep.status === 'succeeded') console.log(dep.imageUri)
      */
     get(appId: string, did: string): Promise<DeploymentResponse>;
     /**
@@ -1878,55 +1866,6 @@ declare class DeploymentsClient {
      *   }
      */
     rollback(appId: string, did: string): Promise<void>;
-    /**
-     * Stream Cloud Build log lines for a deployment via SSE. Returns an
-     * AsyncIterable that yields `{type:'item', value}`, `{type:'gap'}` (on
-     * reconnect when ring buffer rolled), or `{type:'decode-skip'}` (single
-     * malformed frame). Iterator completes when the deployment reaches a
-     * terminal state.
-     *
-     * @example happy
-     *   const ctrl = new AbortController()
-     *   for await (const ev of sdk.deployments.streamBuildLogs(appId, did, { signal: ctrl.signal })) {
-     *     if (ev.type === 'item') process.stdout.write(ev.value.line + '\n')
-     *   }
-     *
-     * @example failure
-     *   try {
-     *     for await (const _ of sdk.deployments.streamBuildLogs(appId, did)) {}
-     *   } catch (e) {
-     *     if (e instanceof StreamConsumedError) /* iterating twice — forbidden *\/
-     *   }
-     */
-    streamBuildLogs(appId: string, did: string, opts?: {
-        signal?: AbortSignal;
-    }): SSEStream<BuildLogEvent>;
-    /**
-     * Stream runtime pod stdout/stderr after deploy succeeds. Same iterator
-     * semantics as `streamBuildLogs`. Ring buffer cap = 200 most recent lines.
-     *
-     * @example happy
-     *   for await (const ev of sdk.deployments.streamPodLogs(appId, did)) {
-     *     if (ev.type === 'item') console.log(ev.value.line)
-     *   }
-     */
-    streamPodLogs(appId: string, did: string, opts?: {
-        signal?: AbortSignal;
-    }): SSEStream<PodLogEvent>;
-    /**
-     * Stream Kubernetes pod events (Normal / Warning — CrashLoopBackOff,
-     * OOMKilled, ImagePullBackOff, ...). Use for self-heal signal detection.
-     *
-     * @example happy
-     *   for await (const ev of sdk.deployments.streamPodEvents(appId, did)) {
-     *     if (ev.type === 'item' && ev.value.type === 'Warning') {
-     *       console.warn(ev.value.reason, ev.value.message)
-     *     }
-     *   }
-     */
-    streamPodEvents(appId: string, did: string, opts?: {
-        signal?: AbortSignal;
-    }): SSEStream<PodEventEvent>;
 }
 
 interface GatewayEngine {
@@ -2166,10 +2105,10 @@ declare function isAllowed(r: GatewayQueryResult | InvokeResult): boolean;
 /**
  * True when a deny is an SQL-format rejection the caller can fix by editing the SQL.
  *
- * Keys on the backend's `safesql:` deny_reason prefix (e.g. "safesql: only SELECT or WITH
- * allowed (got \"insert\")"). String-prefix matching is brittle by construction — the
- * backend wording may change. (The improvement spec's "SQL 형식 오류:" literal was inaccurate;
- * the real prefix is `safesql:`.)
+ * The live backend wraps these as `"SQL 형식 오류: safesql: only SELECT or WITH allowed
+ * (got \"delete\")"` — a Korean prefix plus the inner `safesql:` marker. Matches either so
+ * it survives wording shifts in the wrapper. String matching is brittle by construction;
+ * branch on this for UX hints only, not control flow that must be exact.
  */
 declare function isSqlFormatError(r: GatewayQueryResult | InvokeResult): boolean;
 /** True when a deny is a policy denial (not an SQL-format error). Editing SQL will not help. */
@@ -2358,9 +2297,14 @@ declare class IdentityProviderClient {
 declare class IdentitySystemOAuthClientsClient {
     private readonly http;
     constructor(http: HttpClient);
+    /**
+     * Fetch an OAuth client by ID. This is the only global OAuth-client route on
+     * the backend (`GET /oauth-clients/{clientID}`). To **create** an OAuth
+     * client, use the app-scoped `sdk.apps.oauthClients.create(appId, …)` — the
+     * backend only exposes creation under `POST /apps/{appID}/oauth-clients/`.
+     * There is no global create/delete route.
+     */
     get(clientId: string, opts?: RequestOptions): Promise<SystemOAuthClient>;
-    create(input: Record<string, unknown>, opts?: RequestOptions): Promise<SystemOAuthClient>;
-    delete(clientId: string, opts?: RequestOptions): Promise<void>;
 }
 
 interface SettlePublicationInput {
@@ -2563,6 +2507,28 @@ declare class NoAuth implements AuthProvider {
     onUnauthorized(): Promise<boolean>;
 }
 
+interface ParsedFrame {
+    id?: string;
+    event?: string;
+    data: string;
+}
+type StreamItem<T> = {
+    type: 'item';
+    value: T;
+    id: string | undefined;
+} | {
+    type: 'gap';
+    sinceId: string | undefined;
+    missingCount?: number;
+} | {
+    type: 'decode-skip';
+    frame: ParsedFrame;
+    error: AxHubError;
+};
+interface SSEStream<T> extends AsyncIterable<StreamItem<T>> {
+    dispose(): void;
+}
+
 type WebhookVerifyReason = 'signature_mismatch' | 'timestamp_skew' | 'malformed_signature' | 'missing_secret' | 'replay';
 interface VerifyWebhookInput {
     rawBody: Buffer | Uint8Array | string;
@@ -2580,4 +2546,4 @@ interface VerifyWebhookResult {
 declare function signWebhook(rawBody: Buffer | Uint8Array | string, secret: string, timestamp?: string): string;
 declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
 
-export { AbortError, AccessDeniedError, type AddColumnInput, type AddCommentInput, type AddGrantInput, AlreadyAccessedError, AlreadyActiveError, AlreadyDeletedError, AlreadyInactiveError, AlreadyMemberError, AlreadyRevokedError, AlreadySettledError, type AnonymizeInput, type AppAccess, type AppCategory, type AppID, type AppId, type AppResponse, AppScopedClient, AppScopedDataClient, type AppSlug, type AppTable, type AppTemplate, AppUnavailableError, AppsClient, AuditClient, type AuditEvent, type AuditEventID, type AuthProvider, type AuthRing, AuthorizationPendingError, AuthzClient, type AuthzGrant, type AuthzSubject, type AuthzTag, AxHubClient, type AxHubClientOptions, AxHubError, type AxHubErrorInit, BadRequestError, type Branded, type BuildLogEvent, type BulkInviteResult, type CatalogAncestor, type CatalogConnector, type CatalogKind, type CatalogKindAction, type CatalogPermissionsReadDetail, type CatalogPermissionsReadList, type CatalogResourceDetail, type CatalogResourceFilter, type CatalogResourceView, type CatalogTag, type ColumnType, type Comment, ConfigurationError, ConflictError, type ConnectGitInput, type ConnectorID, type CreateAppInput, type CreateCategoryInput, type CreateDeploymentInput, type CreateOAuthClientInput, type CreateTableInput, type CreateTenantInput, type CursorDirection, DEFAULT_BASE_URL, type DataBulkResult, DataClient, type DataCountOptions, type DataGetOptions, type DataListOptions, type DataOrderBy, DataTableClient, type DataTableSchema, type DecideInput, type DecideResult, DecodeError, type DeploymentID, type DeploymentId, type DeploymentResponse, type DeploymentStatus, DeploymentsClient, type DeviceAuthorizationResponse, DeviceFlowDeniedError, DeviceFlowTimeoutError, type DiscoverAppsOptions, type DiscoverOptions, type DispatchContext, DomainTakenError, DuplicateError, type EmailDomain, type EmitAuditEventInput, EmptyError, type EnvVar, ExpiredTokenError, type FetchLike, type FieldError, ForbiddenError, GatewayCatalogClient, GatewayClient, type GatewayConnector, type GatewayEngine, type GatewayQueryColumn, type GatewayQueryInput, type GatewayQueryResult, type GatewayResource, type GitConnection, type GitConnectionSetup, type GitConnectionStatus, type GithubInstallStart, type GrantID, type GrantPrincipalType, type GrantScope, IdentityClient, IdentityDeviceCodeClient, IdentityMeClient, IdentityOAuthClient, IdentityOIDCClient, IdentityPATClient, type IdentityProvider, IdentityProviderClient, IdentitySystemOAuthClientsClient, type InferRow, type InstallStartInput, type IntegrityCheckResult, InternalServerError, IntrospectFailedError, InvalidCursorError, InvalidGrantError, InvalidPathError, InvalidStateTransitionError, InvalidValueError, InvitationExpiredError, type InviteTenantMemberInput, type InvokeInput, type InvokeResult, type IssuePersonalAccessTokenInput, type IssuePersonalAccessTokenResult, type KeysetCursor, LastAdminError, LegacyCursorError, type LikeResult, type LikeStatus, type ListAllItem, type ListAllOptions, type ListOptions, type Logger, type MeResponse, type MockClientOptions, type MockFixtures, MockInProductionError, type MockRow, type MockSchemas, MockStore, NetworkError, NoAuth, NotAdminError, NotAllowedError, NotDeletedError, NotFoundError, NotMemberError, type OAuthClient, type OAuthClientWithSecret, OAuthError, type OAuthErrorInit, type OAuthTokenResponse, type OrderByField, type PATID, type PATSummary, type PaginatedList, type ParsedFrame, type PatId, PendingExistsError, PermanentlyDeletedError, PermissionDeniedError, type PodEventEvent, type PodLogEvent, PoolStaleError, PreconditionFailedError, type PublicationRequest, type PublicationRequestStatus, PublicationRequestsClient, type QueryExpr, type RateLimitStrategy, RateLimitedError, type RequestId, RequiredError, type ResourceID, type RetryInfo, type SSEStream, ScanLimitExceededError, SchemaCache, type SchemaCacheOptions, SchemaNameTakenError, type SchemaShapeFromRow, type SelectColumns, type SettlePublicationInput, type SignIconUploadInput, type SignIconUploadResult, SlowDownError, SlugTakenError, StaticTokenAuth, StreamConsumedError, type StreamItem, type SubjectID, type SubmitPublicationInput, type SystemOAuthClient, type TableColumn, type TableConstraint, type TableGrant, type TableID, type TableIndex, TableNotFoundError, type TableSchema, type TagID, type Tenant, TenantGatewayClient, type TenantID, type TenantId, type TenantInvitation, type TenantMember, TenantScopedAppsClient, TenantScopedClient, type TenantSlug, TenantSlugRequiredError, TenantsClient, TimeoutError, TokenExpiredError, TokenInvalidError, TokenMissingError, type TokenType, UnauthenticatedError, UnavailableError, type UnlikeResult, type UnpublishInput, type UpdateAppInput, type UpdateGitConnectionInput, type UpdateTenantInput, type UserID, type UserId, ValidationError, type VerifyWebhookInput, type VerifyWebhookResult, WebhookVerificationError, type WebhookVerifyReason, and, asAppId, asAppSlug, asDeploymentId, asPatId, asRequestId, asTenantId, asTenantSlug, asUserId, assertMockModeAllowed, createMockStore, cursorFromRow, decodeCursor, defineSchema, dispatch, encodeCursor, escapeLike, formatErrorMessage, getAccessibleColumns, getMaskHint, id, isAllowed, isOAuthPath, isPolicyDeny, isSqlFormatError, not, or, orderByFingerprint, parseRetryAfter, raw, schemaCacheKey, signWebhook, tableFromPath, verifyWebhook, where };
+export { AbortError, AccessDeniedError, type AddColumnInput, type AddCommentInput, type AddGrantInput, AlreadyAccessedError, AlreadyActiveError, AlreadyDeletedError, AlreadyInactiveError, AlreadyMemberError, AlreadyRevokedError, AlreadySettledError, type AnonymizeInput, type AppAccess, type AppCategory, type AppID, type AppId, type AppResponse, AppScopedClient, AppScopedDataClient, type AppSlug, type AppTable, type AppTemplate, AppUnavailableError, AppsClient, AuditClient, type AuditEvent, type AuditEventID, type AuthProvider, type AuthRing, AuthorizationPendingError, AuthzClient, type AuthzGrant, type AuthzSubject, type AuthzTag, AxHubClient, type AxHubClientOptions, AxHubError, type AxHubErrorInit, BadRequestError, type Branded, type BulkInviteResult, type CatalogAncestor, type CatalogConnector, type CatalogKind, type CatalogKindAction, type CatalogPermissionsReadDetail, type CatalogPermissionsReadList, type CatalogResourceDetail, type CatalogResourceFilter, type CatalogResourceView, type CatalogTag, type ColumnType, type Comment, ConfigurationError, ConflictError, type ConnectGitInput, type ConnectorID, type CreateAppInput, type CreateCategoryInput, type CreateDeploymentInput, type CreateOAuthClientInput, type CreateTableInput, type CreateTenantInput, type CursorDirection, DEFAULT_BASE_URL, type DataBulkResult, DataClient, type DataCountOptions, type DataGetOptions, type DataListOptions, type DataOrderBy, DataTableClient, type DataTableSchema, type DecideInput, type DecideResult, DecodeError, type DeploymentFailureReason, type DeploymentID, type DeploymentId, type DeploymentResponse, type DeploymentStatus, DeploymentsClient, type DeviceAuthorizationResponse, DeviceFlowDeniedError, DeviceFlowTimeoutError, type DiscoverAppsOptions, type DiscoverOptions, type DispatchContext, DomainTakenError, DuplicateError, type EmailDomain, type EmitAuditEventInput, EmptyError, type EnvVar, ExpiredTokenError, type FetchLike, type FieldError, ForbiddenError, GatewayCatalogClient, GatewayClient, type GatewayConnector, type GatewayEngine, type GatewayQueryColumn, type GatewayQueryInput, type GatewayQueryResult, type GatewayResource, type GitConnection, type GitConnectionSetup, type GitConnectionStatus, type GithubInstallStart, type GrantID, type GrantPrincipalType, type GrantScope, IdentityClient, IdentityDeviceCodeClient, IdentityMeClient, IdentityOAuthClient, IdentityOIDCClient, IdentityPATClient, type IdentityProvider, IdentityProviderClient, IdentitySystemOAuthClientsClient, type InferRow, type InstallStartInput, type IntegrityCheckResult, InternalServerError, IntrospectFailedError, InvalidCursorError, InvalidGrantError, InvalidPathError, InvalidStateTransitionError, InvalidValueError, InvitationExpiredError, type InviteTenantMemberInput, type InvokeInput, type InvokeResult, type IssuePersonalAccessTokenInput, type IssuePersonalAccessTokenResult, type KeysetCursor, LastAdminError, LegacyCursorError, type LikeResult, type LikeStatus, type ListAllItem, type ListAllOptions, type ListOptions, type Logger, type MeResponse, type MockClientOptions, type MockFixtures, MockInProductionError, type MockRow, type MockSchemas, MockStore, NetworkError, NoAuth, NotAdminError, NotAllowedError, NotDeletedError, NotFoundError, NotMemberError, type OAuthClient, type OAuthClientWithSecret, OAuthError, type OAuthErrorInit, type OAuthTokenResponse, type OrderByField, type PATID, type PATSummary, type PaginatedList, type ParsedFrame, type PatId, PendingExistsError, PermanentlyDeletedError, PermissionDeniedError, PoolStaleError, PreconditionFailedError, type PublicationRequest, type PublicationRequestStatus, PublicationRequestsClient, type QueryExpr, type RateLimitStrategy, RateLimitedError, type RequestId, RequiredError, type ResourceID, type RetryInfo, type SSEStream, ScanLimitExceededError, SchemaCache, type SchemaCacheOptions, SchemaNameTakenError, type SchemaShapeFromRow, type SelectColumns, type SettlePublicationInput, type SignIconUploadInput, type SignIconUploadResult, SlowDownError, SlugTakenError, StaticTokenAuth, StreamConsumedError, type StreamItem, type SubjectID, type SubmitPublicationInput, type SystemOAuthClient, type TableColumn, type TableConstraint, type TableGrant, type TableID, type TableIndex, TableNotFoundError, type TableSchema, type TagID, type Tenant, TenantGatewayClient, type TenantID, type TenantId, type TenantInvitation, type TenantMember, TenantScopedAppsClient, TenantScopedClient, type TenantSlug, TenantSlugRequiredError, TenantsClient, TimeoutError, TokenExpiredError, TokenInvalidError, TokenMissingError, type TokenType, UnauthenticatedError, UnavailableError, type UnlikeResult, type UnpublishInput, type UpdateAppInput, type UpdateGitConnectionInput, type UpdateTenantInput, type UserID, type UserId, ValidationError, type VerifyWebhookInput, type VerifyWebhookResult, WebhookVerificationError, type WebhookVerifyReason, and, asAppId, asAppSlug, asDeploymentId, asPatId, asRequestId, asTenantId, asTenantSlug, asUserId, assertMockModeAllowed, createMockStore, cursorFromRow, decodeCursor, defineSchema, dispatch, encodeCursor, escapeLike, formatErrorMessage, getAccessibleColumns, getMaskHint, id, isAllowed, isOAuthPath, isPolicyDeny, isSqlFormatError, not, or, orderByFingerprint, parseRetryAfter, raw, schemaCacheKey, signWebhook, tableFromPath, verifyWebhook, where };

package/dist/index.d.ts

@@ -404,7 +404,8 @@ interface EmitAuditEventInput {
 interface IntegrityCheckResult {
     ok: boolean;
     checked: number;
-    brokenAt?: string;
+    firstBadSeq?: number;
+    reason?: string;
 }
 interface AnonymizeInput {
     subjectId?: string;
@@ -453,6 +454,13 @@ declare class AuditServerForTenantClient {
     private readonly http;
     private readonly tenantSlug;
     constructor(http: HttpClient, tenantSlug: string);
+    /**
+     * Emit a server-side audit event.
+     *
+     * @remarks The backend route `POST /audit-events/server` is not yet
+     * implemented (currently 404). Retained ahead of backend support — see
+     * ADR-0040. Do not rely on this in production until the route ships.
+     */
     emit(input: EmitAuditEventInput, opts?: RequestOptions): Promise<AuditEvent>;
 }
 
@@ -508,7 +516,7 @@ declare class Crud<T extends {
     private readonly http;
     private readonly base;
     constructor(http: HttpClient, base: string);
-    list(opts?: PageRequestOptions): Promise<PaginatedList<T>>;
+    list(opts?: RequestOptions): Promise<T[]>;
     get(id: string, opts?: RequestOptions): Promise<T>;
     create(input: Record<string, unknown>, opts?: RequestOptions): Promise<T>;
     update(id: string, patch: Record<string, unknown>, opts?: RequestOptions): Promise<T>;
@@ -567,6 +575,7 @@ interface BulkInviteResult {
     rejected: Array<{
         email: string;
         reason: string;
+        message?: string;
     }>;
 }
 interface EmailDomain {
@@ -613,9 +622,9 @@ declare class TenantMembersForTenantClient {
     list(opts?: PageRequestOptions): Promise<PaginatedList<TenantMember>>;
     update(membershipId: string, patch: {
         role?: string;
-    }, opts?: RequestOptions): Promise<TenantMember>;
-    deactivate(membershipId: string, opts?: RequestOptions): Promise<TenantMember>;
-    reactivate(membershipId: string, opts?: RequestOptions): Promise<TenantMember>;
+    }, opts?: RequestOptions): Promise<void>;
+    deactivate(membershipId: string, opts?: RequestOptions): Promise<void>;
+    reactivate(membershipId: string, opts?: RequestOptions): Promise<void>;
 }
 declare class TenantInvitationsClient {
     private readonly http;
@@ -851,11 +860,13 @@ declare class AppsCrudMixin {
     signIconDarkUploadURL(appId: string, input: SignIconUploadInput): Promise<SignIconUploadResult>;
     private signIconImpl;
     /**
-     * List apps the caller has been granted access to (not necessarily owned).
-     * Useful for "apps in my dashboard" type views.
+     * List the caller's workspace apps — owned plus apps they've been granted
+     * access to (not necessarily owned). Useful for "apps in my dashboard" views.
      *
-     * Backend route is `/api/v1/users/me/apps` — surfaced here under `sdk.apps`
-     * to avoid a `sdk.users.*` namespace just for this one method (eng review #3).
+     * Backend route is `/api/v1/me/apps/workspace`, which returns plain
+     * `appResponse` rows. (The legacy `/users/me/apps` route returns access
+     * records with a different shape, so it is not used here.) Surfaced under
+     * `sdk.apps` to avoid a `sdk.users.*` namespace for one method (eng review #3).
      *
      * @example happy
      *   const mine = await sdk.apps.listMine()
@@ -1767,68 +1778,45 @@ declare class AppScopedTablesClient {
     inspect(tableName: string, opts?: RequestOptions): Promise<unknown>;
 }
 
-interface ParsedFrame {
-    id?: string;
-    event?: string;
-    data: string;
-}
-type StreamItem<T> = {
-    type: 'item';
-    value: T;
-    id: string | undefined;
-} | {
-    type: 'gap';
-    sinceId: string | undefined;
-    missingCount?: number;
-} | {
-    type: 'decode-skip';
-    frame: ParsedFrame;
-    error: AxHubError;
-};
-interface SSEStream<T> extends AsyncIterable<StreamItem<T>> {
-    dispose(): void;
+type DeploymentStatus = 'pending' | 'building' | 'pushing' | 'deploying' | 'succeeded' | 'failed' | 'cancelled';
+interface DeploymentFailureReason {
+    stage: string;
+    code: string;
+    category: string;
+    message: string;
 }
-
-type DeploymentStatus = 'queued' | 'building' | 'deploying' | 'succeeded' | 'failed' | 'cancelled' | 'rolled_back';
 interface DeploymentResponse {
     id: string;
     appId: string;
+    commitSha: string;
     status: DeploymentStatus;
+    /** Stage in progress (building/pushing/deploying); null once terminal. */
+    currentStage: string | null;
+    /** Pushed image path; null before the build completes. */
+    imageUri: string | null;
     triggerSource: string;
     startedAt: string | null;
     completedAt: string | null;
-    url: string | null;
-    errorMessage: string | null;
-    createdAt: string;
-    updatedAt: string;
+    /** Populated only when status === 'failed'; null otherwise. */
+    failureReason: DeploymentFailureReason | null;
 }
 interface CreateDeploymentInput {
-    ref?: string;
-}
-interface BuildLogEvent {
-    ts: string;
-    line: string;
-}
-interface PodLogEvent {
-    ts: string;
-    line: string;
-}
-interface PodEventEvent {
-    type: 'Normal' | 'Warning';
-    reason: string;
-    message: string;
-    ts: string;
+    /** Specific git commit SHA (40-hex) to build. Omit to deploy the GitConnection default-branch HEAD. */
+    commitSha?: string;
+    /** Force a rebuild even if this commit already has a built image (dependency / base-image refresh). */
+    forceRebuild?: boolean;
 }
 declare class DeploymentsClient {
     private readonly http;
     constructor(http: HttpClient);
     /**
      * Trigger a new deployment. Returns immediately with the deployment row
-     * in `queued` or `building` state; use `streamBuildLogs` or polling
-     * `get()` to observe progression.
+     * in `pending` or `building` state; poll `get()` to observe progression.
      *
      * @example happy
-     *   const dep = await sdk.deployments.create('app_abc', { ref: 'main' })
+     *   const dep = await sdk.deployments.create('app_abc', { commitSha: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0' })
+     *   // or omit input entirely to deploy the default-branch HEAD:
+     *   const head = await sdk.deployments.create('app_abc')
      *
      * @example failure
      *   try { await sdk.deployments.create('app_abc') }
@@ -1851,7 +1839,7 @@ declare class DeploymentsClient {
      *
      * @example happy
      *   const dep = await sdk.deployments.get('app_abc', 'dep_123')
-     *   if (dep.status === 'succeeded') console.log(dep.url)
+     *   if (dep.status === 'succeeded') console.log(dep.imageUri)
      */
     get(appId: string, did: string): Promise<DeploymentResponse>;
     /**
@@ -1878,55 +1866,6 @@ declare class DeploymentsClient {
      *   }
      */
     rollback(appId: string, did: string): Promise<void>;
-    /**
-     * Stream Cloud Build log lines for a deployment via SSE. Returns an
-     * AsyncIterable that yields `{type:'item', value}`, `{type:'gap'}` (on
-     * reconnect when ring buffer rolled), or `{type:'decode-skip'}` (single
-     * malformed frame). Iterator completes when the deployment reaches a
-     * terminal state.
-     *
-     * @example happy
-     *   const ctrl = new AbortController()
-     *   for await (const ev of sdk.deployments.streamBuildLogs(appId, did, { signal: ctrl.signal })) {
-     *     if (ev.type === 'item') process.stdout.write(ev.value.line + '\n')
-     *   }
-     *
-     * @example failure
-     *   try {
-     *     for await (const _ of sdk.deployments.streamBuildLogs(appId, did)) {}
-     *   } catch (e) {
-     *     if (e instanceof StreamConsumedError) /* iterating twice — forbidden *\/
-     *   }
-     */
-    streamBuildLogs(appId: string, did: string, opts?: {
-        signal?: AbortSignal;
-    }): SSEStream<BuildLogEvent>;
-    /**
-     * Stream runtime pod stdout/stderr after deploy succeeds. Same iterator
-     * semantics as `streamBuildLogs`. Ring buffer cap = 200 most recent lines.
-     *
-     * @example happy
-     *   for await (const ev of sdk.deployments.streamPodLogs(appId, did)) {
-     *     if (ev.type === 'item') console.log(ev.value.line)
-     *   }
-     */
-    streamPodLogs(appId: string, did: string, opts?: {
-        signal?: AbortSignal;
-    }): SSEStream<PodLogEvent>;
-    /**
-     * Stream Kubernetes pod events (Normal / Warning — CrashLoopBackOff,
-     * OOMKilled, ImagePullBackOff, ...). Use for self-heal signal detection.
-     *
-     * @example happy
-     *   for await (const ev of sdk.deployments.streamPodEvents(appId, did)) {
-     *     if (ev.type === 'item' && ev.value.type === 'Warning') {
-     *       console.warn(ev.value.reason, ev.value.message)
-     *     }
-     *   }
-     */
-    streamPodEvents(appId: string, did: string, opts?: {
-        signal?: AbortSignal;
-    }): SSEStream<PodEventEvent>;
 }
 
 interface GatewayEngine {
@@ -2166,10 +2105,10 @@ declare function isAllowed(r: GatewayQueryResult | InvokeResult): boolean;
 /**
  * True when a deny is an SQL-format rejection the caller can fix by editing the SQL.
  *
- * Keys on the backend's `safesql:` deny_reason prefix (e.g. "safesql: only SELECT or WITH
- * allowed (got \"insert\")"). String-prefix matching is brittle by construction — the
- * backend wording may change. (The improvement spec's "SQL 형식 오류:" literal was inaccurate;
- * the real prefix is `safesql:`.)
+ * The live backend wraps these as `"SQL 형식 오류: safesql: only SELECT or WITH allowed
+ * (got \"delete\")"` — a Korean prefix plus the inner `safesql:` marker. Matches either so
+ * it survives wording shifts in the wrapper. String matching is brittle by construction;
+ * branch on this for UX hints only, not control flow that must be exact.
  */
 declare function isSqlFormatError(r: GatewayQueryResult | InvokeResult): boolean;
 /** True when a deny is a policy denial (not an SQL-format error). Editing SQL will not help. */
@@ -2358,9 +2297,14 @@ declare class IdentityProviderClient {
 declare class IdentitySystemOAuthClientsClient {
     private readonly http;
     constructor(http: HttpClient);
+    /**
+     * Fetch an OAuth client by ID. This is the only global OAuth-client route on
+     * the backend (`GET /oauth-clients/{clientID}`). To **create** an OAuth
+     * client, use the app-scoped `sdk.apps.oauthClients.create(appId, …)` — the
+     * backend only exposes creation under `POST /apps/{appID}/oauth-clients/`.
+     * There is no global create/delete route.
+     */
     get(clientId: string, opts?: RequestOptions): Promise<SystemOAuthClient>;
-    create(input: Record<string, unknown>, opts?: RequestOptions): Promise<SystemOAuthClient>;
-    delete(clientId: string, opts?: RequestOptions): Promise<void>;
 }
 
 interface SettlePublicationInput {
@@ -2563,6 +2507,28 @@ declare class NoAuth implements AuthProvider {
     onUnauthorized(): Promise<boolean>;
 }
 
+interface ParsedFrame {
+    id?: string;
+    event?: string;
+    data: string;
+}
+type StreamItem<T> = {
+    type: 'item';
+    value: T;
+    id: string | undefined;
+} | {
+    type: 'gap';
+    sinceId: string | undefined;
+    missingCount?: number;
+} | {
+    type: 'decode-skip';
+    frame: ParsedFrame;
+    error: AxHubError;
+};
+interface SSEStream<T> extends AsyncIterable<StreamItem<T>> {
+    dispose(): void;
+}
+
 type WebhookVerifyReason = 'signature_mismatch' | 'timestamp_skew' | 'malformed_signature' | 'missing_secret' | 'replay';
 interface VerifyWebhookInput {
     rawBody: Buffer | Uint8Array | string;
@@ -2580,4 +2546,4 @@ interface VerifyWebhookResult {
 declare function signWebhook(rawBody: Buffer | Uint8Array | string, secret: string, timestamp?: string): string;
 declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
 
-export { AbortError, AccessDeniedError, type AddColumnInput, type AddCommentInput, type AddGrantInput, AlreadyAccessedError, AlreadyActiveError, AlreadyDeletedError, AlreadyInactiveError, AlreadyMemberError, AlreadyRevokedError, AlreadySettledError, type AnonymizeInput, type AppAccess, type AppCategory, type AppID, type AppId, type AppResponse, AppScopedClient, AppScopedDataClient, type AppSlug, type AppTable, type AppTemplate, AppUnavailableError, AppsClient, AuditClient, type AuditEvent, type AuditEventID, type AuthProvider, type AuthRing, AuthorizationPendingError, AuthzClient, type AuthzGrant, type AuthzSubject, type AuthzTag, AxHubClient, type AxHubClientOptions, AxHubError, type AxHubErrorInit, BadRequestError, type Branded, type BuildLogEvent, type BulkInviteResult, type CatalogAncestor, type CatalogConnector, type CatalogKind, type CatalogKindAction, type CatalogPermissionsReadDetail, type CatalogPermissionsReadList, type CatalogResourceDetail, type CatalogResourceFilter, type CatalogResourceView, type CatalogTag, type ColumnType, type Comment, ConfigurationError, ConflictError, type ConnectGitInput, type ConnectorID, type CreateAppInput, type CreateCategoryInput, type CreateDeploymentInput, type CreateOAuthClientInput, type CreateTableInput, type CreateTenantInput, type CursorDirection, DEFAULT_BASE_URL, type DataBulkResult, DataClient, type DataCountOptions, type DataGetOptions, type DataListOptions, type DataOrderBy, DataTableClient, type DataTableSchema, type DecideInput, type DecideResult, DecodeError, type DeploymentID, type DeploymentId, type DeploymentResponse, type DeploymentStatus, DeploymentsClient, type DeviceAuthorizationResponse, DeviceFlowDeniedError, DeviceFlowTimeoutError, type DiscoverAppsOptions, type DiscoverOptions, type DispatchContext, DomainTakenError, DuplicateError, type EmailDomain, type EmitAuditEventInput, EmptyError, type EnvVar, ExpiredTokenError, type FetchLike, type FieldError, ForbiddenError, GatewayCatalogClient, GatewayClient, type GatewayConnector, type GatewayEngine, type GatewayQueryColumn, type GatewayQueryInput, type GatewayQueryResult, type GatewayResource, type GitConnection, type GitConnectionSetup, type GitConnectionStatus, type GithubInstallStart, type GrantID, type GrantPrincipalType, type GrantScope, IdentityClient, IdentityDeviceCodeClient, IdentityMeClient, IdentityOAuthClient, IdentityOIDCClient, IdentityPATClient, type IdentityProvider, IdentityProviderClient, IdentitySystemOAuthClientsClient, type InferRow, type InstallStartInput, type IntegrityCheckResult, InternalServerError, IntrospectFailedError, InvalidCursorError, InvalidGrantError, InvalidPathError, InvalidStateTransitionError, InvalidValueError, InvitationExpiredError, type InviteTenantMemberInput, type InvokeInput, type InvokeResult, type IssuePersonalAccessTokenInput, type IssuePersonalAccessTokenResult, type KeysetCursor, LastAdminError, LegacyCursorError, type LikeResult, type LikeStatus, type ListAllItem, type ListAllOptions, type ListOptions, type Logger, type MeResponse, type MockClientOptions, type MockFixtures, MockInProductionError, type MockRow, type MockSchemas, MockStore, NetworkError, NoAuth, NotAdminError, NotAllowedError, NotDeletedError, NotFoundError, NotMemberError, type OAuthClient, type OAuthClientWithSecret, OAuthError, type OAuthErrorInit, type OAuthTokenResponse, type OrderByField, type PATID, type PATSummary, type PaginatedList, type ParsedFrame, type PatId, PendingExistsError, PermanentlyDeletedError, PermissionDeniedError, type PodEventEvent, type PodLogEvent, PoolStaleError, PreconditionFailedError, type PublicationRequest, type PublicationRequestStatus, PublicationRequestsClient, type QueryExpr, type RateLimitStrategy, RateLimitedError, type RequestId, RequiredError, type ResourceID, type RetryInfo, type SSEStream, ScanLimitExceededError, SchemaCache, type SchemaCacheOptions, SchemaNameTakenError, type SchemaShapeFromRow, type SelectColumns, type SettlePublicationInput, type SignIconUploadInput, type SignIconUploadResult, SlowDownError, SlugTakenError, StaticTokenAuth, StreamConsumedError, type StreamItem, type SubjectID, type SubmitPublicationInput, type SystemOAuthClient, type TableColumn, type TableConstraint, type TableGrant, type TableID, type TableIndex, TableNotFoundError, type TableSchema, type TagID, type Tenant, TenantGatewayClient, type TenantID, type TenantId, type TenantInvitation, type TenantMember, TenantScopedAppsClient, TenantScopedClient, type TenantSlug, TenantSlugRequiredError, TenantsClient, TimeoutError, TokenExpiredError, TokenInvalidError, TokenMissingError, type TokenType, UnauthenticatedError, UnavailableError, type UnlikeResult, type UnpublishInput, type UpdateAppInput, type UpdateGitConnectionInput, type UpdateTenantInput, type UserID, type UserId, ValidationError, type VerifyWebhookInput, type VerifyWebhookResult, WebhookVerificationError, type WebhookVerifyReason, and, asAppId, asAppSlug, asDeploymentId, asPatId, asRequestId, asTenantId, asTenantSlug, asUserId, assertMockModeAllowed, createMockStore, cursorFromRow, decodeCursor, defineSchema, dispatch, encodeCursor, escapeLike, formatErrorMessage, getAccessibleColumns, getMaskHint, id, isAllowed, isOAuthPath, isPolicyDeny, isSqlFormatError, not, or, orderByFingerprint, parseRetryAfter, raw, schemaCacheKey, signWebhook, tableFromPath, verifyWebhook, where };
+export { AbortError, AccessDeniedError, type AddColumnInput, type AddCommentInput, type AddGrantInput, AlreadyAccessedError, AlreadyActiveError, AlreadyDeletedError, AlreadyInactiveError, AlreadyMemberError, AlreadyRevokedError, AlreadySettledError, type AnonymizeInput, type AppAccess, type AppCategory, type AppID, type AppId, type AppResponse, AppScopedClient, AppScopedDataClient, type AppSlug, type AppTable, type AppTemplate, AppUnavailableError, AppsClient, AuditClient, type AuditEvent, type AuditEventID, type AuthProvider, type AuthRing, AuthorizationPendingError, AuthzClient, type AuthzGrant, type AuthzSubject, type AuthzTag, AxHubClient, type AxHubClientOptions, AxHubError, type AxHubErrorInit, BadRequestError, type Branded, type BulkInviteResult, type CatalogAncestor, type CatalogConnector, type CatalogKind, type CatalogKindAction, type CatalogPermissionsReadDetail, type CatalogPermissionsReadList, type CatalogResourceDetail, type CatalogResourceFilter, type CatalogResourceView, type CatalogTag, type ColumnType, type Comment, ConfigurationError, ConflictError, type ConnectGitInput, type ConnectorID, type CreateAppInput, type CreateCategoryInput, type CreateDeploymentInput, type CreateOAuthClientInput, type CreateTableInput, type CreateTenantInput, type CursorDirection, DEFAULT_BASE_URL, type DataBulkResult, DataClient, type DataCountOptions, type DataGetOptions, type DataListOptions, type DataOrderBy, DataTableClient, type DataTableSchema, type DecideInput, type DecideResult, DecodeError, type DeploymentFailureReason, type DeploymentID, type DeploymentId, type DeploymentResponse, type DeploymentStatus, DeploymentsClient, type DeviceAuthorizationResponse, DeviceFlowDeniedError, DeviceFlowTimeoutError, type DiscoverAppsOptions, type DiscoverOptions, type DispatchContext, DomainTakenError, DuplicateError, type EmailDomain, type EmitAuditEventInput, EmptyError, type EnvVar, ExpiredTokenError, type FetchLike, type FieldError, ForbiddenError, GatewayCatalogClient, GatewayClient, type GatewayConnector, type GatewayEngine, type GatewayQueryColumn, type GatewayQueryInput, type GatewayQueryResult, type GatewayResource, type GitConnection, type GitConnectionSetup, type GitConnectionStatus, type GithubInstallStart, type GrantID, type GrantPrincipalType, type GrantScope, IdentityClient, IdentityDeviceCodeClient, IdentityMeClient, IdentityOAuthClient, IdentityOIDCClient, IdentityPATClient, type IdentityProvider, IdentityProviderClient, IdentitySystemOAuthClientsClient, type InferRow, type InstallStartInput, type IntegrityCheckResult, InternalServerError, IntrospectFailedError, InvalidCursorError, InvalidGrantError, InvalidPathError, InvalidStateTransitionError, InvalidValueError, InvitationExpiredError, type InviteTenantMemberInput, type InvokeInput, type InvokeResult, type IssuePersonalAccessTokenInput, type IssuePersonalAccessTokenResult, type KeysetCursor, LastAdminError, LegacyCursorError, type LikeResult, type LikeStatus, type ListAllItem, type ListAllOptions, type ListOptions, type Logger, type MeResponse, type MockClientOptions, type MockFixtures, MockInProductionError, type MockRow, type MockSchemas, MockStore, NetworkError, NoAuth, NotAdminError, NotAllowedError, NotDeletedError, NotFoundError, NotMemberError, type OAuthClient, type OAuthClientWithSecret, OAuthError, type OAuthErrorInit, type OAuthTokenResponse, type OrderByField, type PATID, type PATSummary, type PaginatedList, type ParsedFrame, type PatId, PendingExistsError, PermanentlyDeletedError, PermissionDeniedError, PoolStaleError, PreconditionFailedError, type PublicationRequest, type PublicationRequestStatus, PublicationRequestsClient, type QueryExpr, type RateLimitStrategy, RateLimitedError, type RequestId, RequiredError, type ResourceID, type RetryInfo, type SSEStream, ScanLimitExceededError, SchemaCache, type SchemaCacheOptions, SchemaNameTakenError, type SchemaShapeFromRow, type SelectColumns, type SettlePublicationInput, type SignIconUploadInput, type SignIconUploadResult, SlowDownError, SlugTakenError, StaticTokenAuth, StreamConsumedError, type StreamItem, type SubjectID, type SubmitPublicationInput, type SystemOAuthClient, type TableColumn, type TableConstraint, type TableGrant, type TableID, type TableIndex, TableNotFoundError, type TableSchema, type TagID, type Tenant, TenantGatewayClient, type TenantID, type TenantId, type TenantInvitation, type TenantMember, TenantScopedAppsClient, TenantScopedClient, type TenantSlug, TenantSlugRequiredError, TenantsClient, TimeoutError, TokenExpiredError, TokenInvalidError, TokenMissingError, type TokenType, UnauthenticatedError, UnavailableError, type UnlikeResult, type UnpublishInput, type UpdateAppInput, type UpdateGitConnectionInput, type UpdateTenantInput, type UserID, type UserId, ValidationError, type VerifyWebhookInput, type VerifyWebhookResult, WebhookVerificationError, type WebhookVerifyReason, and, asAppId, asAppSlug, asDeploymentId, asPatId, asRequestId, asTenantId, asTenantSlug, asUserId, assertMockModeAllowed, createMockStore, cursorFromRow, decodeCursor, defineSchema, dispatch, encodeCursor, escapeLike, formatErrorMessage, getAccessibleColumns, getMaskHint, id, isAllowed, isOAuthPath, isPolicyDeny, isSqlFormatError, not, or, orderByFingerprint, parseRetryAfter, raw, schemaCacheKey, signWebhook, tableFromPath, verifyWebhook, where };