@boxrouter/sdk 0.0.1-alpha.0 → 0.12.190

package/dist/namespace-pricing.d.mts

@@ -0,0 +1,31 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
+import { HeyApiClient } from './namespace-base.mjs';
+import type { PricingVersionsData, PricingVersionsErrors, PricingVersionsResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare class Pricing extends HeyApiClient {
+    /**
+     * List the providers' live price versions
+     *
+     * Public: needs no key or session. Lists every live price version, which is what
+     * BoxRouter used to calculate sandbox costs, so a published cost can be
+     * rechecked without BoxRouter's database. Live versions never change. With `at`, returns
+     * only the version in effect at that time, one per provider; a provider with no version
+     * in effect then is left out. Effective periods include `effective_from` and exclude
+     * `effective_to` (`[effective_from, effective_to)`); the version taking over at a boundary
+     * applies at that instant.
+     *
+     */
+    versions<ThrowOnError extends boolean = true>(options?: Options<PricingVersionsData, ThrowOnError>): RequestResult<PricingVersionsResponses, PricingVersionsErrors, ThrowOnError, 'data'>;
+}

package/dist/namespace-pricing.mjs

@@ -0,0 +1,22 @@
+import { HeyApiClient } from './namespace-base.mjs';
+export class Pricing extends HeyApiClient {
+    /**
+     * List the providers' live price versions
+     *
+     * Public: needs no key or session. Lists every live price version, which is what
+     * BoxRouter used to calculate sandbox costs, so a published cost can be
+     * rechecked without BoxRouter's database. Live versions never change. With `at`, returns
+     * only the version in effect at that time, one per provider; a provider with no version
+     * in effect then is left out. Effective periods include `effective_from` and exclude
+     * `effective_to` (`[effective_from, effective_to)`); the version taking over at a boundary
+     * applies at that instant.
+     *
+     */
+    versions(options) {
+        return (options?.client ?? this.client).get({
+            responseStyle: 'data',
+            url: '/price-versions',
+            ...options
+        });
+    }
+}

package/dist/namespace-processes.d.mts

@@ -0,0 +1,125 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
+import { HeyApiClient } from './namespace-base.mjs';
+import type { ProcessesCancelData, ProcessesCancelErrors, ProcessesCancelResponses, ProcessesCloseStdinData, ProcessesCloseStdinErrors, ProcessesCloseStdinResponses, ProcessesReadData, ProcessesReadErrors, ProcessesReadResponses, ProcessesRemoveData, ProcessesRemoveErrors, ProcessesRemoveResponses, ProcessesStartData, ProcessesStartErrors, ProcessesStartResponses, ProcessesWriteStdinData, ProcessesWriteStdinErrors, ProcessesWriteStdinResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare class Processes extends HeyApiClient {
+    /**
+     * Start a durable background command
+     *
+     * Runs a command in the background in a Bash login shell and returns a process ID. The
+     * process keeps running between your calls: read its output, write to its input, or cancel
+     * it later, from any client. The sandbox's lifetime bounds how long it can run; cancel it to
+     * end it sooner.
+     *
+     * The sandbox image needs Linux `/proc`, Bash, and a few standard tools (`setsid`, `nohup`,
+     * `tail`, `base64`). If one is missing, the call fails with `unsupported_feature` before
+     * anything starts.
+     *
+     * `stdin` defaults to `false`. Setting it to `true`, to write to the process later, needs a
+     * sandbox created with the `processes.input` requirement and a route that supports writing to
+     * the process after it reconnects (`reattached_stdin`). To check ahead of time which routes
+     * qualify, send the same requirements to `POST /sandboxes/match`.
+     *
+     * With `wait_for_port`, the call returns once that port accepts TCP connections inside the
+     * sandbox. If the process exits first, or the port is still closed after 30 seconds, the
+     * process is ended and the call fails with `409 port_not_listening`. `details` carries
+     * `port`, `stdout_tail`, `stderr_tail` and, when the process exited, `exit_code`.
+     *
+     */
+    start<ThrowOnError extends boolean = true>(options: Options<ProcessesStartData, ThrowOnError>): RequestResult<ProcessesStartResponses, ProcessesStartErrors, ThrowOnError, 'data'>;
+    /**
+     * Delete a finished process's retained output
+     *
+     * Deletes the retained output and metadata for a finished process in the addressed sandbox. It does not stop a running process; that request returns 409. The SDK generates an Idempotency-Key when omitted; reuse a supplied key with the identical request to reconcile an uncertain result.
+     */
+    remove<ThrowOnError extends boolean = true>(options: Options<ProcessesRemoveData, ThrowOnError>): RequestResult<ProcessesRemoveResponses, ProcessesRemoveErrors, ThrowOnError, 'data'>;
+    /**
+     * Read process output from byte offsets
+     *
+     * **Process observation**
+     *
+     * You can rely on:
+     * - A completed result carries the exact exit status and the complete output; otherwise the call reports lost observation or incomplete output.
+     * - Output bytes are exact on every route (commands in byte mode stay exact everywhere).
+     *
+     * You can set: observation deadline. Reattach where the route supports it.
+     *
+     * Not promised: chunk sizes; immediate status visibility; output kept beyond the retained history.
+     *
+     * **Process wait**
+     *
+     * You can rely on:
+     * - Returns the exact observed exit status.
+     * - An observation deadline does not claim the process stopped.
+     *
+     * You can set: observation deadline.
+     *
+     * Returns up to 256 KiB per stream from the requested byte offsets. Pass the
+     * returned next offsets to continue without gaps or repeats. `exit_code` is set
+     * only after the process ended and both streams were read to their ends. Reads
+     * are non-blocking. If the provider replaced the guest session, the answer is
+     * 410 `expired`; the command is never run again.
+     *
+     */
+    read<ThrowOnError extends boolean = true>(options: Options<ProcessesReadData, ThrowOnError>): RequestResult<ProcessesReadResponses, ProcessesReadErrors, ThrowOnError, 'data'>;
+    /**
+     * Write process input
+     *
+     * You can rely on:
+     * - Input is delivered in order.
+     * - EOF is explicit.
+     * - Uncertain delivery is never resent.
+     * - Input is UTF-8 text on every route.
+     *
+     * You can set: data (text), EOF.
+     *
+     * Not promised: chunking on the wire.
+     *
+     * Append text to a process started with `stdin: true`. Calls from one client
+     * must be awaited sequentially to preserve input order. The selected route must
+     * support both `processes.input` and input after process reconnection
+     * (`reattached_stdin`); otherwise writes and EOF are refused as `unsupported_feature`
+     * before dispatch. Use `POST /sandboxes/match` with `requirements.processes.input`
+     * set to true to inspect eligible routes before create. If stdin is closed, return 409.
+     *
+     */
+    writeStdin<ThrowOnError extends boolean = true>(options: Options<ProcessesWriteStdinData, ThrowOnError>): RequestResult<ProcessesWriteStdinResponses, ProcessesWriteStdinErrors, ThrowOnError, 'data'>;
+    /**
+     * Send stdin EOF
+     *
+     * You can rely on:
+     * - Input is delivered in order.
+     * - EOF is explicit.
+     * - Uncertain delivery is never resent.
+     * - Input is UTF-8 text on every route.
+     *
+     * You can set: data (text), EOF.
+     *
+     * Not promised: chunking on the wire.
+     *
+     * Close only the input stream of a process started with stdin enabled; unsupported providers refuse before dispatch.
+     *
+     */
+    closeStdin<ThrowOnError extends boolean = true>(options: Options<ProcessesCloseStdinData, ThrowOnError>): RequestResult<ProcessesCloseStdinResponses, ProcessesCloseStdinErrors, ThrowOnError, 'data'>;
+    /**
+     * Cancel a durable process
+     *
+     * Ends the process and everything it started. This works on every sandbox; it needs no
+     * `processes.cancel` requirement. Cancelling a process that has already finished succeeds and
+     * changes nothing.
+     *
+     */
+    cancel<ThrowOnError extends boolean = true>(options: Options<ProcessesCancelData, ThrowOnError>): RequestResult<ProcessesCancelResponses, ProcessesCancelErrors, ThrowOnError, 'data'>;
+}

package/dist/namespace-processes.mjs

@@ -0,0 +1,184 @@
+import { HeyApiClient } from './namespace-base.mjs';
+export class Processes extends HeyApiClient {
+    /**
+     * Start a durable background command
+     *
+     * Runs a command in the background in a Bash login shell and returns a process ID. The
+     * process keeps running between your calls: read its output, write to its input, or cancel
+     * it later, from any client. The sandbox's lifetime bounds how long it can run; cancel it to
+     * end it sooner.
+     *
+     * The sandbox image needs Linux `/proc`, Bash, and a few standard tools (`setsid`, `nohup`,
+     * `tail`, `base64`). If one is missing, the call fails with `unsupported_feature` before
+     * anything starts.
+     *
+     * `stdin` defaults to `false`. Setting it to `true`, to write to the process later, needs a
+     * sandbox created with the `processes.input` requirement and a route that supports writing to
+     * the process after it reconnects (`reattached_stdin`). To check ahead of time which routes
+     * qualify, send the same requirements to `POST /sandboxes/match`.
+     *
+     * With `wait_for_port`, the call returns once that port accepts TCP connections inside the
+     * sandbox. If the process exits first, or the port is still closed after 30 seconds, the
+     * process is ended and the call fails with `409 port_not_listening`. `details` carries
+     * `port`, `stdout_tail`, `stderr_tail` and, when the process exited, `exit_code`.
+     *
+     */
+    start(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/sandboxes/{sandbox_id}/processes',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    /**
+     * Delete a finished process's retained output
+     *
+     * Deletes the retained output and metadata for a finished process in the addressed sandbox. It does not stop a running process; that request returns 409. The SDK generates an Idempotency-Key when omitted; reuse a supplied key with the identical request to reconcile an uncertain result.
+     */
+    remove(options) {
+        return (options.client ?? this.client).delete({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/sandboxes/{sandbox_id}/processes/{process_id}',
+            ...options
+        });
+    }
+    /**
+     * Read process output from byte offsets
+     *
+     * **Process observation**
+     *
+     * You can rely on:
+     * - A completed result carries the exact exit status and the complete output; otherwise the call reports lost observation or incomplete output.
+     * - Output bytes are exact on every route (commands in byte mode stay exact everywhere).
+     *
+     * You can set: observation deadline. Reattach where the route supports it.
+     *
+     * Not promised: chunk sizes; immediate status visibility; output kept beyond the retained history.
+     *
+     * **Process wait**
+     *
+     * You can rely on:
+     * - Returns the exact observed exit status.
+     * - An observation deadline does not claim the process stopped.
+     *
+     * You can set: observation deadline.
+     *
+     * Returns up to 256 KiB per stream from the requested byte offsets. Pass the
+     * returned next offsets to continue without gaps or repeats. `exit_code` is set
+     * only after the process ended and both streams were read to their ends. Reads
+     * are non-blocking. If the provider replaced the guest session, the answer is
+     * 410 `expired`; the command is never run again.
+     *
+     */
+    read(options) {
+        return (options.client ?? this.client).get({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/sandboxes/{sandbox_id}/processes/{process_id}',
+            ...options
+        });
+    }
+    /**
+     * Write process input
+     *
+     * You can rely on:
+     * - Input is delivered in order.
+     * - EOF is explicit.
+     * - Uncertain delivery is never resent.
+     * - Input is UTF-8 text on every route.
+     *
+     * You can set: data (text), EOF.
+     *
+     * Not promised: chunking on the wire.
+     *
+     * Append text to a process started with `stdin: true`. Calls from one client
+     * must be awaited sequentially to preserve input order. The selected route must
+     * support both `processes.input` and input after process reconnection
+     * (`reattached_stdin`); otherwise writes and EOF are refused as `unsupported_feature`
+     * before dispatch. Use `POST /sandboxes/match` with `requirements.processes.input`
+     * set to true to inspect eligible routes before create. If stdin is closed, return 409.
+     *
+     */
+    writeStdin(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/sandboxes/{sandbox_id}/processes/{process_id}/stdin',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    /**
+     * Send stdin EOF
+     *
+     * You can rely on:
+     * - Input is delivered in order.
+     * - EOF is explicit.
+     * - Uncertain delivery is never resent.
+     * - Input is UTF-8 text on every route.
+     *
+     * You can set: data (text), EOF.
+     *
+     * Not promised: chunking on the wire.
+     *
+     * Close only the input stream of a process started with stdin enabled; unsupported providers refuse before dispatch.
+     *
+     */
+    closeStdin(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/sandboxes/{sandbox_id}/processes/{process_id}/stdin/close',
+            ...options
+        });
+    }
+    /**
+     * Cancel a durable process
+     *
+     * Ends the process and everything it started. This works on every sandbox; it needs no
+     * `processes.cancel` requirement. Cancelling a process that has already finished succeeds and
+     * changes nothing.
+     *
+     */
+    cancel(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/sandboxes/{sandbox_id}/processes/{process_id}/cancel',
+            ...options
+        });
+    }
+}

package/dist/namespace-provider_accounts.d.mts

@@ -0,0 +1,156 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
+import { HeyApiClient } from './namespace-base.mjs';
+import type { ProviderAccountsConnectData, ProviderAccountsConnectErrors, ProviderAccountsConnectResponses, ProviderAccountsDisconnectData, ProviderAccountsDisconnectErrors, ProviderAccountsDisconnectResponses, ProviderAccountsGetData, ProviderAccountsGetErrors, ProviderAccountsGetResponses, ProviderAccountsListData, ProviderAccountsListErrors, ProviderAccountsListResponses, ProviderAccountsReplaceCredentialsData, ProviderAccountsReplaceCredentialsErrors, ProviderAccountsReplaceCredentialsResponses, ProviderAccountsSetupStandardImageData, ProviderAccountsSetupStandardImageErrors, ProviderAccountsSetupStandardImageResponses, ProviderAccountsTestCredentialsData, ProviderAccountsTestCredentialsErrors, ProviderAccountsTestCredentialsResponses, ProviderAccountsTestData, ProviderAccountsTestErrors, ProviderAccountsTestResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare class ProviderAccounts extends HeyApiClient {
+    /**
+     * List connected accounts
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. Returns your workspace's account metadata and the list of providers enabled for you;
+     * it never returns stored credentials.
+     *
+     */
+    list<ThrowOnError extends boolean = true>(options?: Options<ProviderAccountsListData, ThrowOnError>): RequestResult<ProviderAccountsListResponses, ProviderAccountsListErrors, ThrowOnError, 'data'>;
+    /**
+     * Connect a provider account
+     *
+     * Saves your own provider credentials so BoxRouter can run sandboxes on that account. Needs
+     * the `provider-accounts:manage` permission on the API key; a signed-in dashboard session also
+     * works. This permission is separate from the access that creates sandboxes.
+     *
+     * BoxRouter first makes one read-only request to the provider with the credentials. A clear
+     * rejection fails with `422 credentials_rejected`; an unreachable provider or an inconclusive
+     * answer does not block the save. The credentials are then stored encrypted and never
+     * returned. The account is enabled at once. Connecting starts no sandbox and prepares
+     * nothing in your provider account: the first sandbox that needs the standard image
+     * prepares it, or run the standard image setup to prepare it now.
+     *
+     * If the key matches one you already connected (same provider, settings and last four
+     * characters), the account is still connected and the response carries a
+     * `duplicate_credential` warning naming the other account. Connecting or testing an account
+     * whose provider is not enabled for you fails with `409 provider_not_enabled`.
+     *
+     * Provider connection settings, such as a custom URL or proxy, and credentials that run your
+     * code need extra authority on the key. Submitting a URL or proxy does not by itself give
+     * BoxRouter network access to that host. For credentials that run your code, send the ID of an
+     * artifact you uploaded; an unknown or expired artifact fails with `404`. The response
+     * returns account metadata only, never the code, configuration or tokens. Sending the same
+     * request again reuses the recorded outcome, and a request still waiting on the provider
+     * fails with `409` instead of running your code a second time.
+     *
+     * If the provider later answers with `401` or `403`, the account's status becomes
+     * `credentials_rejected`; the status carries a safe cause and the action that restores access.
+     *
+     */
+    connect<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsConnectData, ThrowOnError>): RequestResult<ProviderAccountsConnectResponses, ProviderAccountsConnectErrors, ThrowOnError, 'data'>;
+    /**
+     * Test provider credentials without saving them
+     *
+     * Checks credentials without saving them. Needs the `provider-accounts:manage` permission on
+     * the API key; a signed-in dashboard session also works. BoxRouter makes the same read-only
+     * request to the provider as when it tests a saved account, using the credentials in the body.
+     * Nothing is stored and no account is created or changed, so no idempotency key is needed.
+     *
+     * Credentials that run your code are not accepted here. Connection settings, such as a custom
+     * URL, are accepted and choose where the request goes; they need extra authority on the key,
+     * and submitting a URL or proxy does not by itself give BoxRouter network access to that host.
+     * The response returns the provider's own status and body, up to 4096 characters, without
+     * adding a validation message.
+     *
+     * Fails with `409 provider_not_enabled` when this provider is not enabled for you.
+     *
+     */
+    testCredentials<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsTestCredentialsData, ThrowOnError>): RequestResult<ProviderAccountsTestCredentialsResponses, ProviderAccountsTestCredentialsErrors, ThrowOnError, 'data'>;
+    /**
+     * Remove a connected account
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. Reject with 409 while owned
+     * resources, pending mutations or unresolved cleanup still depend on this
+     * credential. Never orphan sandboxes silently or transfer them to managed
+     * billing. Removes the stored secret; does not revoke the upstream token.
+     * For callable credentials, close all unreferenced factory workers and remove
+     * their retained code/configuration and acquired secrets. Pending acquisitions
+     * and retained credential-version dependencies also prevent disconnection.
+     *
+     * Removal waits for work already running on the account (standard-image setup,
+     * Actions runner-image checks), which can take minutes. With `wait=false` the
+     * request returns 202 at once with the account and `disconnect.state:
+     * disconnecting`, and finishes in the background: read the account until it
+     * returns 404 (removed) or `disconnect.state: failed`, whose `error` is the
+     * refusal this request would otherwise have returned, with the account still
+     * connected. Repeating the request while a removal runs returns the same 202 and
+     * starts nothing new.
+     *
+     */
+    disconnect<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsDisconnectData, ThrowOnError>): RequestResult<ProviderAccountsDisconnectResponses, ProviderAccountsDisconnectErrors, ThrowOnError, 'data'>;
+    /**
+     * Get connected-account metadata
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. The account must be visible within the caller's workspace. Never reveals
+     * key material.
+     *
+     */
+    get<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsGetData, ThrowOnError>): RequestResult<ProviderAccountsGetResponses, ProviderAccountsGetErrors, ThrowOnError, 'data'>;
+    /**
+     * Rotate a connected account's credentials
+     *
+     * Replaces a connected account's credentials, for example to rotate a key. Needs the
+     * `provider-accounts:manage` permission on the API key (a signed-in dashboard session also
+     * works) and the account's current `expected_version`.
+     *
+     * The new credentials must belong to the same provider. BoxRouter makes one read-only request
+     * to the provider and refuses a clear rejection with `422 credentials_rejected`; it does not
+     * check which account the key belongs to. Requests already running keep the old credentials,
+     * and requests that start afterward use the new ones. A provider that is not enabled for you
+     * fails with `409 provider_not_enabled`.
+     *
+     * Leave out the connection settings to keep the existing ones. Settings you send must match the
+     * existing route; changing the endpoint, proxy or header identity needs a new connected
+     * account, not a key rotation. Credentials that run your code need extra authority on the key
+     * and an artifact you uploaded. If the new credentials fail to activate, the old version stays
+     * in use. A token refresh that already happened with the provider is not undone.
+     *
+     */
+    replaceCredentials<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsReplaceCredentialsData, ThrowOnError>): RequestResult<ProviderAccountsReplaceCredentialsResponses, ProviderAccountsReplaceCredentialsErrors, ThrowOnError, 'data'>;
+    /**
+     * Test a saved provider account
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. The credential check makes one read-only provider request using the saved
+     * credentials and returns the provider's native status and body, limited to 4096 characters.
+     * A successful test can update account health and register provider event webhooks. It
+     * starts no sandbox and prepares no image; run the standard image setup to prepare the
+     * standard image before the first sandbox needs it. The response reports the credential
+     * check.
+     * Fails with `409 provider_not_enabled` when this provider is not enabled for you.
+     *
+     */
+    test<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsTestData, ThrowOnError>): RequestResult<ProviderAccountsTestResponses, ProviderAccountsTestErrors, ThrowOnError, 'data'>;
+    /**
+     * Run the standard image setup proof
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. This explicit action first tests the saved key, then boots the provider's
+     * standard image, runs a bounded command, and destroys the proof sandbox. The provider
+     * may charge for that short sandbox. Readiness is recorded only after boot, command and
+     * cleanup succeed; failure returns the unavailable state and its setup fix. Requests are
+     * idempotent and must include an idempotency key.
+     *
+     */
+    setupStandardImage<ThrowOnError extends boolean = true>(options: Options<ProviderAccountsSetupStandardImageData, ThrowOnError>): RequestResult<ProviderAccountsSetupStandardImageResponses, ProviderAccountsSetupStandardImageErrors, ThrowOnError, 'data'>;
+}